Examples use a fictional festival, summer-fest. Sign in at events.grofomo.com and they switch to your own events.

Prelaunch verification

POST/v1/events/{slug}/prelaunch/verify

Finish a registration's double opt-in with the verification.token the register response returned. action is one of check_code (with code), resend_email or resend_code. Wrong and expired codes come back as an outcome, not an error, so ask again; too many wrong codes is 429 rate_limited, after which a resend issues a fresh one. Resends are limited to three per registration per ten minutes.

The confirmation link in the email lands on our hosted confirm page, so you never build that half.

Send ?surface=webOmit it and the request is treated as coming from the mobile app, which is gated on a different visibility setting — so a perfectly live event can return 404 not_found for no visible reason.

Request

curl -sS \
  -X POST \
  -H 'X-Grofomo-Key: pk_live_YOUR_PUBLISHABLE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"action":"check_code","token":"<verification token>","code":"123456"}' \
  'https://api.grofomo.com/v1/events/summer-fest/prelaunch/verify?surface=web'

Path parameters

slugstringrequired: The event's URL slug. Globally unique. It can change if the organiser renames the event, but an old slug keeps reaching the same event, so a stored one never breaks. Example: `summer-fest`.

Query parameters

surface'web'required: Must be `web` for a website. Omit it and you get the mobile-app surface, which is gated on a different visibility setting — so a perfectly live event can return 404. Example: `web`.

Response

200 OK

{
  "apiVersion": 1,
  "data": {
    "outcome": "verified",
    "successMessage": "You're on the list. We'll email you with tickets, presales and news."
  }
}

outcome"verified" | "already_verified" | "sent" | "wrong_code" | …
successMessagestring | null

Generated from PrelaunchVerifyResponse

Errors

unauthorizedHTTP 401: No key was sent and the organiser requires one — or the key is invalid, revoked, belongs to another organisation, or is scoped to a different event.
origin_not_allowedHTTP 403: Your site's domain is not on the organiser's allowed list. Browser calls only: a server sends no Origin header and is unaffected.
not_foundHTTP 404: No event with that slug is published on this surface. Check the slug, and check you sent `?surface=web`.
invalid_tokenHTTP 410: The verification token has expired (24 hours). Register again.
nothing_pendingHTTP 400: There is no number to verify on this registration.
rate_limitedHTTP 429: Too many wrong codes, or too many resends.

Notes

Rate limited to roughly 20 requests per minute per caller. Guidance, not a contract — see caching and rate limits.
Cache-Control: no-store