Attendee registration API
Connect your CRM, online store or ticketing platform to QRACCESS: create attendees straight from your own system and, in the same call, send each one their badge with its QR code by email and/or SMS.
Built for external registrations β when sign-ups are already collected somewhere else and all you need is for them to land in QRACCESS with a badge ready for QR check-in at the door.
Pricing and how the API is enabled
The API is not open by default: the QRACCESS team switches it on for your account. The integration setup is quoted case by case β ask for a quote telling us which system you want to connect.
1. Request it
Tell us which group or event you want to integrate.
2. Get your key
We generate an API key tied to that group, optionally restricted to your IP addresses.
3. Integrate
Your system calls the create endpoint with that key.
Each attendee created through the API consumes attendee credit from your balance, exactly like one added from the dashboard β the price per attendee is the same either way. If the balance runs out, the API returns a clear error and does not create the record. And if you only need a one-off load rather than a live integration, importing attendees from a spreadsheet may be all it takes β no API involved.
Authentication
Send your key in the X-Api-Key header. Authorization: Bearer
is also accepted and, for compatibility, an api_key field in the request body.
- The key identifies the group: every attendee it creates lands in the group the key belongs to.
- If you contracted the IP restriction, calls from any other address are rejected with
403. - Rate limit: 60 requests per minute per key (120 per IP). Above that, the API returns
429. - Treat the key like a password: never embed it in client-side code or on public pages.
Creating an attendee
POST {YOUR_DOMAIN}/api/v1/insert-assistant
curl -X POST "https://control.qraccess.com/api/v1/insert-assistant" \
-H "X-Api-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"client_uuid": "order-8842",
"send_email": true,
"send_sms": true,
"data": {
"Name": "Emily Carter",
"Email": "emily@example.com",
"Phone": "+447700900123"
}
}'
The same example in PHP
<?php
$apiKey = 'YOUR_API_KEY';
$url = 'https://control.qraccess.com/api/v1/insert-assistant';
$payload = [
// Your own identifier for the operation: repeating the call with
// the same value will not create a duplicate attendee.
'client_uuid' => 'order-8842',
'send_email' => true,
'send_sms' => true,
'data' => [
'Name' => 'Emily Carter',
'Email' => 'emily@example.com',
'Phone' => '+447700900123',
],
];
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'X-Api-Key: ' . $apiKey,
'Content-Type: application/json',
'Accept: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_UNICODE),
CURLOPT_TIMEOUT => 30,
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
$res = json_decode($body, true);
if ($status === 200 && ($res['success'] ?? false)) {
// Store the qr_code: it is the code validated at the door.
$qr = $res['data']['qr_code'];
// Deliveries are reported separately: the attendee is created
// even if a delivery fails.
$emailOk = $res['data']['email_sent'] ?? null;
$smsOk = $res['data']['sms_sent'] ?? null;
} elseif ($status === 429) {
// Rate limited: retry later (with the SAME client_uuid).
} else {
// 401 bad key, 403 IP not allowed, 422 invalid data or no
// attendee credit left.
error_log('QRACCESS ' . $status . ': ' . $body);
}
Parameters
| Field | Type | Required | Description |
|---|---|---|---|
data | object | Yes | One value for every active field of the group. The key of each value is the field label exactly as it reads in the dashboard. |
client_uuid | string (β€64) | No | Your identifier for the operation. Repeating the call with the same value returns the attendee already created instead of duplicating it. Strongly recommended. |
send_email | boolean | No | Emails the badge to the attendee's address. |
send_sms | boolean | No | Sends the badge by SMS to the attendee's phone. |
attach_pkpass | boolean | No | Attaches the Apple Wallet pass to the email (requires Wallet to be configured). |
language | string | No | es, en or fr. Defaults to the group's language. |
Important:
datamust include all the active fields of the group, not just the required ones. Any extra or missing field makes the response a422. If you add a new field to the group, update your integration as well.
Successful response
{
"success": true,
"message": "Attendee created successfully",
"data": {
"id": "β¦",
"qr_code": "A1B2C3D4E5",
"group_id": "β¦",
"created_at": "2026-08-04T10:15:00.000000Z",
"email_sent": true,
"sms_sent": true
}
}
The qr_code is the code that will be validated at the door. Store it if
you want to link the attendee back to your own system.
Updating an attendee
POST {YOUR_DOMAIN}/api/v1/update-assistant
Same as the create call, plus a qr_code to identify the attendee. Only the fields
you send with a value are updated; anything you omit is kept. You can resend the badge with
send_email or send_sms.
curl -X POST "https://control.qraccess.com/api/v1/update-assistant" \
-H "X-Api-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "qr_code": "A1B2C3D4E5", "data": { "Company": "New Company Ltd" } }'
Safe retries
If your system loses the connection right after sending a request, it cannot know whether the attendee was created. Blindly retrying would create a duplicate attendee β and a duplicate email.
- Send your own
client_uuidwith every create call (your order or registration ID, for example). - If you repeat the call with the same value, QRACCESS returns the attendee it already created, flagged with
"idempotent": true. - No second record is created and the badge is not sent again.
Response codes
| Code | Meaning |
|---|---|
200 | OK (or idempotent retry). |
401 | Missing or invalid key. |
403 | IP not allowed. |
404 | Attendee or group not found. |
422 | Invalid data, or no attendee credit left. |
429 | Too many requests. |
How the badge is delivered
- Email: composed with your group's template, with the badge attached as a PDF. If you have your own SMTP server configured, it goes out from your domain (see the SMTP guide).
- SMS: sent with your SMS credentials and includes the link to the attendee's QR code.
- If a delivery fails (a malformed phone number, SMTP not configured), the attendee is still created and the response says so in
email_sentandsms_sent. Your integration can retry just the delivery. - Every delivery is logged β recipient, channel, result, date and origin of the call β so you can audit it later.
Want to connect your system to QRACCESS?
Tell us what you need to integrate and we will send you a setup quote along with test credentials.
Would you like to try QRACCESS at your next event?
Create an account and start setting up your first event from the web control panel.
Control panel: https://control.qraccess.com