Cvent Platform REST API (Hospitality)

openapi: 3.0.2
info:
  title: Cvent Authentication API
  description: 'The Authentication surface of the Cvent REST API (Cvent Hospitality Cloud). Split by tag from the

    single "Cvent REST APIs" OpenAPI document Cvent publishes on its developer portal.

    Operations, schemas, parameters and responses are carried through verbatim; nothing was authored here.


    Source: https://developers.cvent.com/documentation (getPublicSpec, https://developers.cvent.com/api/graphql)

    '
  contact:
    name: Cvent Development Platform
    url: https://developers.cvent.com/
  version: ea
servers:
- url: https://api-platform.cvent.com/ea
- url: https://api-platform-eur.cvent.com/ea
tags:
- name: Authentication
  description: Endpoints for obtaining, refreshing, and validating OAuth2 access tokens.
paths:
  /oauth2/authorize:
    get:
      tags:
      - Authentication
      summary: Get Authorization Code
      description: 'Initiates the OAuth2 authorization code flow by directing the user-agent to the Cvent authorization
        server. The client typically triggers this request via a browser. For the `redirect_uri` HTTPS is required;
        `http://localhost` is permitted for local testing only. On success, the authorization server redirects the
        user-agent back to the client''s `redirect_uri` with an authorization code. The client can then exchange
        that code via [Get Token](#operation/oauth2Token) to obtain an access token.

        '
      operationId: oauth2Authorize
      parameters:
      - in: query
        name: response_type
        description: 'The response type must be code. Indicates the client wants an authorization code (authorization
          code grant flow).


          **Note:** *implicit flow* or the *token* value is not supported at this time.

          '
        schema:
          type: string
          enum:
          - code
        example: code
        required: true
      - in: query
        name: client_id
        description: 'The OAuth2 Client application ID.


          Must be a pre-registered client created in the developer portal.

          '
        schema:
          type: string
        example: ad398u21ijw3s9w3939
        required: true
      - in: query
        name: redirect_uri
        description: 'The URL to which the authorization server redirects the browser after authorization has been
          granted by the user.


          A redirect URI must:


          * Be an absolute URI.

          * Be pre-registered with a client.

          * **NOT** include a fragment component.

          * Wildcards are **NOT** supported


          Requires HTTPS over HTTP except for http://localhost for testing purposes only.


          **Note:** App callback URLs such as *com.myclientapp://myclient/redirect* are also supported.

          '
        schema:
          type: string
        example: https://example.com/redirect
        required: true
      - in: query
        name: state
        description: 'An opaque value the client application adds to the initial request. The authorization server

          includes this value when redirecting back to the client.


          This value must be used by the client to prevent CSRF attacks.


          **Optional** but strongly recommended.

          '
        schema:
          type: string
        example: abc123xyz
        required: false
      - in: query
        name: scope
        description: 'Can be a combination of any scopes associated with a client. Scopes must be separated by spaces.

          Any scope used must be pre-associated with the client or it will be ignored at runtime.


          **Note:** If the client doesn''t request any scopes, the authorization server uses all

          scopes associated with the client.

          '
        schema:
          type: string
        example: event/events:read event/attendees:read
        required: false
      responses:
        '302':
          description: Redirect back to calling application.
          headers:
            Location:
              schema:
                type: string
              description: "**Positive Response**\n\nThe authorization server redirects the user-agent back to the\
                \ client's redirect URI with the authorization code and state.\nThe code and state must be returned\
                \ in the query string parameters.\n\n**Negative Responses**\n\n- If client_id and redirect_uri are\
                \ valid but there are other problems with the request parameters\n(for example, if response_type\
                \ is not included), the authorization server redirects the error to\nclient's redirect_uri.\n  -\
                \ Location: https://client_redirect_uri?error=invalid_request\n\n- If the client requests 'code'\
                \ in response_type but does not have permission for these requests,\nthe authorization server should\
                \ return unauthorized_client to client's redirect_uri.\n  - Location: https://client_redirect_uri?error=unauthorized_client\n\
                \n- If the client requests invalid, unknown, malformed scope, the authorization server should return\n\
                invalid_scope to the client's redirect_uri, as follows.\n  - Location: https://client_redirect_uri?error=invalid_scope\n\
                \n- If there is any unexpected error in the server, the authorization server should return\nserver_error\
                \ to client's redirect_uri. It should not be the HTTP 500 error displayed to\nthe end user in the\
                \ browser, because this error doesn't get sent to the client.\n  - Location: https://client_redirect_uri?error=server_error\n\
                \n- In the rare case where the authorization server encounters an exception in the communication\n\
                protocol while making any connection to an external identity provider, the authorization\nserver\
                \ redirects the error to the client's redirect_uri with either of the following messages.\n  - Location:\
                \ https://client_redirect_uri?error=invalid_request&error_description=Connection+reset\n  - Location:\
                \ https://client_redirect_uri?error=invalid_request&error_description=Read+timed+out\n"
              example: https://client_redirect_uri?code=AUTHORIZATION_CODE&state=STATE
        '400':
          description: The request is missing a required parameter.
  /oauth2/token:
    post:
      tags:
      - Authentication
      summary: Get Token
      description: 'Obtains an access token and, optionally, a refresh token. Read the [Developer Quickstart](/docs/rest-api/tutorials/developer-quickstart)
        for an example request.


        **Note:** The token endpoint returns refresh_token only when the grant_type is authorization_code.

        '
      operationId: oauth2Token
      parameters:
      - in: header
        name: Authorization
        description: 'The client must pass its client_id and client_secret in the authorization header through Basic
          HTTP authorization.


          An example is `Basic Base64Encode(client_id:client_secret)` where `Base64Encode` means that the client
          id and secret are base64 encoded.

          '
        schema:
          type: string
        example: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=
        required: true
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Oauth2TokenApplicationXWwwFormUrlencodedPostRequest'
      responses:
        '200':
          description: A successful response returning an access token and a possible refresh token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Oauth2TokenPostResponse'
        '400':
          description: A bad token response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Oauth2TokenPostResponse-0'
        '401':
          description: Client authentication failed. The credentials provided in the Authorization header are invalid
            or missing.
  /token-validation:
    get:
      tags:
      - Authentication
      summary: Validate Token
      description: Verifies presented authentication token is valid.
      operationId: validateToken
      security:
      - OAuth2.clientCredentials: []
      - OAuth2.authorizationCode: []
      parameters: []
      responses:
        '200':
          $ref: '#/components/responses/ValidToken'
        '400':
          $ref: '#/components/responses/BadRequest1'
        '401':
          $ref: '#/components/responses/Unauthorized1'
        '403':
          $ref: '#/components/responses/Forbidden1'
        '429':
          $ref: '#/components/responses/TooManyRequests1'
      deprecated: false
      externalDocs:
        description: More about OAuth2 authorization code support for administrators
        url: '#oauth2-auth-code-planner-admin'
components:
  responses:
    ValidToken:
      description: A confirmation message that the token is valid
      headers: {}
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidToken'
    Unauthorized1:
      description: Bad or expired token
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse-12'
          example:
            code: 401
            message: Unauthorized
    TooManyRequests1:
      description: Too many requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse-12'
          example:
            code: 429
            message: Limit Exceeded
    Forbidden1:
      description: You do not have access to the resource
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse-12'
          example:
            code: 403
            message: Access Forbidden
    BadRequest1:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse-12'
          example:
            code: 400
            message: Bad Request
  schemas:
    Oauth2TokenPostResponse-0:
      type: object
      properties:
        error_description:
          type: string
          description: Additional error information, when available.
        error:
          type: string
          description: '**invalid_request**


            The request is missing a required parameter, includes an unsupported parameter value (other than unsupported_grant_type),
            or is otherwise malformed. For example, grant_type is refresh_token but refresh_token is not included.


            **invalid_client**


            Client authentication failed. For example, when the client includes client_id and client_secret in the
            authorization header, but there''s no such client with that client_id and client_secret.


            **invalid_grant**


            Refresh token has been revoked.


            Authorization code has been consumed already or does not exist.


            **unauthorized_client**


            Client is not allowed for code grant flow or for refreshing tokens.


            **unsupported_grant_type**


            Returned if grant_type is anything other than authorization_code or refresh_token.

            '
          enum:
          - invalid_request
          - invalid_client
          - invalid_grant
          - unauthorized_client
          - unsupported_grant_type
          example: invalid_request
    ErrorResponseBase1:
      title: ErrorResponseBase
      type: object
      description: Represents an error response with no additional details.
      required:
      - code
      - message
      properties:
        code:
          type: integer
          description: The HTTP status code representing the error.
          example: 400
        message:
          type: string
          description: A brief description of the error.
          example: Bad Request
        target:
          type: string
          description: The target resource of the error.
          example: example target
    Oauth2TokenApplicationXWwwFormUrlencodedPostRequest:
      type: object
      properties:
        grant_type:
          description: Controls the OAuth2 grant flow used to obtain tokens.
          enum:
          - client_credentials
          - authorization_code
          - refresh_token
          example: client_credentials
        client_id:
          description: 'The OAuth2 Client application ID.


            Must be a pre-registered client created in the developer portal.

            '
          type: string
          example: djc98u3jiedmi283eu928
        scope:
          description: 'Can be a combination of any scopes associated with a client. Any scope requested must be
            pre-associated with the client or it will be ignored at runtime.

            If the client doesn''t request any scopes, the authorization server uses all scopes associated with
            the client.


            **Optional** - Only used if the grant_type is client_credentials.

            '
          type: string
          example: event/events:read event/attendees:read
        redirect_uri:
          description: 'Must be the same *redirect_uri* that was used to get *authorization_code* in */oauth2/authorize*.


            **Required only if grant_type is authorization_code.**

            '
          type: string
          example: https://example.com/redirect
        refresh_token:
          description: 'The refresh token.


            **Note:** The token endpoint returns *refresh_token* only when the grant_type is *authorization_code*.

            '
          type: string
          example: dn43ud8uj32nk2je
        code:
          description: 'The code that is returned from a successful */oauth2/authorize*.


            **Required if grant_type is authorization_code.**

            '
          type: string
          example: AUTHORIZATION_CODE
      required:
      - grant_type
      - client_id
    Oauth2TokenPostResponse:
      type: object
      properties:
        access_token:
          type: string
          description: The access token contains scopes and groups and is used to grant access to authorized resources.
          example: eyJz9sdfsdfsdfsd
        refresh_token:
          type: string
          description: The refresh token contains the information necessary to obtain a new access token.
          example: dn43ud8uj32nk2je
        token_type:
          type: string
          description: The OAuth2 token type. Always `Bearer`.
          example: Bearer
        expires_in:
          type: integer
          description: The lifetime in seconds of the access token.
          default: 3600
          example: 3600
      required:
      - access_token
      - token_type
      - expires_in
    ErrorResponse-12:
      title: ErrorResponse
      description: Represents an error response with additional details of cascading error messages.
      allOf:
      - $ref: '#/components/schemas/ErrorResponseBase1'
      type: object
      required:
      - code
      - message
      properties:
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorResponseBase1'
          description: Additional details of cascading error messages.
    ValidToken:
      title: Valid Token
      description: Validity status of an authentication token.
      type: object
      properties:
        tokenValid:
          type: boolean
          description: True indicates the presented authentication token is valid.
          example: true
        statusCode:
          type: integer
          description: Supplementary status code. Typically will be 200 for a success case.
          example: 200
  securitySchemes:
    OAuth2.clientCredentials:
      type: oauth2
      description: OAuth2 Client Credentials Flow.
      flows:
        clientCredentials:
          tokenUrl: https://api-platform.cvent.com/ea/oauth2/token
          scopes:
            account/hooks:delete: Allows the deletion of hooks.
            account/hooks:read: Allows the reading of hooks.
            account/hooks:write: Allows the creation/updation of hooks.
            account/user-groups:delete: Allows deletion for user groups
            account/user-groups:read: Allows the reading of user groups
            account/user-groups:write: Allows the writing of user groups
            account/users:delete: Allows the deletion of User
            account/users:read: Allows the reading of User, User Group
            account/users:write: Allows the creation/updating of User
            appointments/appointment-attendees:read: Allows the reading of appointment attendees and their related
              entities.
            appointments/appointment-events:read: Allows the reading of appointment events and their related entities.
            appointments/appointment-types:read: Allows the reading of appointment types and their related entities.
            appointments/appointments:read: Allows the reading of appointment and their related entities.
            appointments/appointments:write: Allows the writing of appointments and their related entities.
            appointments/available-times:read: Allows the reading of availability times.
            appointments/locations:read: Allows the reading of appointment locations and their related entities.
            attendee-insights/attendee-insights:read: Allows the reading of engagement scores (attendee insights).
            attendee-insights/scores:read: Allows the reading of scores.
            attendee-insights/stats:read: Allows the reading of engagement score (attendee insight) stats.
            budget/budget-items:delete: Allows the deletion of budget items
            budget/budget-items:read: Allows the reading of all budget items
            budget/budget-items:write: Allows creation/updation of budget item
            budget/budget-totals:read: Allows the reading of all event budget totals
            budget/budget-vendors:read: Allows reading of account-level budget vendors.
            budget/cards:read: Allows the reading of cards
            budget/currency-conversion-rate:delete: Allows deletion of currency conversion rate for currency.
            budget/currency-conversion-rate:read: Allows reading of currency conversion rate for currency.
            budget/currency-conversion-rate:write: Allows creation/update of currency conversion rate for currency.
            budget/payments:delete: Allows deletion of payments.
            budget/payments:read: Allows reading of payment for budget item.
            budget/payments:write: Allows creation of payment in a budget item.
            budget/transactions:delete: Allows delete card transactions.
            budget/transactions:read: Allows the reading of all card's transactions
            budget/transactions:write: Allows creation of card transactions.
            bulk/bulk-jobs:read: Allows the reading of bulk job related entities
            bulk/bulk-jobs:write: Allows the creation, update and deletion of bulk job related entities
            business-transient/bids:read: Allows the reading of Business Transient Bid data
            business-transient/proposals:read: Allows the reading of Business Transient Proposal data
            business-transient/supplier-brands:read: Allows the reading of a supplier brand or a list of travel
              supplier brands.
            business-transient/supplier-chains:read: Allows the reading of a travel supplier chain or a list of
              travel supplier chains.
            business-transient/supplier-properties:read: Allows the reading of a travel supplier property or a list
              of travel supplier properties.
            business-transient/supplier-property-rooms:read: Allows the reading of a list of travel supplier property
              rooms.
            business-transient/travel-accounts:read: Allows the reading of business transient travel account data.
            business-transient/travel-program-questions:read: Allows the reading of business transient travel program
              question data.
            business-transient/travel-programs:read: Allows the reading of business transient travel program data.
            business-transient/travel-supplier-accounts:read: Allows the reading of business transient travel supplier
              account data.
            business-travel/bids:read: Allows the reading of Business Travel Bid data
            business-travel/proposals:read: Allows the reading of Business Travel Proposal data
            business-travel/travel-accounts:read: Allows the reading of business travel account data.
            business-travel/travel-program-questions:read: Allows the reading of business travel program question
              data.
            business-travel/travel-programs:read: Allows the reading of business travel program data.
            compliance/communications:read: Allows the reading of communication compliance
            compliance/communications:write: Allows the writing of communication compliance
            email/bounces:read: Allow the reading of email bounces.
            email/email-status:read: Allows the reading of email statuses.
            email/emails:read: Allows the reading of emails.
            eMarketing/campaigns:read: Allows the reading of campaigns.
            emarketing/emarketing-email-status:read: Allows the reading of eMarketing email statuses.
            eMarketing/eMarketing-email-templates:read: Allows the reading of email-templates.
            eMarketing/eMarketing-send-emails:write: Allows the writing of eMarketing emails.
            event/admission-items:read: Allows the reading of admission items
            event/air-request:read: Allow reading the air request or air actual detail for attendees.
            event/alternate-travel:read: Allow reading the alternate travel answers for attendees.
            event/attendance-durations:read: Allows the read of Duration records
            event/attendee-activities-metadata:delete: Allows the deletion of attendees activities metadata.
            event/attendee-activities-metadata:read: Allows the reading of attendee activities metadata.
            event/attendee-activities-metadata:write: Allows the creation/updating of attendees activities metadata.
            event/attendee-activities:read: Allows the reading of attendee activities.
            event/attendee-activities:write: Allows the writing of external attendee activities.
            event/attendee-credits:read: Allows the reading of attendee credits.
            event/attendee-links:delete: Allows the deletion of attendee links
            event/attendee-links:read: Allows the reading of attendee links
            event/attendee-links:write: Allows the creation of attendee links
            event/attendee-messages:read: Allows the reading of attendee messages
            event/attendees:read: Allows the reading of attendees.
            event/attendees:write: Allows the creation of an attendee in an event.
            event/audience-segments:read: Allows the reading of audience segments.
            event/audience-segments:write: Allows the creation/updating/deletion of audience segments.
            event/contact-groups:read: Allows the reading of contact groups.
            event/contact-groups:write: Allows the creation/updating of contact groups.
            event/contact-types:read: Allows the reading of contact types.
            event/contacts:delete: Allows the deletion of contacts.
            event/contacts:read: Allows the reading of contacts.
            event/contacts:write: Allows the creation/updating of contacts.
            event/contacts:write-sensitive: Allows the creation/updating of sensitive data related to contacts.
            event/custom-fields:read: Allows the reading of custom fields
            event/custom-fields:write: Allows the writing of custom fields
            event/discounts:write: Allows the writing of discounts
            event/donation-items:read: Allows the reading of donation items.
            event/event-discounts:read: Allows the reading of event discounts.
            event/event-discounts:write: Allows the writing of event discounts.
            event/event-email-status:read: Allows the reading of event email statuses.
            event/event-emails:read: Allows the reading of event emails
            event/event-emails:write: Allows to send event emails.
            event/event-features:read: Allows the reading of events-features
            event/event-features:write: Allows updating the event-features
            event/event-user-groups:read: Allows the reading of user groups
            event/event-user-groups:write: Allows associating/disassociating user groups to event
            event/events:read: Allows the reading of events
            event/events:write: Allows the creation/updating of events
            event/fee-items:read: Allows the reading of fee items.
            event/hotel-request:read: Allow reading the hotel request or housing reservation request detail for
              attendees.
            event/invitation-lists:read: Allows the reading of the invitation lists for an event
            event/meeting-request-forms:read: Allows the reading of meeting request forms.
            event/meeting-requests:read: Allows the reading of meeting requests.
            event/meeting-requests:write: Allows the creation/updating of meeting requests.
            event/membership-items:read: Allows reading of membership items.
            event/orders:read: Allows the reading of orders
            event/planning-documents:read: Allows the reading of event planning documents
            event/players:read: Allows the reading of players
            event/process-form-submissions:read: Allows the reading of process form submissions.
            event/program-items:delete: Allows deletion of session program items
            event/program-items:read: Allows reading of session program items
            event/program-items:write: Allows writing of session program items
            event/quantity-items:read: Allows the reading of quantity items.
            event/quantity-items:write: Allows the writing of quantity items
            event/registration-paths:read: Allows the reading of registration paths
            event/registration-types:read: Allows the reading of registration types
            event/registration-types:write: Allows the writing of registration types
            event/role-assignments:read: Allows the reading of event role assignment.
            event/session-attendance:read: Allows the reading of sessions attendance
            event/session-attendance:write: Allows the creation/updating of sessions attendance
            event/session-categories:read: Allows reading of session categories
            event/session-categories:write: Allows writing of session categories
            event/session-enrollment:delete: Allows the deletion of session registrations
            event/session-enrollment:read: Allows the reading of sessions registrations
            event/session-enrollment:write: Allows the writing of sessions registrations
            event/session-segments:read: Allows reading of session segments
            event/sessions:delete: Allows the deletion of a session in an event
            event/sessions:read: Allows the reading of sessions
            event/sessions:write: Allows the creation of a session in an event
            event/speaker-categories:read: Allows reading of speaker categories
            event/speaker-categories:write: Allows writing of speaker categories
            event/speakers:delete: Allows the deletion of a speaker in an event
            event/speakers:read: Allows the reading of speakers
            event/speakers:write: Allows the creation of a speaker in an event
            event/taxes:read: Allows the reading of taxes.
            event/transactions:read: Allows the reading of transactions
            event/transactions:write: Allows the writing of transactions
            event/video-views:read: Allows reading of video views.
            event/videos:read: Allows the reading of video data.
            event/videos:write: Allows the creation/updating of video data.
            event/vouchers:read: Allows reading of event vouchers.
            event/webcasts:delete: Allows the deletion of webcast
            event/webcasts:read: Allows the reading of webcasts
            event/webcasts:write: Allows the creation of webcast
            event/weblinks:read: Allows the reading of event weblinks
            events-plus/hubs:read: Allows the reading of Events+ hub data.
            exhibitor/badges:read: Allows reading badges
            exhibitor/badges:write: Allows creating/updating badges
            exhibitor/booth-staff:delete: Allows deleting booth staff
            exhibitor/booth-staff:read: Allows reading booth staff
            exhibitor/booth-staff:write: Allows creating booth staff
            exhibitor/eliterature-requests:read: Allows reading eliterature document request data
            exhibitor/exhibitor-admins:read: Allows reading exhibitor admins
            exhibitor/exhibitor-admins:write: Allows creating/updating exhibitor admins
            exhibitor/exhibitor-answers:read: Allows reading exhibitor answers
            exhibitor/exhibitor-answers:write: Allows updating exhibitor answers
            exhibitor/exhibitor-categories:delete: Allows deleting exhibitor categories
            exhibitor/exhibitor-categories:read: Allows reading exhibitor categories
            exhibitor/exhibitor-categories:write: Allows creating/updating exhibitor categories
            exhibitor/exhibitor-contents:delete: Allows deleting exhibitor content
            exhibitor/exhibitor-contents:read: Allows reading exhibitor content
            exhibitor/exhibitor-contents:write: Allows creating/updating exhibitor content
            exhibitor/exhibitor-questions:read: Allows reading exhibitor questions
            exhibitor/exhibitors:delete: Allows deleting exhibitors
            exhibitor/exhibitors:read: Allows reading exhibitors
            exhibitor/exhibitors:write: Allows creating/updating exhibitors
            exhibitor/lead-qualification-answers:read: Allows reading Lead Qualification Answers
            exhibitor/lead-qualification-questions:read: Allows reading Lead Qualification Questions.
            exhibitor/leads:read: Allows reading leads.
            exhibitor/registration-packs:delete: Allows deleting registration pack
            exhibitor/registration-packs:read: Allows reading registration pack
            exhibitor/registration-packs:write: Allows creating/updating registration pack
            exhibitor/sponsorship-levels:read: Allows reading sponsorship level
            file/file:read: Allows the reading of file
            file/file:write: Allows the uploading of file
            housing/connections:write: Allows the user to connect to the Reglink APIs.
            housing/hotel-room-rates:write: Allows the user to create/update hotel room rates.
            housing/housing-event-available-nights:read: Allows the user to read availability information for given
              event.
            housing/housing-event-hotels:read: Allows the user to read information about event hotels.
            housing/housing-event-inventory:read: Allows the user to get information about housing event inventory.
            housing/housing-event-room-types:read: Allows the user to read information about event room types.
            housing/housing-events:read: Allows the user to read information about events.
            housing/reservation-requests:delete: Allows the user to cancel reservation request.
            housing/reservation-requests:read: Allows the user to read reservation request information.
            housing/reservation-requests:write: Allows the user to create/update reservation request.
            housing/reservations-link:delete: Allows the user to remove association from reservation.
            housing/reservations-link:write: Allows the user to associate reservation to reservation request.
            housing/reservations:delete: Allows the user to cancel reservation.
            housing/reservations:read: Allows the user to read reservation details information.

# --- truncated at 32 KB (53 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cvent-hospitality-cloud/refs/heads/main/openapi/cvent-hospitality-cloud-authentication-openapi.yml