Developer documentation

Attendee registration API

Connect your CRM, online store or ticketing platform to QRACCESS: create attendees straight from your own system and, in the same call, send each one their badge with its QR code by email and/or SMS.

Built for external registrations β€” when sign-ups are already collected somewhere else and all you need is for them to land in QRACCESS with a badge ready for QR check-in at the door.

Pricing and how the API is enabled

The API is not open by default: the QRACCESS team switches it on for your account. The integration setup is quoted case by case β€” ask for a quote telling us which system you want to connect.

1. Request it

Tell us which group or event you want to integrate.

2. Get your key

We generate an API key tied to that group, optionally restricted to your IP addresses.

3. Integrate

Your system calls the create endpoint with that key.

Each attendee created through the API consumes attendee credit from your balance, exactly like one added from the dashboard β€” the price per attendee is the same either way. If the balance runs out, the API returns a clear error and does not create the record. And if you only need a one-off load rather than a live integration, importing attendees from a spreadsheet may be all it takes β€” no API involved.

Authentication

Send your key in the X-Api-Key header. Authorization: Bearer is also accepted and, for compatibility, an api_key field in the request body.

  • The key identifies the group: every attendee it creates lands in the group the key belongs to.
  • If you contracted the IP restriction, calls from any other address are rejected with 403.
  • Rate limit: 60 requests per minute per key (120 per IP). Above that, the API returns 429.
  • Treat the key like a password: never embed it in client-side code or on public pages.

Creating an attendee

POST {YOUR_DOMAIN}/api/v1/insert-assistant

curl -X POST "https://control.qraccess.com/api/v1/insert-assistant" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "client_uuid": "order-8842",
        "send_email": true,
        "send_sms": true,
        "data": {
          "Name": "Emily Carter",
          "Email": "emily@example.com",
          "Phone": "+447700900123"
        }
      }'

The same example in PHP

<?php

$apiKey = 'YOUR_API_KEY';
$url    = 'https://control.qraccess.com/api/v1/insert-assistant';

$payload = [
    // Your own identifier for the operation: repeating the call with
    // the same value will not create a duplicate attendee.
    'client_uuid' => 'order-8842',
    'send_email'  => true,
    'send_sms'    => true,
    'data' => [
        'Name'  => 'Emily Carter',
        'Email' => 'emily@example.com',
        'Phone' => '+447700900123',
    ],
];

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'X-Api-Key: ' . $apiKey,
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_UNICODE),
    CURLOPT_TIMEOUT    => 30,
]);

$body   = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$res = json_decode($body, true);

if ($status === 200 && ($res['success'] ?? false)) {
    // Store the qr_code: it is the code validated at the door.
    $qr = $res['data']['qr_code'];
    // Deliveries are reported separately: the attendee is created
    // even if a delivery fails.
    $emailOk = $res['data']['email_sent'] ?? null;
    $smsOk   = $res['data']['sms_sent'] ?? null;
} elseif ($status === 429) {
    // Rate limited: retry later (with the SAME client_uuid).
} else {
    // 401 bad key, 403 IP not allowed, 422 invalid data or no
    // attendee credit left.
    error_log('QRACCESS ' . $status . ': ' . $body);
}

Parameters

FieldTypeRequiredDescription
dataobjectYesOne value for every active field of the group. The key of each value is the field label exactly as it reads in the dashboard.
client_uuidstring (≀64)NoYour identifier for the operation. Repeating the call with the same value returns the attendee already created instead of duplicating it. Strongly recommended.
send_emailbooleanNoEmails the badge to the attendee's address.
send_smsbooleanNoSends the badge by SMS to the attendee's phone.
attach_pkpassbooleanNoAttaches the Apple Wallet pass to the email (requires Wallet to be configured).
languagestringNoes, en or fr. Defaults to the group's language.

Important: data must include all the active fields of the group, not just the required ones. Any extra or missing field makes the response a 422. If you add a new field to the group, update your integration as well.

Successful response

{
  "success": true,
  "message": "Attendee created successfully",
  "data": {
    "id": "…",
    "qr_code": "A1B2C3D4E5",
    "group_id": "…",
    "created_at": "2026-08-04T10:15:00.000000Z",
    "email_sent": true,
    "sms_sent": true
  }
}

The qr_code is the code that will be validated at the door. Store it if you want to link the attendee back to your own system.

Updating an attendee

POST {YOUR_DOMAIN}/api/v1/update-assistant

Same as the create call, plus a qr_code to identify the attendee. Only the fields you send with a value are updated; anything you omit is kept. You can resend the badge with send_email or send_sms.

curl -X POST "https://control.qraccess.com/api/v1/update-assistant" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "qr_code": "A1B2C3D4E5", "data": { "Company": "New Company Ltd" } }'

Safe retries

If your system loses the connection right after sending a request, it cannot know whether the attendee was created. Blindly retrying would create a duplicate attendee β€” and a duplicate email.

  • Send your own client_uuid with every create call (your order or registration ID, for example).
  • If you repeat the call with the same value, QRACCESS returns the attendee it already created, flagged with "idempotent": true.
  • No second record is created and the badge is not sent again.

Response codes

CodeMeaning
200OK (or idempotent retry).
401Missing or invalid key.
403IP not allowed.
404Attendee or group not found.
422Invalid data, or no attendee credit left.
429Too many requests.

How the badge is delivered

  • Email: composed with your group's template, with the badge attached as a PDF. If you have your own SMTP server configured, it goes out from your domain (see the SMTP guide).
  • SMS: sent with your SMS credentials and includes the link to the attendee's QR code.
  • If a delivery fails (a malformed phone number, SMTP not configured), the attendee is still created and the response says so in email_sent and sms_sent. Your integration can retry just the delivery.
  • Every delivery is logged β€” recipient, channel, result, date and origin of the call β€” so you can audit it later.
Integrations

Want to connect your system to QRACCESS?

Tell us what you need to integrate and we will send you a setup quote along with test credentials.

Try it right away

Would you like to try QRACCESS at your next event?

Create an account and start setting up your first event from the web control panel.

Control panel: https://control.qraccess.com

πŸš€ Crear cuenta gratuita