API

Everything you do with events in the dashboard can be scripted: create and update events, pull registrants, mark attendance, send invitations, and export to CSV. Requests and responses are JSON (except the CSV exports and image upload). The base URL is https://programmable.talk.

Successful responses wrap their result in data, or answer { "ok": true } when there is nothing to return. Lists come back whole; there is no pagination.

Authentication

Make a key in Settings. It is shown once; we keep only its hash. Send it in the Authorization header (never in the query string):

Authorization: Bearer pev_…

• Full keys act as the account owner and can read and change events.
• Read keys can only make GET requests; anything else answers 403 “This API key is read-only.”
• Keys are limited to event work. Team, billing, connections, domains and keys themselves need a person signed in (see below).
• While an account is closing, it can be read and exported but not changed: writes answer 423 with code: "closing".
• Revoking a key in Settings stops it at once.

Rate limits. Wrong keys are counted per IP address: after 30 unrecognized keys in an hour, every request from that address carrying a key answers 429 for the rest of the hour. Valid keys have no general request limit; image uploads are limited to 120 an hour per account, and the public directory to 120 requests an hour per IP.

Errors

Errors are JSON with a human-readable error, sometimes with a machine-readable code. For an invalid body, the message names the first field that failed, like title: String must contain at least 2 character(s).

{ "error": "This API key is read-only." }

{ "error": "The free plan includes 3 live events. Upgrade to Pro in Settings for more.", "code": "upgrade" }

• 400: the body isn't JSON, or a field is invalid.
• 401: no key, or a key that wasn't recognized (or was revoked).
• 402 with code: "upgrade": the free plan's limit on live events was reached.
• 403: a read-only key tried to write, the action isn't open to keys, or an account limit was reached (events, entry points, speakers, series).
• 404: no such event (or registrant, speaker…) on this account.
• 409: a conflict, such as an event address or entry point code already taken.
• 423: the account is closing.
• 429: too many wrong keys, uploads, or directory requests.
• 500: “Something went wrong on our side.”

Events

An event is the page people register on, plus where the event really runs (platform: luma, eventbrite, zoom, meetup, other, or here for events hosted on Programmable Talk). An event object carries everything below plus id, slug, created_at, sync timestamps and errors. Dates are ISO 8601 with an offset.

Example: create an event

curl -X POST https://programmable.talk/api/events \
  -H "Authorization: Bearer pev_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Caching for LLM apps",
    "starts_at": "2026-11-12T17:00:00Z",
    "ends_at": "2026-11-12T18:00:00Z",
    "timezone": "Europe/London",
    "platform": "zoom",
    "platform_url": "https://zoom.us/webinar/register/WN_abc",
    "status": "draft"
  }'

Registrants

A registrant's status is registered, waitlisted, cancelled, attended or no_show; channel says how they registered.

Example: list registrants, and export them

curl https://programmable.talk/api/events/EVENT_ID/registrants \
  -H "Authorization: Bearer pev_your_key"

curl https://programmable.talk/api/events/EVENT_ID/export \
  -H "Authorization: Bearer pev_your_key" \
  -o registrants.csv

Invitations

Entry points, speakers, series and images

Entry points

Each way into an event (a link, QR code, email address, partner…) is an entry point with a short code, so every registration says where it came from.

Speakers

Series

One link for every session of a recurring event. Sessions are ordinary events with series_id set.

Images

Public directory

Webhooks

Add an HTTPS endpoint under Connections in Settings (signed in; keys can't). Its signing secret (whsec_…) is shown once. The URL must use https on port 443 or 8443 and resolve to a public address; redirects aren't followed.

Events:

• registration.created, registration.updated (someone registered again), registration.promoted (off the waitlist), registration.cancelled (with via: "luma" | "zoom" when the cancellation came from the platform): data is { event, registrant } as below.
• question.created: { event: { id, slug }, registrant: { id, email, name }, question }
• question.answered: { event: { id }, question: { id, body, answer }, registrant: { id } }

Each delivery is a POST with a JSON body:

{
  "id": "1842",
  "type": "registration.created",
  "created_at": "2026-11-01T09:30:00.000Z",
  "data": {
    "event": { "id": "…", "slug": "…", "title": "…", "starts_at": "…", "platform": "zoom", "platform_url": "…" },
    "registrant": {
      "id": "…", "email": "jane@example.com", "name": "Jane Doe", "company_domain": "example.com",
      "channel": "page", "source_id": "…", "status": "registered", "hope": "…",
      "utm": { "source": "newsletter" }, "created_at": "…"
    }
  }
}

Headers. X-Programmable-Id is the delivery id (the same as the body's id), stable across retries, so you can drop duplicates. X-Programmable-Signature: t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256, keyed with your signing secret, of <t>.<raw body>. Check it against the raw body before parsing, and reject old timestamps:

import { createHmac, timingSafeEqual } from "node:crypto";

// header: the X-Programmable-Signature value; body: the raw request body, unparsed.
function verify(secret: string, header: string, body: string, toleranceSec = 300): boolean {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${body}`).digest();
  const got = Buffer.from(parts.v1, "hex");
  return expected.length === got.length && timingSafeEqual(expected, got);
}

Retries. Answer with a 2xx within 15 seconds. A timeout, network error, or a 408, 409, 425, 429 or 5xx is retried after 1, 5, 15, 60, 180, 360 and 720 minutes, 8 attempts in all. Any other status stops delivery at once.

Not available to API keys

These need a person signed in to the dashboard, so that a leaked key can't add a teammate, reach billing, or change where data goes: team members and invitations, billing and checkout, connections (Luma, Zoom, AI provider, webhook), custom domains, listing, creating or revoking API keys, the full account export, and closing the account.

Not documented here: endpoints for AI drafting, the live room, posts, kits, print bundles, website reviews and invitation graphics. They serve the dashboard and may change without notice.