Apply for a carer ticket
POST
/v1/events/{slug}/carer-applicationsStep three of the carer form: the carer's details, the attendeeKey from the match step, the proofToken from the upload step, and the consent.version they were shown. The application lands in the organiser's queue in Grofomo (Tickets, Carers). On approval the carer is emailed a free ticket in the attendee's own order; on denial they are emailed the reason.
Nothing is emailed until the organiser acts, so there is no confirmation step to build. Sending again from the same email while the first application is waiting replaces it, document included, and the answer is always received.
Both tokens last an hour. expired means start again from the step it names. Include an empty, visually hidden website field in your form and send whatever is in it: people never fill it, and a submission that does is dropped as a bot. There is no Turnstile widget to render.
Send ?surface=webOmit it and the request is treated as coming from the mobile app, which is gated on a different visibility setting — so a perfectly live event can return
404 not_found for no visible reason.Request
curl -sS \
-X POST \
-H 'X-Grofomo-Key: pk_live_YOUR_PUBLISHABLE_KEY' \
-H 'Content-Type: application/json' \
-d '{"attendeeKey":"ZXZlbnQtaWR8dGlja2V0LWlkOjE3ODk2NDM2MDAwMDA6Y2FyZXItYXR0ZW5kZWU.ZXhhbXBsZS1zaWduYXR1cmU","firstName":"Sam","lastName":"Rivera","email":"sam@example.com","phone":"07400 123456","note":"I am Jane's full-time carer.","proofToken":"ZXZlbnQtaWR8aW1hZ2UvanBlZ3xvcmcvZXZlbnQvdXBsb2FkLmpwZzoxNzg5NjQzNjAwMDAwOmNhcmVyLXByb29m.ZXhhbXBsZS1zaWduYXR1cmU","consentVersion":"carer-proof-2026-09","website":""}' \
'https://api.grofomo.com/v1/events/summer-fest/carer-applications?surface=web'Request body
attendeeKeystringrequired- From the match step: the attendee this carer is for.
firstNamestringrequired- The carer's first name.
lastNamestringrequired- The carer's surname.
emailstringrequired- Where the carer's ticket, or the organiser's answer, is sent.
phonestring | null- Mobile number, optional.
notestring | null- Anything the organiser should know, optional.
proofTokenstringrequired- From the upload step, once the file has been PUT.
consentVersionstringrequired- `consent.version` from the programme, as shown to the carer.
websitestring- Leave this out. A hidden form field people never fill; a submission that fills it is dropped as a bot.
Generated from CarerApplicationRequest
Path parameters
slugstringrequired- The event's URL slug. Globally unique. It can change if the organiser renames the event, but an old slug keeps reaching the same event, so a stored one never breaks. Example: `summer-fest`.
Query parameters
surface'web'required- Must be `web` for a website. Omit it and you get the mobile-app surface, which is gated on a different visibility setting — so a perfectly live event can return 404. Example: `web`.
Response
200 OK
{
"apiVersion": 1,
"data": {
"status": "received"
}
}status"received"- Always `received`, whether this is a new application or an update to one already waiting.
Generated from CarerApplicationResultResponse
Errors
unauthorizedHTTP 401- No key was sent and the organiser requires one — or the key is invalid, revoked, belongs to another organisation, or is scoped to a different event.
origin_not_allowedHTTP 403- Your site's domain is not on the organiser's allowed list. Browser calls only: a server sends no Origin header and is unaffected.
not_foundHTTP 404- No event with that slug is published on this surface. Check the slug, and check you sent `?surface=web`.
bad_requestHTTP 400- The body did not match the schema, the email is not valid, or the consent version is not the current one.
applications_closedHTTP 409- The organiser is not taking carer applications for this event.
ticket_not_validHTTP 409- The attendee's ticket has since been cancelled, refunded or transferred, or its tier no longer takes carers.
order_fullHTTP 409- The order already holds as many carer tickets and waiting applications as the organiser allows.
expiredHTTP 410- The attendee key or the proof token is older than an hour. Repeat the step the message names.
invalid_fileHTTP 422- The uploaded document never arrived, is not the type declared, or could not be read.
rate_limitedHTTP 429- Too many applications from this address, or too many waiting for the organiser to review. Try again later.
verify_unavailableHTTP 503- The document could not be checked just now. Send the same application again.
Notes
- Rate limited to roughly 5 requests per minute per caller. Guidance, not a contract — see caching and rate limits.
Cache-Control: no-store