> ## Documentation Index > Fetch the complete documentation index at: https://hack-club-pin-docs-urls.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get a participant > Full detailed record for one registration, including personal, accommodation, consent, and guardian sections (and sensitive medical / accessibility / safeguarding detail for permitted callers). Not available to event API keys. ## OpenAPI ````yaml /openapi.yml get /events/{event_id}/participants/{id} openapi: 3.0.3 info: title: Attend API version: v1 description: > REST API for [Attend](https://attend.hackclub.com), Hack Club's event management platform. The API is used by the Attend mobile app and by trusted server-to-server integrations. ## Authentication Almost every endpoint requires a bearer token: ``` Authorization: Bearer ``` Four kinds of token are accepted: - **Mobile token** — issued to a signed-in user by `POST /session`. Sets the current user. May return the response header `X-Token-Refresh-Recommended: true` when the token is nearing expiry; call `POST /session/refresh` to rotate it. - **Global API token** — a superadmin-issued token. Only honoured while its owner is still a global admin. Sets the current user. May be **scoped** when issued, in which case it reaches only the endpoints that accept that scope and returns `403` everywhere else, read-only endpoints included. An unscoped token carries its owner's full access. Scopes are noted on the endpoints that accept them; the only one today is `bans:write`. - **Series API key** — one key for a whole event series, issued from **Series → API Keys** in the dashboard by a series owner. Does **not** set a current user. It acts as an event API key on *every* event in its series, and it is the only credential that can create an event. Scopes do not apply — a series key's reach is its series. See the **Series** section. - **Event API key** — per-event key (`EventApiToken`, or the legacy `Event#api_key`). Does **not** set a current user, so it only works on the subset of endpoints that don't require one (participant `lookup`, `roster`, `create`, and the travel calendar). Missing or invalid credentials return `401 { "error": "Unauthorized" }`. ### What an API key cannot do Neither key kind sets a current user, so endpoints that must attribute work to a person stay closed to both — regardless of how broad the key is. A series key is wider in *reach* (more events), never in *depth*: | Endpoint | Series key | Event key | | --- | --- | --- | | `GET/POST /series/…` | ✅ its own series | ❌ `403` | | `POST /series/{id}/events` | ✅ its own series | ❌ `403` | | Participant `lookup`, `roster`, `create` | ✅ any event in the series | ✅ its own event | | `GET /events/{id}/travel` | ✅ any event in the series | ✅ its own event | | `GET /events/{id}/participants` (full payload) | ❌ `403` | ❌ `403` | | Notes, scans, scan contexts, Slack blasts, NFC badges | ❌ `403` | ❌ `403` | Either key can be revoked without credentials by POSTing its own secret to `POST /tokens/revoke`; Attend emails the key's owner (or, if their account is gone, the series owners) when that happens. ## Conventions - All timestamps are ISO 8601 strings and may be `null` where noted. - Errors use the envelope `{ "error": "" }`. - `:event_id` path segments accept a numeric id or the event slug on the participants endpoints; other endpoints accept the numeric id only. > **Note:** Inbound webhook receivers (Postmark, Help Scout, DocuSeal, > Slack events) also live under `/api/v1` but are called by third parties, > not by API consumers, and are not documented here. servers: - url: https://attend.hackclub.com/api/v1 description: Production - url: http://localhost:3000/api/v1 description: Local development security: - bearerAuth: [] tags: - name: Authentication description: Obtain, refresh, and revoke mobile bearer tokens. - name: Account description: The authenticated user's profile and accessible events. - name: Series description: >- Event series, and the events inside one, addressed with a single series API key. Creating an event lives here — an event has to belong to a series, and only a series key names one unambiguously. - name: Participants description: Participant registrations for an event. - name: Notes description: Staff notes on a participant's registration. - name: Scans description: QR / NFC / manual scans and check-in. - name: Scan Contexts description: The scan stations configured for an event. - name: Travel Calendar description: Chronological participant travel and pickup operations. - name: Slack Blasts description: Broadcast Slack messages to an event's participants. - name: NFC Badges description: Provision and manage participant NFC badges. - name: Push Tokens description: Register device push-notification tokens. - name: Bans description: The app-wide ban list. Global admins only. - name: Travel description: >- Airport and flight lookups. These endpoints authenticate with the web session cookie (Devise), not a bearer token. paths: /events/{event_id}/participants/{id}: get: tags: - Participants summary: Get a participant description: >- Full detailed record for one registration, including personal, accommodation, consent, and guardian sections (and sensitive medical / accessibility / safeguarding detail for permitted callers). Not available to event API keys. parameters: - $ref: '#/components/parameters/EventId' - name: id in: path required: true schema: type: integer description: The participant_event id. responses: '200': description: The participant. content: application/json: schema: type: object properties: participant: $ref: '#/components/schemas/ParticipantDetail' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: parameters: EventId: name: event_id in: path required: true schema: type: string description: Event id or slug. schemas: ParticipantDetail: description: >- The full participant record returned by GET /participants/{id}. Extends the list representation with personal, accommodation, consent and guardian sections, plus sensitive medical / accessibility / safeguarding detail for permitted callers. allOf: - $ref: '#/components/schemas/Participant' - type: object properties: personal: type: object properties: legal_first_name: type: string legal_last_name: type: string preferred_name: type: string nullable: true date_of_birth: type: string format: date nullable: true age: type: integer nullable: true tshirt_size: type: string nullable: true engagement_preference: type: string nullable: true engagement_notes: type: string nullable: true address: type: object description: Blank fields are omitted. properties: line_1: type: string line_2: type: string city: type: string state: type: string postal_code: type: string country: type: string accommodation: type: object nullable: true properties: check_in_date: type: string format: date nullable: true check_out_date: type: string format: date nullable: true gender_identity: type: string nullable: true gender_identity_other: type: string nullable: true assigned_room: type: string nullable: true rooming_exempt: type: boolean venue_name: type: string nullable: true preferred_roommate_genders: type: string nullable: true roommate_preferences: type: string nullable: true roommate_exclusions: type: string nullable: true quiet_room_preference: type: string nullable: true room_type_preference: type: string nullable: true accessibility_needs: type: string nullable: true notes: type: string nullable: true consents: type: array items: type: object properties: id: type: integer consent_type: type: string status: type: string pending_on: type: string nullable: true sent_at: type: string format: date-time nullable: true viewed_at: type: string format: date-time nullable: true participant_signed_at: type: string format: date-time nullable: true guardian_signed_at: type: string format: date-time nullable: true signed_at: type: string format: date-time nullable: true document_url: type: string nullable: true failure_reason: type: string nullable: true guardians: type: array items: type: object properties: id: type: integer guardian_id: type: integer nullable: true name: type: string nullable: true email: type: string nullable: true phone: type: string nullable: true relationship: type: string nullable: true is_primary: type: boolean status: type: string accepted_at: type: string format: date-time nullable: true completed_at: type: string format: date-time nullable: true invited_via_email: type: string nullable: true invite_token_sent_at: type: string format: date-time nullable: true media_permission: type: string nullable: true photo_permission: type: string nullable: true travel_permission: type: string nullable: true emergency_medical_consent: type: string nullable: true otc_medication_consent: type: string nullable: true emergency_contacts: type: array items: type: object properties: id: type: integer name: type: string phone: type: string email: type: string relationship: type: string priority: type: integer medical_detail: type: object nullable: true description: Sensitive — permitted callers only. properties: allergy_severity: type: string nullable: true emergency_action_plan: type: string nullable: true additional_notes: type: string nullable: true dietary_detail: type: object nullable: true description: Sensitive. properties: intolerances: type: string nullable: true notes: type: string nullable: true accessibility: type: object nullable: true description: Sensitive. additionalProperties: true safeguarding_detail: type: object nullable: true description: Sensitive. properties: high_support_notes: type: string nullable: true authorized_pickup_adults: type: string nullable: true other_instructions: type: string nullable: true curfew_acknowledged: type: boolean overnight_rules_acknowledged: type: boolean Participant: type: object description: >- A participant registration. Sensitive fields (allergies, medical, dietary, safeguarding, emergency and guardian contacts) are only present for global admins and safeguarding leads. properties: participant_id: type: integer participant_event_id: type: integer display_name: type: string example: Jane full_name: type: string example: Jane Doe email: type: string format: email slack_user_id: type: string nullable: true phone: type: string nullable: true pronouns: type: string nullable: true headshot_url: type: string nullable: true status: $ref: '#/components/schemas/ParticipantStatus' checked_in_at: type: string format: date-time nullable: true nfc_badge_token: type: string nullable: true nfc_badge_assigned: type: boolean has_anaphylaxis_risk: type: boolean requires_refrigeration: type: boolean cross_contamination_risk: type: boolean high_support_flag: type: boolean can_leave_unaccompanied: type: boolean waiver_signed: type: boolean updated_at: type: string format: date-time scans_by_context: type: array items: $ref: '#/components/schemas/ScansByContext' travel_inbound: nullable: true allOf: - $ref: '#/components/schemas/Travel' travel_outbound: nullable: true allOf: - $ref: '#/components/schemas/Travel' allergies: type: string nullable: true description: Sensitive — permitted callers only. medical_conditions: type: string nullable: true description: Sensitive. medications: type: string nullable: true description: Sensitive. diet_type: type: string nullable: true description: Sensitive. life_threatening_allergies: type: string nullable: true description: Sensitive. freedom_waiver_granted: type: boolean description: Sensitive. emergency_contacts: type: array description: Sensitive — permitted callers only. items: type: object properties: name: type: string phone: type: string relationship: type: string priority: type: integer parent_guardian_name: type: string description: Sensitive; present only if a primary guardian exists. parent_guardian_phone: type: string description: Sensitive. parent_guardian_email: type: string description: Sensitive. Error: type: object properties: error: type: string example: Unauthorized ParticipantStatus: type: string enum: - invited - in_progress - awaiting_guardian - complete - withdrawn - rejected ScansByContext: type: object properties: scan_context_id: type: integer scan_context_name: type: string checks_in: type: boolean is_travel_pickup: type: boolean is_airport: type: boolean deprecated: true description: Deprecated alias for `is_travel_pickup`. scan_count: type: integer first_scanned_at: type: string format: date-time nullable: true last_scanned_at: type: string format: date-time nullable: true Travel: type: object description: A participant's inbound or outbound travel record. properties: id: type: integer direction: type: string example: inbound mode: type: string example: plane visa_required: type: boolean nullable: true visa_status: type: string nullable: true visa_type: type: string nullable: true visa_number: type: string nullable: true passport_nationality: type: string nullable: true is_unaccompanied_minor: type: boolean carrier: type: string nullable: true flight_number: type: string nullable: true train_departure_station: type: string nullable: true train_arrival_station: type: string nullable: true departure_station: type: string nullable: true arrival_station: type: string nullable: true departure_city: type: string nullable: true arrival_city: type: string nullable: true departure_time: type: string format: date-time nullable: true arrival_time: type: string format: date-time nullable: true expected_arrival_time: type: string format: date-time nullable: true bus_departure_location: type: string nullable: true bus_arrival_location: type: string nullable: true origin_address: type: string nullable: true other_details: type: string nullable: true notes: type: string nullable: true pickup_dismissed_at: type: string format: date-time nullable: true legs: type: array items: $ref: '#/components/schemas/TravelLeg' TravelLeg: type: object properties: id: type: integer position: type: integer flight_code: type: string nullable: true departure_airport: type: string nullable: true arrival_airport: type: string nullable: true departure_time: type: string format: date-time nullable: true arrival_time: type: string format: date-time nullable: true live_status: type: string nullable: true live_departure_time: type: string format: date-time nullable: true live_arrival_time: type: string format: date-time nullable: true travel_picked_up_at: type: string format: date-time nullable: true airport_picked_up_at: type: string format: date-time nullable: true deprecated: true description: Deprecated alias for `travel_picked_up_at`. responses: Unauthorized: description: Missing or invalid credentials. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: The caller cannot access this event or action. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Event or record not found. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer description: >- Mobile token, global API token, series API key, or event API key. See Authentication above for which endpoints each one reaches. ````