---
title: "Request and response rules"
description: "URL shapes, input formats, success responses, and write restrictions."
lastModified: "2026-08-25"
---

## URL shapes

Most resources in this cookbook are event-level resources:

```
POST  /api/core/organizations/{organization_id}/events/{event_id}/{resource}
PATCH /api/core/organizations/{organization_id}/events/{event_id}/{resource}/{id}
```

`events` is organization-level and uses:

```
PATCH /api/core/organizations/{organization_id}/events/{id}
```

## Request bodies

Core writes use a flat JSON object. Do not wrap the request in JSON:API `data`, `type`, or `attributes` objects.

Request keys use `snake_case`. Response attributes use `kebab-case`.

`PATCH` is partial unless a field is explicitly documented as full replacement. Omitted fields retain their current values. A supplied empty array commonly means “replace this collection with no items”; it is not the same as omitting the field.

Only fields selected in the token scope are mapped into a mutation. Unselected parameters are ignored. Some resource mutations deliberately use a smaller action-specific subset; those cases are marked **Ignored on POST**, **Ignored on PATCH**, or **Rejected on PATCH** in the tables below.

## Success responses

Successful creates return `201 Created`; successful updates return `200 OK`.

The response is JSON:API, but its attributes are selected by the scope's **Write response fields**. `id` is always included. For example, if a lead scope selects `sponsor_ids`, `registrant_id`, `notes`, and `updated_at`, a write response has this shape:

```json
{
  "data": {
    "id": "3898",
    "type": "lead",
    "attributes": {
      "sponsor-ids": [103705],
      "registrant-id": 1201,
      "notes": "Requested pricing information",
      "updated-at": "2026-08-25T12:00:00Z"
    }
  }
}
```

If no write-response fields are selected, the successful response still contains `data.id` and `data.type`, but no resource attributes should be assumed.

## Boundaries, restrictions, and errors

- Event-level records and referenced parents must belong to the event in the URL.  
- A body `event_id` or `organization_id` that conflicts with the URL returns `400 Bad Request`.  
- Missing records, out-of-event references, and records hidden by row restrictions normally return `404 Not Found`.  
- Invalid values and business-rule failures normally return `422 Unprocessable Entity`.  
- A disabled scope, missing action, missing required write-field grant, or disallowed operation returns `403 Forbidden`.  
- Creates are rechecked against the scope's row restrictions. A created record that would be invisible to the same scope is rolled back.  
- Scalar fields reject arrays and objects. Array fields require an array of scalar values. Raw fields accept the nested shapes documented below.