Venue API

Overview

When a parent books a party with you, your confirmation page and emails show a Make your invites button. When they tap it, your server calls us with the party details, and we reply with a link to send them to. They land on an invite with the date, time and place already filled in and locked, pick a design and share it. Your team then sees the party’s headcount in the venue dashboard: numbers only, never guests’ names or notes.

• Data moves only when the host taps, so a booking that never makes invites is never shared with us.
• The booking email is included so only the person who booked can claim the invite.
• Calls are idempotent per booking: a repeat handoff for the same reference returns the same link.
• Any party works, not only a children’s birthday: send the occasion, or set one per package in your venue dashboard.

Authentication

Every call carries your venue’s API key as a bearer token. Create and revoke keys in the venue dashboard; keep them on your server, never in a browser or an email.

Authorization: Bearer YOUR_API_KEY

Start with a test key, which begins rsvps_test_. It works exactly like a live key, but every invite it makes is marked Test, is kept apart from your live bookings even when the reference is the same, and sends no reminders or updates. Packages it names are never added to your settings or renamed. Switch to a live key, which beginsrsvps_live_, when your integration is ready for real parents.

The API keys page in your venue dashboard lists the last 50 bookings your keys sent in the past 30 days, with what happened to each: an invite started, the same booking sent again, or a refusal and why, down to the fields a request got wrong. Once you have a test key, Send a test booking there sends a practice one so you can watch it arrive.

Each key can make 120 requests a minute. To rotate a key, create a new one, switch your server over to it, then revoke the old one. The base URL ishttps://app.inviteroo.com.

Create a handoff

PUT/api/v1/venue/handoffs/:externalRef

Call this when the parent taps the button. externalRef is your booking reference: letters, numbers, dots, dashes and underscores, up to 64 characters. Send a JSON body; unknown fields are rejected.

curl -X PUT https://app.inviteroo.com/api/v1/venue/handoffs/BB-20417 \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "childFirstName": "Mabel",
    "childAge": 7,
    "partyDate": "2027-10-17",
    "startTime": "14:00",
    "endTime": "16:00",
    "hostFirstName": "Jo",
    "bookingEmail": "jo@example.com"
  }'

A successful call returns 200 with the link to redirect the parent to, usually with a 303 See Other from your own route:

{ "url": "https://app.inviteroo.com/start/…" }

Make the call outside any database transaction on your side, and if it fails, show the host a friendly “Invites are having a moment, try again shortly” page. The link opens the host’s draft, so never store it, log it or put it in an email: hand it over with a redirect from a button they pressed.

Moves and cancellations

PATCH/api/v1/venue/bookings/:externalRef

Call this whenever a confirmed booking changes date or time, or is cancelled or expires. It carries no personal data. If the parent has shared the invite, guests see the new details, or that the party is cancelled, the next time they open it.

curl -X PATCH https://app.inviteroo.com/api/v1/venue/bookings/BB-20417 \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "partyDate": "2027-10-24", "startTime": "14:00", "endTime": "16:00", "status": "confirmed" }'

It returns { "updated": true }. A 404 means the host never made invites, so there is nothing to update. Send these from a queue and retry with backoff on anything else, including a 503 while updates are paused.

Packages that offer invites

A package is a party product your booking system sells, such as a jungle party or an adult hire. Name it in each handoff’s bookingType and we learn it from there; you then choose in your venue dashboard which packages offer invites, and what each one’s invites start as. Two optional calls keep your system in step.

GET/api/v1/venue/booking-types

Ask before showing the button, and cache the answer for a few minutes. Show the button when the venue-wide switch is on and the booking’s package offers invites, or, for a package we haven’t seen, when new packages are set to offer.

PUT/api/v1/venue/booking-types/:bookingTypeId

Registers or renames a package ahead of any booking, so the venue can decide on it before anyone books. bookingTypeId is your own id for it: letters, numbers, dots, dashes and underscores, up to 64 characters. It never changes whether the package offers invites; that stays with the venue dashboard. Send it from a queue too: while handoffs are paused it answers 503 and changes nothing, so retry it with backoff.

curl https://app.inviteroo.com/api/v1/venue/booking-types \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY"

curl -X PUT https://app.inviteroo.com/api/v1/venue/booking-types/jungle-party \
  -H "Authorization: Bearer $RSVP_SORTED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Jungle party" }'

The GET answers with your venue-wide switch and every package with whether it offers invites, as in the table above. The PUT answers with the package as we now hold it:{ "id": "jungle-party", "name": "Jungle party", "offerInvites": true }.

Errors

Errors are RFC 9457 problem details (application/problem+json) with a stable code. Log the code and the status, never the body you sent, which carries personal data.

Where to show the link

• On your booking confirmation page, next to Add to my calendar, for confirmed and paid bookings only.
• In the booking confirmation and payment emails, as a link to a page on your site with one button. Mail scanners and link previews open links before anyone clicks, so the handoff itself must only ever happen from a button someone pressed, never from the email link.
• Wherever hosts look up their booking.

Suggested wording: “Make invites for Mabel’s party in a minute, free with your booking.” The button itself says Make your invites.

Security and data

• We store the first name and age of the person the party is for, the occasion, the party date and times, the room, the package, the number of places, the booking reference and the parent’s first name. For the booking email and mobile number we store a keyed hash and a masked hint only.
• Booking updates carry no personal data.
• The list of bookings received keeps each booking’s reference, package, outcome and key for 30 days, and nothing about the family.
• Invites, replies and everything attached to them are deleted 90 days after the party.
• Your dashboard shows each party’s numbers: children coming, grown-ups staying and who is still to reply. Never guests’ names, notes or contact details.
• We act as a separate controller for the host’s and guests’ data. Add a line to your privacy notice saying that if a parent chooses to make invitations, you share their child’s first name and age, the occasion, the party’s date, times, room, package and number of places, the booking reference, their first name, and the email address and mobile number they booked with, with Inviteroo.

Questions about connecting? Email hello@rsvpsorted.com.