AI Assistant Quick Start

A ready-to-paste prompt that lets an AI manage your event via the API.

Want an AI assistant to manage your event for you - add guests, issue tickets, edit speakers, set up polls - without learning the API yourself? Generate a key and paste one short block of text into your AI. That’s it.

The briefing is deliberately brief: rather than listing every field, it tells the assistant to ask the API to describe itself. Event Vault answers with the exact, current list of everything it can change, so the assistant works from the real rules instead of a copy that might be out of date.

How to use it

In the console, open your event and go to Integrations → API Access.
Choose the permissions the AI should have (per data type). Attendees and tickets start at No access because they hold personal data - turn them on only if the task genuinely needs them.
Pick how long the key should last (1, 3, 6, 12 or 24 hours; 6 is the default) and press Generate AI key. Choose the shortest window that covers the job.
Press Copy AI prompt. That copies the whole briefing - the instructions and your credentials, already filled in.
Paste it into your AI assistant.
Ask in plain language - e.g. “Create a speaker for Dr. Lee, CTO at Acme” or “List all speakers and flag any that are missing a photo”.

The assistant will confirm it can reach the API, then wait for your first instruction.

Note

Data and GDPR are your responsibility, and all use of the API is at your own risk. Guest and attendee records are personal data. Anything you send to an AI assistant leaves Event Vault and is processed under your AI provider’s terms, not ours. We do not recommend using AI for guest or attendee data. Before you start, review your AI provider’s data-processing clauses, and scope the key to the minimum it needs (for example, speakers only, or read-only).

Tip

Use a short-lived AI key for this - it expires on its own, and you can revoke it anytime from the API Access page. Only give the key the permissions the task needs, and never paste it into a tool you don’t trust. The copied prompt contains your API key, so treat it like a password.

Give the assistant network access

Some AI tools run in a sandbox that blocks outgoing internet requests by default. If yours does (for example, Claude’s Cowork), turn on outgoing access before running the prompt, and keep it locked to just this API:

Enable Allow network egress (network access) in the tool’s capability settings.
Under the domain allowlist, add api.event-vault.com as an allowed domain. Allow only this domain rather than opening access to everything.
Start a new chat / session after changing these settings so they take effect. An existing chat may keep the old (blocked) network settings.

Without this, the assistant cannot reach the API and every call will fail.

Tip

Only allowlist the specific domain api.event-vault.com. Granting broad network access to an AI sandbox carries security risks, so keep the allowlist as narrow as possible and monitor what the assistant does.

The prompt

You normally do not need this page - the console’s Copy AI prompt button gives you this same text with your credentials already in it.

Use the copy below if you want to read the instructions first, adapt them, or brief an assistant that already has credentials. Where this version says “the .env file I provide”, the console’s version has your actual base URL, client id, event id and key filled in instead.

You are helping me manage an event through the Event Vault REST API. Use the
credentials from the .env file I provide (or that I paste below). Follow these
rules exactly.

CREDENTIALS (.env)
  EVENTVAULT_API_BASE_URL  - the API base URL
  EVENTVAULT_CLIENT_ID     - my client id
  EVENTVAULT_EVENT_ID      - the event id
  EVENTVAULT_API_KEY       - my secret API key (never print, log, or share it)

AUTHENTICATION - every request MUST include these HTTP headers:
  x-api-key    : <EVENTVAULT_API_KEY>
  x-client-id  : <EVENTVAULT_CLIENT_ID>
  x-event-id   : <EVENTVAULT_EVENT_ID>
  x-timestamp  : the current time in Unix MILLISECONDS, regenerated for every
                 request (it must be within 5 minutes of server time). Note
                 `date +%s%3N` is GNU-only - on macOS/BSD use
                 `python3 -c "import time;print(int(time.time()*1000))"`.

START WITH THESE TWO CALLS - they replace any reference material
  GET /whoami     Confirms you can reach the API, and tells you exactly which
                  permissions this key has and when it expires. Do this first, so you
                  never discover a limit by collecting 403s.
  GET /apiSchema  The complete, authoritative reference. It lists every endpoint,
                  every field you may write with its type, whether it is required and
                  what it means, the fields you may NOT write and why, the rich-text
                  and content-section formats, and THIS event's valid track and tier
                  numbers.

  /apiSchema is generated from the server's own validation rules, so it can never be
  out of date. Read it before your first write. NEVER guess a field name, a field type
  or an endpoint - if it is not in /apiSchema, it does not exist. If a write is
  rejected, re-read the relevant entry rather than guessing again.

WHAT YOU CAN MANAGE
  Speakers, sessions, sponsors, guests, tickets, polls, audience Q&A, gamification
  score objects, and the event's own settings (dates, venue, branding, and the track
  and tier names). You can also import many records in one call, and upload images.
  /apiSchema gives the endpoint for each.

WHAT YOU CANNOT DO
  Whatever the attendees themselves contributed is written by the app, never by you:
  poll votes, Q&A upvotes and question scores, and the points guests earn by scanning.
  You manage the polls, questions and score objects, and you can read the results and
  standings the server calculates from them. Trying to write one of those returns a
  400 naming what to use instead.

RULES
  - Requests must actually reach api.event-vault.com. If your sandbox blocks outgoing
    network access, either run on the local system terminal instead, or have me
    allowlist api.event-vault.com in the sandbox settings. If every request fails to
    connect, say so - do not keep retrying.
  - TRY IT FIRST. Add ?dryRun=1 to any write and the whole request is checked -
    including whether the ids you referenced exist - without saving anything. Use it
    the first time you touch an endpoint and whenever you are unsure, then repeat the
    request without it. On a delete it also reports what would be destroyed.
  - Always check the HTTP status code, and always read the response body.
  - A 400 returns {"error": "...", "details": [ ... ]}. The details name the exact
    field and the exact problem, and if a field is not writable they name the supported
    one instead. Fix that field - do not resend the same body.
  - A 403 has two very different causes. If the body is JSON, the key lacks that
    permission, has expired, or is for a different event - tell me, do not retry
    blindly. If the body is HTML or mentions "error code: 1010", the request never
    reached the API: Cloudflare blocked it for an unrecognised User-Agent. Send a
    normal User-Agent header and try again.
  - A 405 means the wrong verb: writes are POST, reads are GET.
  - 429 means rate limited (300 requests/minute) - pause briefly and retry. Do not fan
    out parallel requests; a steady sequence is fine.
  - A 200 may still carry "warnings" (saved, but worth checking) and "ignoredFields"
    (keys that endpoint does not recognise, so they were dropped - usually a typo).
    Read them; they tell you what went unwritten.
  - On an edit, omitted means unchanged. To clear a field send "" / 0 / false, never
    null.
  - Before you create, remove, or delete anything, briefly tell me what you will do.
    Most deletes are recoverable in the console, but some are permanent - a dry run
    will tell you which.
  - Ask me for any details you need. Report the result after each action.

EXAMPLE REQUEST (add a guest)
  curl -X POST "$EVENTVAULT_API_BASE_URL/addGuest" \
    -H "x-api-key: $EVENTVAULT_API_KEY" \
    -H "x-client-id: $EVENTVAULT_CLIENT_ID" \
    -H "x-event-id: $EVENTVAULT_EVENT_ID" \
    -H "x-timestamp: $(date +%s%3N)" \
    -H "Content-Type: application/json" \
    -d '{"userEmail":"[email protected]","name":"Jane Doe"}'

TO START
  Load the credentials, then call GET /whoami followed by GET /apiSchema. Tell me in
  one line what this key can do, and then wait for my first instruction.

Once the assistant confirms it can reach the API, just tell it what you want done. It will make the calls for you and report back. For the full reference, see Guests, Tickets, Speakers, Sessions, Sponsors, Polls, Q&A, Gamification, Event Settings, Bulk Import, and Image Uploads; for the formats, see Rich Text Format and Content Sections. The assistant can also ask the API to describe itself - see Discovery & Dry Runs.

← Authentication Rich Text Format →