Cvent OAuth API
Endpoints for obtaining, refreshing, and validating OAuth2 access tokens.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cvent-oauth-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.0.2
info:
title: Cvent REST APIs — Authentication
version: ea
description: Endpoints for obtaining, refreshing, and validating OAuth2 access tokens.
contact:
name: Cvent Development Platform
url: https://developers.cvent.com/
externalDocs:
description: Cvent REST API documentation
url: https://developers.cvent.com/documentation
servers:
- url: https://api-platform.cvent.com/ea
- url: https://api-platform-eur.cvent.com/ea
tags:
- name: Authentication
description: Endpoints for obtaining, refreshing, and validating OAuth2 access tokens.
paths:
/oauth2/authorize:
get:
tags:
- Authentication
summary: Get Authorization Code
description: 'Initiates the OAuth2 authorization code flow by directing the user-agent to the Cvent authorization server.
The client typically triggers this request via a browser. For the `redirect_uri` HTTPS is required; `http://localhost`
is permitted for local testing only. On success, the authorization server redirects the user-agent back to the client''s
`redirect_uri` with an authorization code. The client can then exchange that code via [Get Token](#operation/oauth2Token)
to obtain an access token.
'
operationId: oauth2Authorize
parameters:
- in: query
name: response_type
description: 'The response type must be code. Indicates the client wants an authorization code (authorization code
grant flow).
**Note:** *implicit flow* or the *token* value is not supported at this time.
'
schema:
type: string
enum:
- code
example: code
required: true
- in: query
name: client_id
description: 'The OAuth2 Client application ID.
Must be a pre-registered client created in the developer portal.
'
schema:
type: string
example: ad398u21ijw3s9w3939
required: true
- in: query
name: redirect_uri
description: 'The URL to which the authorization server redirects the browser after authorization has been granted
by the user.
A redirect URI must:
* Be an absolute URI.
* Be pre-registered with a client.
* **NOT** include a fragment component.
* Wildcards are **NOT** supported
Requires HTTPS over HTTP except for http://localhost for testing purposes only.
**Note:** App callback URLs such as *com.myclientapp://myclient/redirect* are also supported.
'
schema:
type: string
example: https://example.com/redirect
required: true
- in: query
name: state
description: 'An opaque value the client application adds to the initial request. The authorization server
includes this value when redirecting back to the client.
This value must be used by the client to prevent CSRF attacks.
**Optional** but strongly recommended.
'
schema:
type: string
example: abc123xyz
required: false
- in: query
name: scope
description: 'Can be a combination of any scopes associated with a client. Scopes must be separated by spaces.
Any scope used must be pre-associated with the client or it will be ignored at runtime.
**Note:** If the client doesn''t request any scopes, the authorization server uses all
scopes associated with the client.
'
schema:
type: string
example: event/events:read event/attendees:read
required: false
responses:
'302':
description: Redirect back to calling application.
headers:
Location:
schema:
type: string
description: "**Positive Response**\n\nThe authorization server redirects the user-agent back to the client's\
\ redirect URI with the authorization code and state.\nThe code and state must be returned in the query string\
\ parameters.\n\n**Negative Responses**\n\n- If client_id and redirect_uri are valid but there are other problems\
\ with the request parameters\n(for example, if response_type is not included), the authorization server redirects\
\ the error to\nclient's redirect_uri.\n - Location: https://client_redirect_uri?error=invalid_request\n\n\
- If the client requests 'code' in response_type but does not have permission for these requests,\nthe authorization\
\ server should return unauthorized_client to client's redirect_uri.\n - Location: https://client_redirect_uri?error=unauthorized_client\n\
\n- If the client requests invalid, unknown, malformed scope, the authorization server should return\ninvalid_scope\
\ to the client's redirect_uri, as follows.\n - Location: https://client_redirect_uri?error=invalid_scope\n\
\n- If there is any unexpected error in the server, the authorization server should return\nserver_error to\
\ client's redirect_uri. It should not be the HTTP 500 error displayed to\nthe end user in the browser, because\
\ this error doesn't get sent to the client.\n - Location: https://client_redirect_uri?error=server_error\n\
\n- In the rare case where the authorization server encounters an exception in the communication\nprotocol\
\ while making any connection to an external identity provider, the authorization\nserver redirects the error\
\ to the client's redirect_uri with either of the following messages.\n - Location: https://client_redirect_uri?error=invalid_request&error_description=Connection+reset\n\
\ - Location: https://client_redirect_uri?error=invalid_request&error_description=Read+timed+out\n"
example: https://client_redirect_uri?code=AUTHORIZATION_CODE&state=STATE
'400':
description: The request is missing a required parameter.
/oauth2/token:
post:
tags:
- Authentication
summary: Get Token
description: 'Obtains an access token and, optionally, a refresh token. Read the [Developer Quickstart](/docs/rest-api/tutorials/developer-quickstart)
for an example request.
**Note:** The token endpoint returns refresh_token only when the grant_type is authorization_code.
'
operationId: oauth2Token
parameters:
- in: header
name: Authorization
description: 'The client must pass its client_id and client_secret in the authorization header through Basic HTTP
authorization.
An example is `Basic Base64Encode(client_id:client_secret)` where `Base64Encode` means that the client id and secret
are base64 encoded.
'
schema:
type: string
example: Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=
required: true
requestBody:
content:
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/Oauth2TokenApplicationXWwwFormUrlencodedPostRequest'
responses:
'200':
description: A successful response returning an access token and a possible refresh token.
content:
application/json:
schema:
$ref: '#/components/schemas/Oauth2TokenPostResponse'
'400':
description: A bad token response.
content:
application/json:
schema:
$ref: '#/components/schemas/Oauth2TokenPostResponse-0'
'401':
description: Client authentication failed. The credentials provided in the Authorization header are invalid or missing.
/token-validation:
get:
tags:
- Authentication
summary: Validate Token
description: Verifies presented authentication token is valid.
operationId: validateToken
security:
- OAuth2.clientCredentials: []
- OAuth2.authorizationCode: []
parameters: []
responses:
'200':
$ref: '#/components/responses/ValidToken'
'400':
$ref: '#/components/responses/BadRequest1'
'401':
$ref: '#/components/responses/Unauthorized1'
'403':
$ref: '#/components/responses/Forbidden1'
'429':
$ref: '#/components/responses/TooManyRequests1'
deprecated: false
externalDocs:
description: More about OAuth2 authorization code support for administrators
url: '#oauth2-auth-code-planner-admin'
components:
schemas:
Oauth2TokenPostResponse:
type: object
properties:
access_token:
type: string
description: The access token contains scopes and groups and is used to grant access to authorized resources.
example: eyJz9sdfsdfsdfsd
refresh_token:
type: string
description: The refresh token contains the information necessary to obtain a new access token.
example: dn43ud8uj32nk2je
token_type:
type: string
description: The OAuth2 token type. Always `Bearer`.
example: Bearer
expires_in:
type: integer
description: The lifetime in seconds of the access token.
default: 3600
example: 3600
required:
- access_token
- token_type
- expires_in
Oauth2TokenApplicationXWwwFormUrlencodedPostRequest:
type: object
properties:
grant_type:
description: Controls the OAuth2 grant flow used to obtain tokens.
enum:
- client_credentials
- authorization_code
- refresh_token
example: client_credentials
client_id:
description: 'The OAuth2 Client application ID.
Must be a pre-registered client created in the developer portal.
'
type: string
example: djc98u3jiedmi283eu928
scope:
description: 'Can be a combination of any scopes associated with a client. Any scope requested must be pre-associated
with the client or it will be ignored at runtime.
If the client doesn''t request any scopes, the authorization server uses all scopes associated with the client.
**Optional** - Only used if the grant_type is client_credentials.
'
type: string
example: event/events:read event/attendees:read
redirect_uri:
description: 'Must be the same *redirect_uri* that was used to get *authorization_code* in */oauth2/authorize*.
**Required only if grant_type is authorization_code.**
'
type: string
example: https://example.com/redirect
refresh_token:
description: 'The refresh token.
**Note:** The token endpoint returns *refresh_token* only when the grant_type is *authorization_code*.
'
type: string
example: dn43ud8uj32nk2je
code:
description: 'The code that is returned from a successful */oauth2/authorize*.
**Required if grant_type is authorization_code.**
'
type: string
example: AUTHORIZATION_CODE
required:
- grant_type
- client_id
Oauth2TokenPostResponse-0:
type: object
properties:
error_description:
type: string
description: Additional error information, when available.
error:
type: string
description: '**invalid_request**
The request is missing a required parameter, includes an unsupported parameter value (other than unsupported_grant_type),
or is otherwise malformed. For example, grant_type is refresh_token but refresh_token is not included.
**invalid_client**
Client authentication failed. For example, when the client includes client_id and client_secret in the authorization
header, but there''s no such client with that client_id and client_secret.
**invalid_grant**
Refresh token has been revoked.
Authorization code has been consumed already or does not exist.
**unauthorized_client**
Client is not allowed for code grant flow or for refreshing tokens.
**unsupported_grant_type**
Returned if grant_type is anything other than authorization_code or refresh_token.
'
enum:
- invalid_request
- invalid_client
- invalid_grant
- unauthorized_client
- unsupported_grant_type
example: invalid_request
ValidToken:
title: Valid Token
description: Validity status of an authentication token.
type: object
properties:
tokenValid:
type: boolean
description: True indicates the presented authentication token is valid.
example: true
statusCode:
type: integer
description: Supplementary status code. Typically will be 200 for a success case.
example: 200
ErrorResponseBase1:
title: ErrorResponseBase
type: object
description: Represents an error response with no additional details.
required:
- code
- message
properties:
code:
type: integer
description: The HTTP status code representing the error.
example: 400
message:
type: string
description: A brief description of the error.
example: Bad Request
target:
type: string
description: The target resource of the error.
example: example target
ErrorResponse-12:
title: ErrorResponse
description: Represents an error response with additional details of cascading error messages.
allOf:
- $ref: '#/components/schemas/ErrorResponseBase1'
type: object
required:
- code
- message
properties:
details:
type: array
items:
$ref: '#/components/schemas/ErrorResponseBase1'
description: Additional details of cascading error messages.
responses:
BadRequest1:
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse-12'
example:
code: 400
message: Bad Request
Unauthorized1:
description: Bad or expired token
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse-12'
example:
code: 401
message: Unauthorized
TooManyRequests1:
description: Too many requests
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse-12'
example:
code: 429
message: Limit Exceeded
Forbidden1:
description: You do not have access to the resource
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse-12'
example:
code: 403
message: Access Forbidden
ValidToken:
description: A confirmation message that the token is valid
headers: {}
content:
application/json:
schema:
$ref: '#/components/schemas/ValidToken'
securitySchemes:
OAuth2.clientCredentials:
type: oauth2
description: OAuth2 Client Credentials Flow.
flows:
clientCredentials:
tokenUrl: https://api-platform.cvent.com/ea/oauth2/token
scopes:
account/hooks:delete: Allows the deletion of hooks.
account/hooks:read: Allows the reading of hooks.
account/hooks:write: Allows the creation/updation of hooks.
account/user-groups:delete: Allows deletion for user groups
account/user-groups:read: Allows the reading of user groups
account/user-groups:write: Allows the writing of user groups
account/users:delete: Allows the deletion of User
account/users:read: Allows the reading of User, User Group
account/users:write: Allows the creation/updating of User
appointments/appointment-attendees:read: Allows the reading of appointment attendees and their related entities.
appointments/appointment-events:read: Allows the reading of appointment events and their related entities.
appointments/appointment-types:read: Allows the reading of appointment types and their related entities.
appointments/appointments:read: Allows the reading of appointment and their related entities.
appointments/appointments:write: Allows the writing of appointments and their related entities.
appointments/available-times:read: Allows the reading of availability times.
appointments/locations:read: Allows the reading of appointment locations and their related entities.
attendee-insights/attendee-insights:read: Allows the reading of engagement scores (attendee insights).
attendee-insights/scores:read: Allows the reading of scores.
attendee-insights/stats:read: Allows the reading of engagement score (attendee insight) stats.
budget/budget-items:delete: Allows the deletion of budget items
budget/budget-items:read: Allows the reading of all budget items
budget/budget-items:write: Allows creation/updation of budget item
budget/budget-totals:read: Allows the reading of all event budget totals
budget/budget-vendors:read: Allows reading of account-level budget vendors.
budget/cards:read: Allows the reading of cards
budget/currency-conversion-rate:delete: Allows deletion of currency conversion rate for currency.
budget/currency-conversion-rate:read: Allows reading of currency conversion rate for currency.
budget/currency-conversion-rate:write: Allows creation/update of currency conversion rate for currency.
budget/payments:delete: Allows deletion of payments.
budget/payments:read: Allows reading of payment for budget item.
budget/payments:write: Allows creation of payment in a budget item.
budget/transactions:delete: Allows delete card transactions.
budget/transactions:read: Allows the reading of all card's transactions
budget/transactions:write: Allows creation of card transactions.
bulk/bulk-jobs:read: Allows the reading of bulk job related entities
bulk/bulk-jobs:write: Allows the creation, update and deletion of bulk job related entities
business-transient/bids:read: Allows the reading of Business Transient Bid data
business-transient/proposals:read: Allows the reading of Business Transient Proposal data
business-transient/supplier-brands:read: Allows the reading of a supplier brand or a list of travel supplier brands.
business-transient/supplier-chains:read: Allows the reading of a travel supplier chain or a list of travel supplier
chains.
business-transient/supplier-properties:read: Allows the reading of a travel supplier property or a list of travel
supplier properties.
business-transient/supplier-property-rooms:read: Allows the reading of a list of travel supplier property rooms.
business-transient/travel-accounts:read: Allows the reading of business transient travel account data.
business-transient/travel-program-questions:read: Allows the reading of business transient travel program question
data.
business-transient/travel-programs:read: Allows the reading of business transient travel program data.
business-transient/travel-supplier-accounts:read: Allows the reading of business transient travel supplier account
data.
business-travel/bids:read: Allows the reading of Business Travel Bid data
business-travel/proposals:read: Allows the reading of Business Travel Proposal data
business-travel/travel-accounts:read: Allows the reading of business travel account data.
business-travel/travel-program-questions:read: Allows the reading of business travel program question data.
business-travel/travel-programs:read: Allows the reading of business travel program data.
compliance/communications:read: Allows the reading of communication compliance
compliance/communications:write: Allows the writing of communication compliance
email/bounces:read: Allow the reading of email bounces.
email/email-status:read: Allows the reading of email statuses.
email/emails:read: Allows the reading of emails.
eMarketing/campaigns:read: Allows the reading of campaigns.
emarketing/emarketing-email-status:read: Allows the reading of eMarketing email statuses.
eMarketing/eMarketing-email-templates:read: Allows the reading of email-templates.
eMarketing/eMarketing-send-emails:write: Allows the writing of eMarketing emails.
event/admission-items:read: Allows the reading of admission items
event/air-request:read: Allow reading the air request or air actual detail for attendees.
event/alternate-travel:read: Allow reading the alternate travel answers for attendees.
event/attendance-durations:read: Allows the read of Duration records
event/attendee-activities-metadata:delete: Allows the deletion of attendees activities metadata.
event/attendee-activities-metadata:read: Allows the reading of attendee activities metadata.
event/attendee-activities-metadata:write: Allows the creation/updating of attendees activities metadata.
event/attendee-activities:read: Allows the reading of attendee activities.
event/attendee-activities:write: Allows the writing of external attendee activities.
event/attendee-credits:read: Allows the reading of attendee credits.
event/attendee-links:delete: Allows the deletion of attendee links
event/attendee-links:read: Allows the reading of attendee links
event/attendee-links:write: Allows the creation of attendee links
event/attendee-messages:read: Allows the reading of attendee messages
event/attendees:read: Allows the reading of attendees.
event/attendees:write: Allows the creation of an attendee in an event.
event/audience-segments:read: Allows the reading of audience segments.
event/audience-segments:write: Allows the creation/updating/deletion of audience segments.
event/contact-groups:read: Allows the reading of contact groups.
event/contact-groups:write: Allows the creation/updating of contact groups.
event/contact-types:read: Allows the reading of contact types.
event/contacts:delete: Allows the deletion of contacts.
event/contacts:read: Allows the reading of contacts.
event/contacts:write: Allows the creation/updating of contacts.
event/contacts:write-sensitive: Allows the creation/updating of sensitive data related to contacts.
event/custom-fields:read: Allows the reading of custom fields
event/custom-fields:write: Allows the writing of custom fields
event/discounts:write: Allows the writing of discounts
event/donation-items:read: Allows the reading of donation items.
event/event-discounts:read: Allows the reading of event discounts.
event/event-discounts:write: Allows the writing of event discounts.
event/event-email-status:read: Allows the reading of event email statuses.
event/event-emails:read: Allows the reading of event emails
event/event-emails:write: Allows to send event emails.
event/event-features:read: Allows the reading of events-features
event/event-features:write: Allows updating the event-features
event/event-user-groups:read: Allows the reading of user groups
event/event-user-groups:write: Allows associating/disassociating user groups to event
event/events:read: Allows the reading of events
event/events:write: Allows the creation/updating of events
event/fee-items:read: Allows the reading of fee items.
event/hotel-request:read: Allow reading the hotel request or housing reservation request detail for attendees.
event/invitation-lists:read: Allows the reading of the invitation lists for an event
event/meeting-request-forms:read: Allows the reading of meeting request forms.
event/meeting-requests:read: Allows the reading of meeting requests.
event/meeting-requests:write: Allows the creation/updating of meeting requests.
event/membership-items:read: Allows reading of membership items.
event/orders:read: Allows the reading of orders
event/planning-documents:read: Allows the reading of event planning documents
event/players:read: Allows the reading of players
event/process-form-submissions:read: Allows the reading of process form submissions.
event/program-items:delete: Allows deletion of session program items
event/program-items:read: Allows reading of session program items
event/program-items:write: Allows writing of session program items
event/quantity-items:read: Allows the reading of quantity items.
event/quantity-items:write: Allows the writing of quantity items
event/registration-paths:read: Allows the reading of registration paths
event/registration-types:read: Allows the reading of registration types
event/registration-types:write: Allows the writing of registration types
event/role-assignments:read: Allows the reading of event role assignment.
event/session-attendance:read: Allows the reading of sessions attendance
event/session-attendance:write: Allows the creation/updating of sessions attendance
event/session-categories:read: Allows reading of session categories
event/session-categories:write: Allows writing of session categories
event/session-enrollment:delete: Allows the deletion of session registrations
event/session-enrollment:read: Allows the reading of sessions registrations
event/session-enrollment:write: Allows the writing of sessions registrations
event/session-segments:read: Allows reading of session segments
event/sessions:delete: Allows the deletion of a session in an event
event/sessions:read: Allows the reading of sessions
event/sessions:write: Allows the creation of a session in an event
event/speaker-categories:read: Allows reading of speaker categories
event/speaker-categories:write: Allows writing of speaker categories
event/speakers:delete: Allows the deletion of a speaker in an event
event/speakers:read: Allows the reading of speakers
event/speakers:write: Allows the creation of a speaker in an event
event/taxes:read: Allows the reading of taxes.
event/transactions:read: Allows the reading of transactions
event/transactions:write: Allows the writing of transactions
event/video-views:read: Allows reading of video views.
event/videos:read: Allows the reading of video data.
event/videos:write: Allows the creation/updating of video data.
event/vouchers:read: Allows reading of event vouchers.
event/webcasts:delete: Allows the deletion of webcast
event/webcasts:read: Allows the reading of webcasts
event/webcasts:write: Allows the creation of webcast
event/weblinks:read: Allows the reading of event weblinks
events-plus/hubs:read: Allows the reading of Events+ hub data.
exhibitor/badges:read: Allows reading badges
exhibitor/badges:write: Allows creating/updating badges
exhibitor/booth-staff:delete: Allows deleting booth staff
exhibitor/booth-staff:read: Allows reading booth staff
exhibitor/booth-staff:write: Allows creating booth staff
exhibitor/eliterature-requests:read: Allows reading eliterature document request data
exhibitor/exhibitor-admins:read: Allows reading exhibitor admins
exhibitor/exhibitor-admins:write: Allows creating/updating exhibitor admins
exhibitor/exhibitor-answers:read: Allows reading exhibitor answers
exhibitor/exhibitor-answers:write: Allows updating exhibitor answers
exhibitor/exhibitor-categories:delete: Allows deleting exhibitor categories
exhibitor/exhibitor-categories:read: Allows reading exhibitor categories
exhibitor/exhibitor-categories:write: Allows creating/updating exhibitor categories
exhibitor/exhibitor-contents:delete: Allows deleting exhibitor content
exhibitor/exhibitor-contents:read: Allows reading exhibitor content
exhibitor/exhibitor-contents:write: Allows creating/updating exhibitor content
exhibitor/exhibitor-questions:read: Allows reading exhibitor questions
exhibitor/exhibitors:delete: Allows deleting exhibitors
exhibitor/exhibitors:read: Allows reading exhibitors
exhibitor/exhibitors:write: Allows creating/updating exhibitors
exhibitor/lead-qualification-answers:read: Allows reading Lead Qualification Answers
exhibitor/lead-qualification-questions:read: Allows reading Lead Qualification Questions.
exhibitor/leads:read: Allows reading leads.
exhibitor/registration-packs:delete: Allows deleting registration pack
exhibitor/registration-packs:read: Allows reading registration pack
exhibitor/registration-packs:write: Allows creating/updating registration pack
exhibitor/sponsorship-levels:read: Allows reading sponsorship level
file/file:read: Allows the reading of file
file/file:write: Allows the uploading of file
housing/connections:write: Allows the user to connect to the Reglink APIs.
housing/hotel-room-rates:write: Allows the user to create/update hotel room rates.
housing/housing-event-available-nights:read: Allows the user to read availability information for given event.
housing/housing-event-hotels:read: Allows the user to read information about event hotels.
housing/housing-event-inventory:read: Allows the user to get information about housing event inventory.
housing/housing-event-room-types:read: Allows the user to read information about event room types.
housing/housing-events:read: Allows the user to read information about events.
housing/reservation-requests:delete: Allows the user to cancel reservation request.
housing/reservation-requests:read: Allows the user to read reservation request information.
housing/reservation-requests:write: Allows the user to create/update reservation request.
housing/reservations-link:delete: Allows the user to remove association from reservation.
housing/reservations-link:write: Allows the user to associate reservation to reservation request.
housing/reservations:delete: Allows the user to cancel reservation.
housing/reservations:read: Allows the user to read reservation details information.
housing/reservations:write: Allows the user to create/update reservation.
onsite/signatures:read: Allows reading signatures.
proposal/proposals:write: Allows the creation/writing of proposal
remote-printing/badge-print-jobs:read: Allows reading print jobs.
remote-printing/badge-print-jobs:write: Allows creat
# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cvent/refs/heads/main/openapi/cvent-oauth-api-openapi.yml