Congressio API

Public endpoints — no authentication

The conference directory is readable without credentials. It returns exactly what an anonymous visitor sees on the public event pages: name, slug, dates, timezone, venue, organizer and whether the program is published. Rate limit: 60 requests per minute per IP address.

• GET/api/v1/public/events

  Public conference directory — name, slug, dates, timezone, venue, organizer, program status.

• GET/api/v1/public/events/{eventSlug}

  One publicly visible conference, by slug.

curl -s https://www.congressio.net/api/v1/public/events?limit=5

Organization API keys

Everything beyond the public directory is scoped to one organization. An organization admin creates a key in Organization settings → API; the secret is shown once and stored only as a hash, so rotate by creating a new key and revoking the old one. Send it as a bearer token. Rate limit: 120 requests per minute per key.

curl -s https://www.congressio.net/api/v1/events \
  -H "Authorization: Bearer cong_live_…"

Scopes

A key is granted exactly the scopes it needs. An operation whose scope is missing is refused with HTTP 403 and the code forbidden.

• events:read
• submissions:read
• registrations:read
• registrations:write

Endpoints

• GET/api/v1/eventsevents:read

  Every event owned by the key's organization.

• GET/api/v1/events/{eventId}/submissionssubmissions:read

  Submitted papers and abstracts, with status and track.

• GET/api/v1/events/{eventId}/registrationsregistrations:read

  Confirmed attendee registrations, tiers and payment status.

• POST/api/v1/events/{eventId}/registrationsregistrations:write

  Register an attendee and issue their pass. Takes no payment.

OpenAPI specification

Every operation has a unique operation ID, a description, typed parameters and a response schema — enough to generate a client, or LLM function-calling definitions, straight from the document.

• https://www.congressio.net/openapi.json
• https://www.congressio.net/api/openapi.json

Errors

Errors are always JSON, never an HTML page. Each one carries a stable code to branch on, a human-readable message, a hint describing how to resolve it, and a link to this page.

{
  "error": "Missing required scope: registrations:write",
  "code": "forbidden",
  "message": "Missing required scope: registrations:write",
  "hint": "The key is valid but lacks the scope this operation needs. Re-create the key with the required scope.",
  "docs": "https://www.congressio.net/developers"
}

For AI agents

llms.txt describes what Congressio is for, which jobs it is the right tool for, and the exact calls to make. Public pages also answer Accept: text/markdown with a Markdown representation of the same URL, so an agent does not have to parse the rendered page.

curl -s -H "Accept: text/markdown" https://www.congressio.net/

Rate limits

Every response states the quota, so a client can pace itself instead of discovering the ceiling by being refused. Unauthenticated endpoints allow 60 requests per minute per IP address; keyed endpoints allow 120 per minute per key. A refused request answers 429 with Retry-After — wait that long rather than guessing a backoff.

RateLimit-Policy: "default";q=120;w=60
RateLimit: "default";r=119;t=42
RateLimit-Limit: 120
RateLimit-Remaining: 119
RateLimit-Reset: 42

# on a 429
Retry-After: 42

Command-line tool

The official CLI wraps this API for shells, CI pipelines and agents. It has no dependencies, needs no build step, prints the API payload unchanged with --json, and honours the rate-limit headers above.

Connect an AI assistant

Congressio speaks the Model Context Protocol, so you can add it to Claude, ChatGPT or any assistant that supports connectors and then ask about your conference in plain language. Authentication is OAuth — the assistant registers itself and sends the user through a consent screen, so there is no key to paste. Every tool is bounded by that user's own role.

https://www.congressio.net/api/mcp

Webhooks

Subscribe an endpoint to submission, review, decision, registration, lead and invoice events. Each delivery is an HTTP POST signed with HMAC-SHA256 over a timestamped payload, and failed deliveries retry with backoff.