Create an event once. Open it safely anywhere.

QUICK START

Authenticate from your backend

Send your API key in the Authorization: Bearer … header. Store it in a server-side secret manager or private environment variable.

Customer portal-issued API keys will carry tenant scope. The X-Integration-Id header identifies the integration/client until the DB-backed authentication migration lands, and the live API currently requires it.

POST/api/v1/integrations/events

Create an event

Choose a stable Idempotency-Key for the logical create operation and reuse that same value when retrying. A retry then returns the original event rather than creating a duplicate.

# Run this from your server, CI job or secure terminal.
curl --request POST \
  "$CFM_API_ORIGIN/api/v1/integrations/events" \
  --header "Authorization: Bearer $CFM_API_KEY" \
  --header "X-Integration-Id: $CFM_INTEGRATION_ID" \
  --header "Idempotency-Key: event-2026-09-09-river-festival" \
  --header "Content-Type: application/json" \
  --data '{
    "ownerName": "Operations desk",
    "title": "River festival volunteer team",
    "eventType": "Community Event",
    "operationalArea": "Town centre and showgrounds",
    "description": "Check in at the operations tent.",
    "startsAt": "2026-09-12T22:00:00.000Z",
    "closesAt": "2026-09-13T06:00:00.000Z",
    "retentionDays": 30,
    "centreLat": -38.0816,
    "centreLng": 142.808,
    "authorityConfirmed": true
  }'

POST/api/v1/integrations/events/{id}/embed-sessions

Open the owner workspace

After creating an event, request a short-lived, one-time embed session from your server. The event must belong to the account authenticated by the Bearer key.

# Run this from your server, CI job or secure terminal.
curl --request POST \
  "$CFM_API_ORIGIN/api/v1/integrations/events/$CFM_EVENT_ID/embed-sessions" \
  --header "Authorization: Bearer $CFM_API_KEY" \
  --header "X-Integration-Id: $CFM_INTEGRATION_ID"

# The response contains embedUrl and expiresAt.
# Send only embedUrl to the authorised browser. It can be opened once.

1. 1
   Your server requests a session

   Call the endpoint with the event ID and server-side Bearer key.

2. 2
   Return only the embed URL

   Do not proxy the API key, permanent owner link or response headers to the client.

3. 3
   Open only the returned launch URL in the browser

   The URL is short-lived and one-time. Request a new session instead of storing or replaying it.