For developers: event webhooks and read API

For developers: event webhooks and the read API

Last updated: 26 September 2026

Whatever happens on your event here can reach your own system the moment it happens: a new registration, a seat handed over from the waiting list, a paper submitted, a review decision. No API key and no special account: the event's organiser opens “Connect your systems” from the “For the organiser” box on the event page and adds a URL. Everything below describes what arrives at that URL.

Zapier in three steps

In Zapier, start a Zap with Webhooks by Zapier → Catch Hook and copy the URL it gives you.
On your event page: “Connect your systems” → paste the URL → “Save webhook” → “Test”. Zapier receives a ping message and reads the fields from it.
Finish the Zap with whatever you need: a row in a Google Sheet, a Slack message, a contact in your CRM. Turn it on.

The same works with Make, n8n, and any server that accepts a POST.

What is sent

Event `kind`	When	Inside `data`
`registration.created`	a member registered	`registration`
`registration.accepted`	the organiser accepted a registration	`registration`
`registration.rejected`	the organiser declined a registration	`registration`
`registration.cancelled`	a registration was cancelled (by its holder or the organiser)	`registration`
`waitlist.joined`	capacity was reached and a member joined the waiting list	`registration`
`waitlist.promoted`	a seat freed and the earliest waiting member took it	`registration`
`submission.created`	an abstract or paper was uploaded	`submission`
`submission.decided`	a submission's status changed (accept / reject / revise)	`submission`
`ping`	the organiser pressed “Test”	`message`

Message shape

A POST with a UTF-8 JSON body and three headers of its own:

POST https://your-endpoint.example/hook
Content-Type: application/json
X-EventSheets-Event: registration.created
X-EventSheets-Delivery: 7c1e…-uuid
X-EventSheets-Signature: sha256=<hex>

{
  "id": "7c1e0a5e-…",
  "kind": "registration.created",
  "occurred_at": "2026-11-07T09:30:12+00:00",
  "event": { "id": 1461, "title": "…", "title_en": "…", "url": "https://eventsheets.com/ar/events/details?event_id=1461" },
  "data": {
    "registration": {
      "registration_id": 5120,
      "type": "participant",            // attendee | participant
      "status": "accepted",             // pending | accepted | rejected | waitlisted
      "registered_at": "2026-11-07 09:30:12",
      "member": { "id": 193, "name": "…", "email": "…", "country": "…" }
    }
  }
}

For submission events, submission takes the place of registration: submission_id, title, kind (abstract or full_paper), status (pending | accepted | rejected | revise), submitted_at, and author with the same fields as a member. The file itself is never sent; it is downloaded from the event page under the organiser's own access.

Verifying the signature

Each webhook has a secret, shown to the organiser on the same screen. The signature is HMAC-SHA256 of the request body exactly as received, keyed with that secret, in hex. Verify it before trusting a message: the URL itself may be known to others.

// PHP
$body = file_get_contents('php://input');
$sig  = $_SERVER['HTTP_X_EVENTSHEETS_SIGNATURE'] ?? '';
$ok   = hash_equals('sha256=' . hash_hmac('sha256', $body, $secret), $sig);

// Node
const ok = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex') === req.get('X-EventSheets-Signature');

What the site does, and does not do

No retries. Each event is sent once, and the site waits up to six seconds for an answer. A 2xx answer means “delivered”; anything else is logged as a failure in the webhook's log, which the organiser can read.
Twenty consecutive failures switch the webhook off, and the log says so. One button turns it back on.
https only, to a public server whose name resolves; private addresses and bare IPs are refused.
The event is sent after the visitor's page has been answered, so a slow endpoint of yours never slows a registration.
At most three webhooks per event, and each may choose which kinds it wants.
X-EventSheets-Delivery is unique per delivery; use it to ignore duplicates if you store messages.

The read API

Published events can be read without a key from GET /api/event (a list) and GET /api/event/{id} (one event), as JSON carrying the fields the public page shows. Unpublished events are never returned. Every event page also carries structured data (JSON-LD of type Event) and an .ics file, which are the simplest route for a machine reader.

Tell us

If you need an event that is not in the list, or a field that is missing, write to us from the contact page and say what you are connecting. The list above grows with what organisers actually ask for.