> ## Documentation Index
> Fetch the complete documentation index at: https://attend.hackclub.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API overview

> REST API for Attend, Hack Club's event management platform.

Attend runs registration, check-in, travel and safeguarding for Hack Club
events. This API is what the Attend mobile app talks to, and what trusted
server-to-server integrations use.

## Base URL

```
https://attend.hackclub.com/api/v1
```

## Authentication

Almost every endpoint takes a bearer token:

```http theme={null}
Authorization: Bearer <token>
```

There are four kinds, and which one you hold decides what you can reach:

| Token | Sets a current user | Reach |
| - | - | - |
| Mobile token | Yes | Whatever the signed-in user can see |
| Global API token | Yes | Its owner's full access, or only the scopes it was issued with |
| Series API key | No | Every event in one series, and creating new events in it |
| Event API key | No | One event, and only the endpoints that don't need a user |

The **API reference** tab notes which tokens each endpoint accepts, and which
scopes apply.

## Getting a token

Mobile tokens come from `POST /session`. Series and event keys are issued from
the Attend dashboard by someone who owns the series or administers the event.
Global API tokens are issued by a superadmin.

## Setting up an event end to end

An event can be provisioned without anyone opening the dashboard. Everything
below takes a series API key, which is also the only credential that can create
an event in the first place.

```bash theme={null}
# 1. Create it. Name and support email are required; schedule, location and
#    module toggles can all come in the same call, or later via PATCH.
curl -X POST https://attend.hackclub.com/api/v1/series/current/events \
  -H "Authorization: Bearer $ATTEND_KEY" -H "Content-Type: application/json" \
  -d '{"event":{"name":"Sunbeam Summer","support_email":"sunbeam@hackclub.com",
       "starts_at":"2026-10-01T09:00:00Z","ends_at":"2026-10-04T17:00:00Z"}}'

# 2. Waivers. `auto` clones the standard templates and wires up their field
#    mappings; `manual` takes DocuSeal template ids you made yourself.
curl -X PUT https://attend.hackclub.com/api/v1/events/sunbeam-summer/setup/waivers \
  -H "Authorization: Bearer $ATTEND_KEY" -H "Content-Type: application/json" \
  -d '{"mode":"auto"}'

# 3. Staff. Someone who has never signed in gets an account that links up on
#    their first sign-in, and an email telling them what they can now do.
curl -X POST https://attend.hackclub.com/api/v1/events/sunbeam-summer/staff \
  -H "Authorization: Bearer $ATTEND_KEY" -H "Content-Type: application/json" \
  -d '{"email":"organizer@example.com","role":"event_admin"}'

# 4. Take it out of draft. GET /setup first if you want to see what's left.
curl -X POST https://attend.hackclub.com/api/v1/events/sunbeam-summer/setup/complete \
  -H "Authorization: Bearer $ATTEND_KEY"
```

Participants are then invited with `POST /events/{id}/participants`, corrected
with `PATCH /events/{id}/participants/{id}` (which also withdraws and reinstates
them), and removed from the event with `DELETE` on the same path.

## Rate limits and errors

Errors are JSON, with an `error` key describing what went wrong. A `401` means
the token is missing, expired or revoked; a `403` means the token is valid but
its scope or event doesn't cover the request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.