Skip to content
E-Ticket
fr

Developers

API documentation

The E-Ticket API gives organisers programmatic access to their ticketing: events, categories and ticket types, orders and issued tickets, attendance, promo codes, accreditations and entrance control. It is part of the Basic and Custom plans.

Get started in three steps

Every request carries an API key in the Authorization header. A key belongs to an organiser account and only reaches its own events.

  1. Open the “My plan” tab in your organiser space.
  2. Create a key, name it and pick its permissions: read, write, entrance control.
  3. Copy it right away — it is shown only once — then call the API:
curl https://ticket.e-cosplay.fr/api/public/v1/events?when=upcoming \
  -H "Authorization: Bearer etk_live_VOTRE_CLE"

Conventions

  • Base URL:https://ticket.e-cosplay.fr/api/public/v1
  • Amounts in cents, excluding tax; never a floating-point number for money.
  • ISO 8601 dates in UTC (“2026-10-03T18:00:00.000Z”).
  • Lists are paginated with page and limit (100 max) and returned with data, page, limit and total.
  • Errors: an object with an error field (stable code), plus fields for invalid input (422).
  • 600 requests per minute per key; X-RateLimit-* and Retry-After headers.
  • Permissions: read, write (tickets, promo codes, accreditations, order resend), scan (entrance control).

OpenAPI 3.1 file (JSON) — import it into Postman, Bruno, Insomnia or a client generator. Route descriptions are in French.

Linked accounts — OAuth 2.0 sign-in

Your users sign in with their E-Ticket account, and your application walks away with an API key of its own. It never sees their password, and the key carries your application name: anyone can cut the link without touching their other access.

  1. Register your application: you receive a client_id and, unless it is a mobile app, a client_secret.
  2. Send the user to /api/oauth/authorize. They sign in, see what you are asking for, and accept.
  3. Your return address receives a single-use code, valid for ten minutes.
  4. Exchange that code at /api/oauth/token: the response carries the key and the linked account.
# 1. l'utilisateur ouvre cette adresse et autorise l'application
https://ticket.e-cosplay.fr/api/oauth/authorize
  ?response_type=code
  &client_id=etkapp_VOTRE_APPLI
  &redirect_uri=https://mon-appli.fr/callback
  &scope=identity+read
  &state=UNE_VALEUR_ALEATOIRE
  &code_challenge=BASE64URL(SHA256(verifier))
  &code_challenge_method=S256

# 2. votre callback reçoit ?code=… : échangez-le contre la clé
curl -X POST https://ticket.e-cosplay.fr/api/oauth/token \
  -d grant_type=authorization_code \
  -d code=LE_CODE_RECU \
  -d redirect_uri=https://mon-appli.fr/callback \
  -d client_id=etkapp_VOTRE_APPLI \
  -d client_secret=etksec_VOTRE_SECRET \
  -d code_verifier=LE_VERIFIER

# 3. la réponse contient la clé du compte lié
{ "access_token": "etk_live_…", "token_type": "Bearer",
  "scope": "identity read", "account": { "email": "…" } }
  • PKCE (S256) is required for an application without a secret — mobile or web page — and verified everywhere else when supplied.
  • A new authorisation rotates the key: the old one stops working immediately. A replayed code revokes the link.
  • /api/oauth/userinfo says who owns a key; /api/oauth/revoke hands it back.
  • Server metadata: https://ticket.e-cosplay.fr/api/oauth/metadata

Applications are registered by the association, for its own use: there is no open sign-up. This chapter describes the flow for the ones that exist.

Loading the API description…