Venue API

Overview

When a parent books a party with you, your confirmation page and emails show a Make your invite button. When they tap it, your server calls us with the party details, and we reply with a link to send them to. They land on an invite with the date, time and place already filled in and locked, pick a design and share it. Your team then sees the party’s headcount in the venue dashboard: numbers only, never guests’ names or notes.

• Data moves only when the host taps, so a booking that never makes invites is never shared with us.
• The booking email is included so only the person who booked can claim the invite.
• Calls are idempotent per booking: a repeat handoff for the same reference returns the same link.
• Any party works, not only a children’s birthday: send the occasion, or set one per package in your venue dashboard.

Authentication

Every call carries your venue’s API key as a bearer token. Create and revoke keys in the venue dashboard; keep them on your server, never in a browser or an email.

Authorization: Bearer YOUR_API_KEY

Each key can make 120 requests a minute. To rotate a key, create a new one, switch your server over to it, then revoke the old one. The base URL ishttps://app.rsvpsorted.com.

Create a handoff

PUT/api/v1/venue/handoffs/:externalRef

Call this when the parent taps the button. externalRef is your booking reference: letters, numbers, dots, dashes and underscores, up to 64 characters. Send a JSON body; unknown fields are rejected.

curl -X PUT https://app.rsvpsorted.com/api/v1/venue/handoffs/KB-20417 \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "childFirstName": "Ava",
    "childAge": 7,
    "partyDate": "2026-10-17",
    "startTime": "14:00",
    "endTime": "16:00",
    "hostFirstName": "Jo",
    "bookingEmail": "jo@example.com"
  }'

A successful call returns 200 with the link to redirect the parent to, usually with a 303 See Other from your own route:

{ "url": "https://app.rsvpsorted.com/start/…" }

Make the call outside any database transaction on your side, and if it fails, show the host a friendly “Invites are having a moment, try again shortly” page. The link opens the host’s draft, so never store it, log it or put it in an email: hand it over with a redirect from a button they pressed.

Moves and cancellations

PATCH/api/v1/venue/bookings/:externalRef

Call this whenever a confirmed booking changes date or time, or is cancelled or expires. It carries no personal data. If the parent has shared the invite, guests see the new details, or that the party is cancelled, the next time they open it.

curl -X PATCH https://app.rsvpsorted.com/api/v1/venue/bookings/KB-20417 \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "partyDate": "2026-10-24", "startTime": "14:00", "endTime": "16:00", "status": "confirmed" }'

It returns { "updated": true }. A 404 means the host never made invites, so there is nothing to update. Send these from a queue and retry with backoff on anything else.

Packages that offer invites

A package is a party product your booking system sells, such as a jungle party or an adult hire. Name it in each handoff’s bookingType and we learn it from there; you then choose in your venue dashboard which packages offer invites, and what each one’s invites start as. Two optional calls keep your system in step.

GET/api/v1/venue/booking-types

Ask before showing the button, and cache the answer for a few minutes. Show the button when the venue-wide switch is on and the booking’s package offers invites, or, for a package we haven’t seen, when new packages are set to offer.

PUT/api/v1/venue/booking-types/:bookingTypeId

Registers or renames a package ahead of any booking, so the venue can decide on it before anyone books. bookingTypeId is your own id for it: letters, numbers, dots, dashes and underscores, up to 64 characters. It never changes whether the package offers invites; that stays with the venue dashboard.

curl https://app.rsvpsorted.com/api/v1/venue/booking-types \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY"

curl -X PUT https://app.rsvpsorted.com/api/v1/venue/booking-types/jungle-party \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Jungle party" }'

Both answer with the package as we now hold it: { "id": "jungle-party", "name": "Jungle party", "offerInvites": true }.

Errors

Errors are RFC 9457 problem details (application/problem+json) with a stable code. Log the code and the status, never the body you sent, which carries personal data.

Where to show the link

• On your booking confirmation page, next to Add to my calendar, for confirmed and paid bookings only.
• In the booking confirmation and payment emails, as a link to a page on your site with one button. Mail scanners and link previews open links before anyone clicks, so the handoff itself must only ever happen from a button someone pressed, never from the email link.
• Wherever hosts look up their booking.

Suggested wording: “Make invites for Ava’s party in a minute, free with your booking.” The button itself says Make your invite.

Security and data

• We store the child’s first name and age, the party date and times, and the parent’s first name. For the booking email we store a one-way hash and a masked hint only.
• Booking updates carry no personal data.
• Invites, replies and everything attached to them are deleted 90 days after the party.
• Your dashboard shows each party’s numbers: children coming, grown-ups staying and who is still to reply. Never guests’ names, notes or contact details.
• We act as a separate controller for the host’s and guests’ data. Add a line to your privacy notice saying that if a parent chooses to make invitations, you share their child’s first name, age, party details and email address with RSVP Sorted.

Questions about connecting? Email hello@rsvpsorted.com.