Skip to main content
The Vizito API is a JSON API over HTTPS. Every endpoint lives under one base URL, takes and returns JSON, and is authenticated with an API key.

Base URL

Every path in this reference is relative to that base URL. GET /companiesList means GET https://api.vizito.eu/api/companiesList.

​
Authentication

Send your API key as a bearer token on every request:
Keys are created by a global admin on the Integrations page of the Backoffice. See Authentication for expiry, IP restrictions, Microsoft Entra ID and what a key is not allowed to do.

​
Everything hangs off a location

Almost every endpoint names a location, either in the path (/companies/{company_id}/...) or in the body (company_id). Your key is pinned to a set of locations, and naming one outside that set is refused with 403. Start with GET /companiesList: it is the only endpoint that needs no location id, and it returns the ones your key covers.

​
Conventions

Every id is a 24-character hexadecimal string, e.g. 5f2a1b9c4d3e2f0011223344. Objects carry theirs as _id. Ids are stable: store them rather than re-resolving objects by name.
Timestamps are ISO 8601 in UTC — 2026-08-29T07:58:11.000Z — both in and out. Where an endpoint takes a date in the path it also accepts a plain YYYY-MM-DD, which is read in the location’s own timezone.
Send Content-Type: application/json. Form-encoded bodies are accepted too, for the sake of older integrations, but JSON is what you want.
A visit type can define its own questions. Their answers are stored on the visitor or registered visitor under the field’s field_name, alongside the built-in fields — so you send and read them as ordinary top-level keys. GET /companies/{company_id}/fields lists what a location has.
Visitors, registered visitors and hosts accept keys beyond the documented ones and store them as-is. Handy for carrying your own reference ("crm_id": "..."), but be deliberate: a typo in a field name creates a new field rather than failing.
Endpoints that return configured text — visit types, agreements, fields — take a language_id query parameter (en, nl, fr, de, …) and answer in that language, falling back to English.

​
Listing endpoints

The two big lists — visitors and registered visitors — are the ones the Backoffice grids are built on, so they take the grid’s parameters: They answer with the page and the unfiltered-by-page total:
Every other list endpoint returns a plain array.

​
Rate limits

There is no general request quota. Two things are limited:
  • Failed key presentations — 30 refused credentials from one IP address in 15 minutes gets you 429 for the rest of the window. Valid requests never count towards it.
  • Bulk invitations — capped per location, so a loop cannot mail your whole address book. Over the cap, the extra recipients are reported as skippedRateLimited rather than sent.
Still, be reasonable: prefer one call with a page of 100 over a hundred calls, and use webhooks instead of polling every few seconds.

​
Errors

Failures come back as an HTTP status with a short JSON body. See Errors for what each status means and how to react to it.

Related topics

Introduction