Skip to main content

title: “Requirements & Constraints” description: “Authentication, environments, pagination, rate limits and conditional fields for the Integrations API.” ---## Authentication All requests must include your API key in the X-Api-Key HTTP header:
curl --request GET \
  --url 'https://api-alpha.fourvenues.com/integrations/events/' \
  --header 'X-Api-Key: YOUR_API_KEY_HERE'

Getting an API key

API keys are provisioned by the Fourvenues team. To request one, contact integrations@fourvenues.com and include: - Your venue name(s) and Fourvenues account email - The integration you are building (e.g. “custom check-in scanner”, “BI dashboard”) - The endpoints you need access to
API keys are scoped: they only grant access to the specific endpoints requested. If you need additional access later, contact the team to update your key’s permissions.

Key lifecycle

PropertyDetail
ExpiryKeys have a limited lifespan and must be rotated before expiry.
RevocationKeys can be revoked immediately if misused.
ScopeEach key is tied to specific endpoints and your account’s venues only.
---## Environments
EnvironmentBase URLPurpose
Alphahttps://api-alpha.fourvenues.com/integrationsDevelopment & testing — uses isolated data, no real payments
Productionhttps://api.fourvenues.com/integrationsLive data — use only when your integration is fully tested
The alpha environment contains test data only. Events, tickets and payments created there do not appear in production and vice versa. Always validate your integration against alpha before switching to production.
You can verify your API key is working against the correct environment by calling the channels endpoint:
curl --request GET \
  --url 'https://api-alpha.fourvenues.com/integrations/channels/' \
  --header 'X-Api-Key: YOUR_API_KEY_HERE'
A successful response returns the channels associated with your key:
{
  "success": true,
  "data": [
    {
      "_id": "pw2gra4r20xlu02js0ybj42s6vYpAzeX",
      "name": "My team",
      "slug": "my-team"
    }
  ]
}
---## Pagination Most list endpoints return paginated results. Common query parameters:
ParameterTypeDescription
pageintegerPage number, starting at 1
limitintegerNumber of results per page (default varies per endpoint)
start_datestring (YYYY-MM-DD)Filter records created/updated after this date
end_datestring (YYYY-MM-DD)Filter records created/updated before this date
date_fieldstringWhich date field to filter on: created_at or updated_at
For incremental syncs, always use date_field=updated_at together with a narrow start_date/end_date window to avoid re-fetching unchanged records.
---## Conditional required fields Some endpoints have fields that become required depending on context.

Check-in endpoint (PUT /integrations/tickets/{id}/checkin)

FieldRequired?Notes
enterAlways required1 to mark as entered, 0 to revert
entry_dateRequired when enter: 1ISO 8601 datetime string (e.g. 2024-09-28T23:00:00.000Z)

Bookings (GET /integrations/bookings/)

FieldRequired?Notes
event_idRequiredThe event to query bookings for
dateRequiredThe event date in YYYY-MM-DD format
---## Rate limits The Integrations API does not publish explicit rate limit values, but the following guidelines apply: - Polling intervals: Do not poll any endpoint more than once per minute. For check-in pre-loading, every 5 minutes is recommended. - Burst requests: Avoid sending more than 10 requests per second from a single key. - 429 responses: If you receive a 429 Too Many Requests, implement exponential backoff before retrying. ---## Common errors
HTTP StatussuccessCauseFix
401 UnauthorizedfalseMissing or invalid X-Api-KeyCheck the header name and key value
403 ForbiddenfalseKey does not have access to this endpointContact the Fourvenues team to update key scope
404 Not FoundfalseResource does not exist or belongs to another accountVerify the _id or code
422 Unprocessable EntityfalseMissing required field or invalid valueCheck the request body against the API reference
429 Too Many RequestsfalseRate limit exceededImplement exponential backoff
500 Internal Server ErrorfalseUnexpected server errorRetry once; if persistent, contact support
---## Security considerations - Never expose your API key in client-side code (browser JavaScript, mobile apps). Always route requests through your backend. - Rotate keys regularly — contact the team to issue a new key and invalidate the old one. - Use HTTPS — all API endpoints require HTTPS. HTTP requests will be rejected.