API requests go to
https://confirmed.show/api/v1/<production>/<endpoint>, and
every request needs a valid API token.
How to send your token
You can send the token in any of these places. The server checks them in this order and uses the first token it finds.
| Method | Example |
|---|---|
| Query parameter |
https://confirmed.show/api/v1/my-production/shows?token=abc123
|
| Custom header | X-API-Token: abc123 |
| Authorization header | Authorization: abc123 |
| Bearer token | Authorization: Bearer abc123 |
Getting a token
You can generate tokens from the Data & API page of your production. Generate and manage API keys walks through the steps.
What a key can reach
Each key has one of three types, and each endpoint names the types it accepts.
| Key type | What it can reach |
|---|---|
| Read-only | Every GET endpoint in the private API |
| Read-write | The same, plus creating and updating shows, acts and venues, sending ticket sales, and uploading files |
| Show control | The Showtime endpoints, and nothing else |
Errors
| Status | What happened |
|---|---|
400 |
The request carried no API token. |
401 |
We don't recognise that token. |
403 |
The token is the wrong type for this endpoint. |
Every endpoint allows cross-origin calls, so you can reach the API from a browser. A call from the browser shows the key to anyone reading the page, though, so it's safer to make the calls from your own server where you can.