curl --request POST \
--url https://api.vizito.eu/api/visitors \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"company_id": "5f2a1b9c4d3e2f0011223344"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({company_id: '5f2a1b9c4d3e2f0011223344'})
};
fetch('https://api.vizito.eu/api/visitors', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.vizito.eu/api/visitors"
payload = { "company_id": "5f2a1b9c4d3e2f0011223344" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.vizito.eu/api/visitors",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'company_id' => '5f2a1b9c4d3e2f0011223344'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"message": "Visitor added!",
"data": {
"_id": "5f2a1b9c4d3e2f0011223344",
"company_id": "5f2a1b9c4d3e2f0011223344",
"first_name": "Ada",
"last_name": "Lovelace",
"company": "<string>",
"email": "jsmith@example.com",
"phone": "<string>",
"recipient": "<string>",
"recipient_mail": "jsmith@example.com",
"visit_type": "5f2a1b9c4d3e2f0011223344",
"entrypoint_id": "5f2a1b9c4d3e2f0011223344",
"known_visitor_id": "5f2a1b9c4d3e2f0011223344",
"signed_in": "2023-11-07T05:31:56Z",
"signed_out": "2023-11-07T05:31:56Z",
"signed_in_source": 0,
"signed_out_source": 0,
"approval": "pending",
"safe": true,
"agreements": [
"5f2a1b9c4d3e2f0011223344"
],
"photo": "<string>",
"signature": "<string>",
"mod_date": "2023-11-07T05:31:56Z"
}
}{
"message": "<string>"
}{
"error": "Invalid API key"
}Signing in a visitor
Creates a visit, running the complete sign-in flow: the host is notified, the badge is printed if the visit type prints one, the confirmation email goes out, and every integration and webhook fires.
Required fields and validation rules are enforced in the front office, not here — a visit created through the API with a required field missing is accepted as-is. There is no idempotency key yet: a retried request creates a second visit.
curl --request POST \
--url https://api.vizito.eu/api/visitors \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"company_id": "5f2a1b9c4d3e2f0011223344"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({company_id: '5f2a1b9c4d3e2f0011223344'})
};
fetch('https://api.vizito.eu/api/visitors', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.vizito.eu/api/visitors"
payload = { "company_id": "5f2a1b9c4d3e2f0011223344" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.vizito.eu/api/visitors",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'company_id' => '5f2a1b9c4d3e2f0011223344'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"message": "Visitor added!",
"data": {
"_id": "5f2a1b9c4d3e2f0011223344",
"company_id": "5f2a1b9c4d3e2f0011223344",
"first_name": "Ada",
"last_name": "Lovelace",
"company": "<string>",
"email": "jsmith@example.com",
"phone": "<string>",
"recipient": "<string>",
"recipient_mail": "jsmith@example.com",
"visit_type": "5f2a1b9c4d3e2f0011223344",
"entrypoint_id": "5f2a1b9c4d3e2f0011223344",
"known_visitor_id": "5f2a1b9c4d3e2f0011223344",
"signed_in": "2023-11-07T05:31:56Z",
"signed_out": "2023-11-07T05:31:56Z",
"signed_in_source": 0,
"signed_out_source": 0,
"approval": "pending",
"safe": true,
"agreements": [
"5f2a1b9c4d3e2f0011223344"
],
"photo": "<string>",
"signature": "<string>",
"mod_date": "2023-11-07T05:31:56Z"
}
}{
"message": "<string>"
}{
"error": "Invalid API key"
}Authorizations
An API key issued in the Backoffice, sent as Authorization: Bearer vzk_<key id>_<secret>.
A Microsoft Entra ID access token obtained with the client credentials
grant is accepted on the same header. The same value is also accepted in
an X-API-Key header.
Body
A 24-character hexadecimal id.
^[0-9a-fA-F]{24}$"5f2a1b9c4d3e2f0011223344"
Falls back to the location's default visit type.
^[0-9a-fA-F]{24}$"5f2a1b9c4d3e2f0011223344"
Prefixed with the visit type's default country code when it
does not start with +.
Name of the host. Match an existing host's cn and their
contact details are filled in automatically.
Links the visit to a registered visitor. Hidden fields stored on that record are carried over.
^[0-9a-fA-F]{24}$"5f2a1b9c4d3e2f0011223344"
A 24-character hexadecimal id.
^[0-9a-fA-F]{24}$"5f2a1b9c4d3e2f0011223344"
0 Backoffice or API, 1 kiosk, 2 contactless.
0, 1, 2 Backdates the sign-in. Defaults to now.
Language for the visitor's emails.

