Getting started

Eventogy sets up one credential per integration. You exchange it for a short-lived token and call the API from your server.

Your credentials

Eventogy gives you, over a secure channel:

Host — your tenant host, e.g. https://yourcompany.eventogy-api.com. All requests go here; the API base path is /api/v1/partner.
Client ID and Client secret — the secret is shown only once and cannot be retrieved later, so store it securely (a server-side secret store, never in a browser or mobile app).
Scopes the credential holds — partners:read (all GET endpoints), partners:write (all create/update/delete endpoints), or both.

To change access or rotate a secret, ask Eventogy to provision a new credential and switch to it before the old one is retired — this gives a clean overlap with no downtime. If a secret is ever exposed, contact Eventogy to revoke it: revocation is immediate and also invalidates any tokens already issued from it.

Environments

Each credential is bound to one tenant (your Eventogy account) in one environment. Replace {tenant} with the tenant subdomain Eventogy gave you.

Environment	Base URL	Availability
Production	`https://{tenant}.eventogy-api.com/api/v1/partner`	Live client data. The Partner API is enabled per tenant by Eventogy.
UAT	`https://{tenant}.uat-eventogy-api.com/api/v1/partner`	Pre-release acceptance testing. Data is not live and may be reset.

Get an access token

POST /api/v1/partner/oauth/token with the client-credentials grant:

Shell

curl -X POST https://yourcompany.eventogy-api.com/api/v1/partner/oauth/token \
  -H "Accept: application/json" \
  -d grant_type=client_credentials \
  -d client_id=<CLIENT_ID> \
  -d client_secret=<CLIENT_SECRET> \
  -d scope="partners:read partners:write"

Response:

JSON

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJ0eXAiOi…"
}

The token is valid for 1 hour (expires_in: 3600).
There is no refresh token — request a new token when the current one nears expiry. A common pattern is to cache the token in memory and re-fetch on expiry or on a 401.
Request only the scopes your credential holds (space-separated). See the scope caveat under Conventions.

Make your first call

Send the token as a bearer. ping is a connectivity check — use it to confirm your host, credentials, and network path before wiring up real endpoints:

Shell

curl https://yourcompany.eventogy-api.com/api/v1/partner/ping \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Accept: application/json"

JSON

{
  "success": true,
  "code": 200,
  "message": "Partner API connection OK.",
  "data": {
    "tenant": "yourcompany",
    "scopes": ["partners:read", "partners:write"]
  }
}