Examples use a fictional festival, summer-fest. Sign in at events.grofomo.com and they switch to your own events.

Carer tickets

GET/v1/events/{slug}/carer-tickets

Some attendees need a carer with them. When the organiser has switched carer tickets on, the carer applies with the attendee's order number and a document that shows they are a carer, and the organiser approves or denies it in Grofomo. Approval emails the carer a free ticket in the attendee's own order, so the door checks the two in together.

This is the form's configuration: whether it is open, the organiser's own note for the top of the page, what counts as proof, the consent line to show beside the upload, and the upload limits. The form itself is three calls: match the order, upload the proof, then apply.

Hide the form when open is false. Show acceptedProof as a list and consent.text word for word: the carer is agreeing to the organiser seeing a sensitive document, and Grofomo records which wording they saw.

Send ?surface=webOmit it and the request is treated as coming from the mobile app, which is gated on a different visibility setting — so a perfectly live event can return 404 not_found for no visible reason.

Request

curl -sS \
  -H 'X-Grofomo-Key: pk_live_YOUR_PUBLISHABLE_KEY' \
  'https://api.grofomo.com/v1/events/summer-fest/carer-tickets?surface=web'

Path parameters

slugstringrequired: The event's URL slug. Globally unique. It can change if the organiser renames the event, but an old slug keeps reaching the same event, so a stored one never breaks. Example: `summer-fest`.

Query parameters

surface'web'required: Must be `web` for a website. Omit it and you get the mobile-app surface, which is gated on a different visibility setting — so a perfectly live event can return 404. Example: `web`.

Response

200 OK

{
  "apiVersion": 1,
  "data": {
    "eventSlug": "summer-fest",
    "eventName": "Summer Fest 2026",
    "open": true,
    "note": "Carer tickets are free for anyone supporting a ticket holder who could not attend without them. We usually reply within three working days.",
    "maxPerOrder": 1,
    "acceptedProof": [
      "A carer card or carer ID (for example from Carers UK, a local carers centre or a Carer Card scheme)",
      "A letter awarding Carer's Allowance, or the middle or higher rate of DLA, PIP or Attendance Allowance to the person you support",
      "A Nimbus Access Card with the +1 symbol",
      "A letter from a GP, social worker or support organisation confirming you are a carer"
    ],
    "consent": {
      "version": "carer-proof-2026-09",
      "text": "The organiser will see the document you upload, only to decide this application. It is deleted 30 days after their decision. Please do not send a passport, driving licence or any other government ID: a carer card, a benefit letter or a letter from a support organisation is all that is needed."
    },
    "proof": {
      "mimeTypes": [
        "image/jpeg",
        "image/png",
        "image/webp",
        "application/pdf"
      ],
      "maxBytes": 15728640
    }
  }
}

eventSlugstring: The event's current slug (an old one still resolves).
eventNamestring
openboolean: Whether the organiser is taking carer applications for this event. Hide the form when false: a submission is refused.
notestring | null: The organiser's own words for the top of the form, e.g. which proof they accept, or null.
maxPerOrdernumber: How many carer tickets one order may hold.
acceptedProofstring[]: What counts as proof, one item per entry. Render as a list.
consentobject: The line the carer agrees to when they upload their proof.
consent.versionstring
consent.textstring
proofobject: Limits for the proof upload.
proof.mimeTypesstring[]
proof.maxBytesnumber

Generated from CarerTicketsInfoResponse

Errors

unauthorizedHTTP 401: No key was sent and the organiser requires one — or the key is invalid, revoked, belongs to another organisation, or is scoped to a different event.
origin_not_allowedHTTP 403: Your site's domain is not on the organiser's allowed list. Browser calls only: a server sends no Origin header and is unaffected.
not_foundHTTP 404: No event with that slug is published on this surface. Check the slug, and check you sent `?surface=web`.

Notes

Rate limited to roughly 60 requests per minute per caller. Guidance, not a contract — see caching and rate limits.
Cache-Control: public, s-maxage=60, stale-while-revalidate=300