Open API
Read-only REST API for organizer data, plus signed webhooks. Base URL: https://ticket.20fit.id/api/v1
Authentication
Create keys in your dashboard → Developers. Send them as a bearer token:
curl https://ticket.20fit.id/api/v1/events \ -H "Authorization: Bearer sk_live_xxx.yyy"
pk_publishable keys →events:readonly.sk_secret keys → scoped organizer reads. Keep them server-side.- Rate limit: 120 requests / minute / key (429 with
Retry-After).
Endpoints
| Method | Path | Scope | Description |
|---|---|---|---|
| GET | /v1/events | events:read | List your events with ticket types and poster URL (posterUrl). Publishable keys return published events only. |
| GET | /v1/orders | orders:read | List orders. Query: ?status=paid&limit=50. |
| GET | /v1/orders/{orderNumber} | orders:read | Order detail with fee breakdown, items, tickets. |
| GET | /v1/tickets | tickets:read | List issued tickets. Query: ?eventId=&status=&limit= (max 200). |
| GET | /v1/settlements | settlements:read | Per-event settlement accounting. Query: ?eventId=&limit=. |
Webhooks
Register an endpoint in Developers. We POST events (e.g. order.paid) with a signature header:
X-20FIT-Signature: t=1720000000,v1=<hex hmac>
// verify: HMAC_SHA256(secret, `${t}.${rawBody}`) === v1Reject requests where the timestamp is older than ~5 minutes to prevent replay.