EventSheets

For developers: event webhooks and the read API

Last updated: 26 September 2026

Whatever happens on your event here can reach your own system the moment it happens: a new registration, a seat handed over from the waiting list, a paper submitted, a review decision. No API key and no special account: the event's organiser opens “Connect your systems” from the “For the organiser” box on the event page and adds a URL. Everything below describes what arrives at that URL.

Zapier in three steps

1. In Zapier, start a Zap with Webhooks by Zapier → Catch Hook and copy the URL it gives you.
2. On your event page: “Connect your systems” → paste the URL → “Save webhook” → “Test”. Zapier receives a ping message and reads the fields from it.
3. Finish the Zap with whatever you need: a row in a Google Sheet, a Slack message, a contact in your CRM. Turn it on.

The same works with Make, n8n, and any server that accepts a POST.

What is sent

Event kind	When	Inside data
registration.created	a member registered	registration
registration.accepted	the organiser accepted a registration	registration
registration.rejected	the organiser declined a registration	registration
registration.cancelled	a registration was cancelled (by its holder or the organiser)	registration
waitlist.joined	capacity was reached and a member joined the waiting list	registration
waitlist.promoted	a seat freed and the earliest waiting member took it	registration
submission.created	an abstract or paper was uploaded	submission
submission.decided	a submission's status changed (accept / reject / revise)	submission
ping	the organiser pressed “Test”	message

Message shape

A POST with a UTF-8 JSON body and three headers of its own:

POST https://your-endpoint.example/hook
Content-Type: application/json
X-EventSheets-Event: registration.created
X-EventSheets-Delivery: 7c1e…-uuid
X-EventSheets-Signature: sha256=<hex>

{
  "id": "7c1e0a5e-…",
  "kind": "registration.created",
  "occurred_at": "2026-11-07T09:30:12+00:00",
  "event": { "id": 1461, "title": "…", "title_en": "…", "url": "https://eventsheets.com/ar/events/details?event_id=1461" },
  "data": {
    "registration": {
      "registration_id": 5120,
      "type": "participant",            // attendee | participant
      "status": "accepted",             // pending | accepted | rejected | waitlisted
      "registered_at": "2026-11-07 09:30:12",
      "member": { "id": 193, "name": "…", "email": "…", "country": "…" }
    }
  }
}

For submission events, submission takes the place of registration: submission_id, title, kind (abstract or full_paper), status (pending | accepted | rejected | revise), submitted_at, and author with the same fields as a member. The file itself is never sent; it is downloaded from the event page under the organiser's own access.

Verifying the signature

Each webhook has a secret, shown to the organiser on the same screen. The signature is HMAC-SHA256 of the request body exactly as received, keyed with that secret, in hex. Verify it before trusting a message: the URL itself may be known to others.

// PHP
$body = file_get_contents('php://input');
$sig  = $_SERVER['HTTP_X_EVENTSHEETS_SIGNATURE'] ?? '';
$ok   = hash_equals('sha256=' . hash_hmac('sha256', $body, $secret), $sig);

// Node
const ok = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex') === req.get('X-EventSheets-Signature');

What the site does, and does not do

• No retries. Each event is sent once, and the site waits up to six seconds for an answer. A 2xx answer means “delivered”; anything else is logged as a failure in the webhook's log, which the organiser can read.
• Twenty consecutive failures switch the webhook off, and the log says so. One button turns it back on.
• https only, to a public server whose name resolves; private addresses and bare IPs are refused.
• The event is sent after the visitor's page has been answered, so a slow endpoint of yours never slows a registration.
• At most three webhooks per event, and each may choose which kinds it wants.
• X-EventSheets-Delivery is unique per delivery; use it to ignore duplicates if you store messages.

The read API

Published events can be read without a key from GET /api/event (a list) and GET /api/event/{id} (one event), as JSON carrying the fields the public page shows. Unpublished events are never returned. Every event page also carries structured data (JSON-LD of type Event) and an .ics file, which are the simplest route for a machine reader.

Tell us

If you need an event that is not in the list, or a field that is missing, write to us from the contact page and say what you are connecting. The list above grows with what organisers actually ask for.