/v1 · stable

Build on the rails
we sell on.

REST API, bearer-token auth, signed webhooks with replay protection. The same surface our own dashboard runs on. ZAR everywhere, integer cents, ISO-8601 timestamps with offset.

Get an API tokenSee examples
  • PCI Level 1 · via Paystack
  • Card data never touches us
  • T+1 daily ZAR settlement
  • Public REST API · /v1
  • Signed webhooks · HMAC-SHA256
  • RLS on every tenant table
  • POPIA-compliant by design
  • 30-min seat reservation hold
  • CPA-aligned refund policy
  • Built in South Africa

Endpoints · /v1

The full surface, no waitlist.

Every endpoint we ship internally is on the public token. No feature gates, no Enterprise tier, no “contact sales for webhook signing”.

GET/v1/pingHealth probe
GET/v1/eventsList your events
POST/v1/eventsCreate event
GET/v1/events/{id}Read event
GET/v1/events/{id}/availabilityLive capacity by tier
GET/v1/events/{id}/tiersList tiers
POST/v1/checkout-sessionsOpen a hosted checkout
GET/v1/transactionsList settled transactions
GET/v1/transactions/verify/{ref}Verify Paystack ref
GET/v1/ordersList orders
GET/v1/orders/{id}Read order + ticket tokens
GET/v1/tickets/{token}Read ticket by share token
GET/v1/resale/listingsActive resale listings
POST/v1/webhooksSubscribe to event webhooks
DELETE/v1/webhooks/{id}Revoke a subscription

Authentication

curl https://eventu.co.za/v1/events \
  -H "Authorization: Bearer evu_live_…" \
  -H "Accept: application/json"

Tokens are scoped to a single organisation. Generate from the dashboard. Rotate any time.

Rate limits

Read endpoints1 000 / min
Write endpoints200 / min
Burst allowance+50 / 10s
Per-IP cap3 000 / min

Webhook events

event.published
order.paid
order.refunded
ticket.scanned
resale.listed
resale.sold

Signed with HMAC-SHA256. Replay-protected via nonce + timestamp.

Examples · /v1

Three lines, every language.

Same request, three runtimes. Same auth header, same response shape. Bearer token in the header, JSON out, ISO-8601 timestamps, integer cents. No SDK wrapper required — though one’s coming.

RequestGET /v1/events
curl https://eventu.co.za/v1/events \
  -H "Authorization: Bearer evu_live_…" \
  -H "Accept: application/json"
Response · 200 OKapplication/json
{
  "data": [
    {
      "id": "ev_2VxQpL",
      "slug": "vastrap-pretoria",
      "title": "Vastrap · Pretoria",
      "starts_at": "2026-03-14T19:00:00+02:00",
      "venue": "Hartfield Christian Centre",
      "currency": "ZAR",
      "min_price_cents": 18000,
      "tier_count": 3,
      "tickets_sold": 342,
      "status": "published"
    }
  ],
  "next_cursor": null
}

Build on EventU

A token, a curl, a callback. Ship by Friday.

Get an API tokenTry /v1/ping
POPIA compliantPaystack securedCPA-aligned refundsBuilt in South Africa