Signing in a visitor

POST /visitors

Creates a visit. It runs the complete sign-in flow: the host is notified, the badge is printed if the visit type prints one, the confirmation email goes out, and every integration and webhook fires.

Body

string

required

The location to sign in to.

string

Visit type id. Falls back to the location’s default visit type.

string

Visitor’s first name.

string

Visitor’s last name.

string

The organisation the visitor comes from.

string

Visitor’s email address. Needed for the sign-in confirmation mail.

string

Phone number. Prefixed with the visit type’s default country code when it does not start with +.

string

Name of the host. Match an existing host’s cn and their contact details are filled in automatically.

string

Where to notify the host, when it cannot be resolved from the host list.

string

Link the visit to a registered visitor. Hidden fields stored on that record are carried over.

string

Entrance to record the visit against.

string

default:"1"

"0" records the visit as a Backoffice/API sign-in, "1" as a kiosk sign-in, "2" as contactless.

string

ISO 8601 timestamp to backdate the sign-in. Without it the visit starts now, in the location’s timezone.

string

Language for the visitor’s emails, e.g. nl.

string

Any field the visit type defines, under its field_name. See Listing fields.

Response

string

Visitor added!

object

The visit that was created. Keep data._id — you need it to sign the visitor out again.

curl -X POST https://api.vizito.eu/api/visitors \
  -H "Authorization: Bearer $VIZITO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "company_id": "5f2a1b9c4d3e2f0011223344",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "company": "Analytical Engines Ltd",
    "email": "ada@example.com",
    "recipient": "Jane Doe",
    "recipient_mail": "jane.doe@example.com",
    "signed_in_source": "0"
  }'

{
  "message": "Visitor added!",
  "data": {
    "_id": "66b0f1a2c3d4e5f600112233",
    "first_name": "Ada",
    "signed_in": "2026-08-29T07:58:11.000Z",
    "signed_in_source": 0
  }
}

Required fields and validation rules are enforced in the front office, not here — a visit created through the API with a required field missing is accepted as-is.

There is no idempotency key yet: a retried request creates a second visit. Guard the retry on your side.

Getting started

Locations

Visitors

Registered visitors

Hosts

Visit types

Entry points

Agreements

Devices

Reporting

Webhooks

Signing in a visitor

Body

Response

​Body

​Response

Body

Response