Request and response rules

URL shapes, input formats, success responses, and write restrictions.

URL shapes

Most resources in this cookbook are event-level resources:

POST  /api/core/organizations/{organization_id}/events/{event_id}/{resource}
PATCH /api/core/organizations/{organization_id}/events/{event_id}/{resource}/{id}

events is organization-level and uses:

PATCH /api/core/organizations/{organization_id}/events/{id}

Request bodies

Core writes use a flat JSON object. Do not wrap the request in JSON:API data, type, or attributes objects.

Request keys use snake_case. Response attributes use kebab-case.

PATCH is partial unless a field is explicitly documented as full replacement. Omitted fields retain their current values. A supplied empty array commonly means “replace this collection with no items”; it is not the same as omitting the field.

Only fields selected in the token scope are mapped into a mutation. Unselected parameters are ignored. Some resource mutations deliberately use a smaller action-specific subset; those cases are marked Ignored on POST, Ignored on PATCH, or Rejected on PATCH in the tables below.

Success responses

Successful creates return 201 Created; successful updates return 200 OK.

The response is JSON:API, but its attributes are selected by the scope’s Write response fields. id is always included. For example, if a lead scope selects sponsor_ids, registrant_id, notes, and updated_at, a write response has this shape:

{
  "data": {
    "id": "3898",
    "type": "lead",
    "attributes": {
      "sponsor-ids": [103705],
      "registrant-id": 1201,
      "notes": "Requested pricing information",
      "updated-at": "2026-08-25T12:00:00Z"
    }
  }
}

If no write-response fields are selected, the successful response still contains data.id and data.type, but no resource attributes should be assumed.

Boundaries, restrictions, and errors

• Event-level records and referenced parents must belong to the event in the URL.
• A body event_id or organization_id that conflicts with the URL returns 400 Bad Request.
• Missing records, out-of-event references, and records hidden by row restrictions normally return 404 Not Found.
• Invalid values and business-rule failures normally return 422 Unprocessable Entity.
• A disabled scope, missing action, missing required write-field grant, or disallowed operation returns 403 Forbidden.
• Creates are rechecked against the scope’s row restrictions. A created record that would be invisible to the same scope is rolled back.
• Scalar fields reject arrays and objects. Array fields require an array of scalar values. Raw fields accept the nested shapes documented below.