For developers: event webhooks and read API

For developers: event webhooks and the read API

Last updated: 26 September 2026

If your organisation works with its own system – a spreadsheet, a registration system, a mailing tool – it can be told about each new thing in your event as it happens: a new registration, a paper submitted, a review decision, a seat freed for someone on the waiting list.

No special account is needed: the organiser opens “Connect your systems” from the “For the organiser” box on the event page and pastes in a link taken from that system, or from a service such as Zapier. The rest of this page is detail for the developer who prepares that link.

Zapier in three steps

In Zapier, start a Zap with Webhooks by Zapier → Catch Hook and copy the URL it gives you.
On your event page: “Connect your systems” → paste the URL → “Save webhook” → “Test”. Zapier receives a ping message and reads the fields from it.
Finish the Zap with whatever you need: a row in a Google Sheet, a Slack message, a contact in your CRM. Turn it on.

The same works with Make, n8n, and any server that accepts a POST.

What is sent

Event `kind`	When	Inside `data`
`registration.created`	a member registered	`registration`
`registration.accepted`	the organiser accepted a registration	`registration`
`registration.rejected`	the organiser declined a registration	`registration`
`registration.cancelled`	a registration was cancelled (by its holder or the organiser)	`registration`
`waitlist.joined`	capacity was reached and a member joined the waiting list	`registration`
`waitlist.promoted`	a seat freed and the earliest waiting member took it	`registration`
`submission.created`	an abstract or paper was uploaded	`submission`
`submission.decided`	a submission's status changed (accept / reject / revise)	`submission`
`ping`	the organiser pressed “Test”	`message`

Message shape

A POST with a UTF-8 JSON body and three headers of its own:

POST https://your-endpoint.example/hook
Content-Type: application/json
X-EventSheets-Event: registration.created
X-EventSheets-Delivery: 7c1e…-uuid
X-EventSheets-Signature: sha256=<hex>

{
  "id": "7c1e0a5e-…",
  "kind": "registration.created",
  "occurred_at": "2026-11-07T09:30:12+00:00",
  "event": { "id": 1461, "title": "…", "title_en": "…", "url": "https://eventsheets.com/ar/events/details?event_id=1461" },
  "data": {
    "registration": {
      "registration_id": 5120,
      "type": "participant",            // attendee | participant
      "status": "accepted",             // pending | accepted | rejected | waitlisted
      "registered_at": "2026-11-07 09:30:12",
      "member": { "id": 193, "name": "…", "email": "…", "country": "…" }
    }
  }
}

For submission events, submission takes the place of registration: submission_id, title, kind (abstract or full_paper), status (pending | accepted | rejected | revise), submitted_at, and author with the same fields as a member. The file itself is never sent; it is downloaded from the event page under the organiser's own access.

Verifying the signature

Each webhook has a secret, shown to the organiser on the same screen. The signature is HMAC-SHA256 of the request body exactly as received, keyed with that secret, in hex. Verify it before trusting a message: the URL itself may be known to others.

// PHP
$body = file_get_contents('php://input');
$sig  = $_SERVER['HTTP_X_EVENTSHEETS_SIGNATURE'] ?? '';
$ok   = hash_equals('sha256=' . hash_hmac('sha256', $body, $secret), $sig);

// Node
const ok = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex') === req.get('X-EventSheets-Signature');

What the site does, and does not do

No retries. Each event is sent once, and the site waits up to six seconds for an answer. A 2xx answer means “delivered”; anything else is logged as a failure in the webhook's log, which the organiser can read.
Twenty consecutive failures switch the webhook off, and the log says so. One button turns it back on.
https only, to a public server whose name resolves; private addresses and bare IPs are refused.
The event is sent after the visitor's page has been answered, so a slow endpoint of yours never slows a registration.
At most three webhooks per event, and each may choose which kinds it wants.
X-EventSheets-Delivery is unique per delivery; use it to ignore duplicates if you store messages.

The read API

Published events can be read without a key from GET /api/event (a list) and GET /api/event/{id} (one event), as JSON carrying the fields the public page shows. Unpublished events are never returned. Every event page also carries structured data (JSON-LD of type Event) and an .ics file, which are the simplest route for a machine reader.

Tell us

If you need an event that is not in the list, or a field that is missing, write to us from the contact page and say what you are connecting. The list above grows with what organisers actually ask for.