> ## Documentation Index > Fetch the complete documentation index at: https://developers.vizito.eu/llms.txt > Use this file to discover all available pages before exploring further. # Signing in a visitor > Creates a visit, running the complete sign-in flow: the host is notified, the badge is printed if the visit type prints one, the confirmation email goes out, and every integration and webhook fires. Required fields and validation rules are enforced in the front office, not here — a visit created through the API with a required field missing is accepted as-is. There is no idempotency key yet: a retried request creates a second visit. ## OpenAPI ````yaml https://vizito.eu/openapi.yaml post /visitors openapi: 3.1.0 info: title: Vizito API version: 1.0.0 description: | Read and write your Vizito visitor data over HTTPS. Every endpoint takes and returns JSON, and is authenticated with an API key created by a global admin on the Integrations page of the Backoffice. Almost every endpoint names a **location** — `company_id` in the API. Your key is pinned to a set of locations; naming one outside that set is refused with `403`. Start at `GET /companiesList`, the one endpoint that needs no location id. contact: name: Vizito support email: support@vizito.eu url: https://vizito.eu termsOfService: https://vizito.eu/terms servers: - url: https://api.vizito.eu/api description: Production security: - apiKey: [] tags: - name: Locations description: The locations your credential covers, and their configuration. - name: Visitors description: The visits themselves — one visitor is one visit, not a person. - name: Registered visitors description: Expected visitors — pre-register, invite, and sign in on arrival. - name: Hosts description: The people who can be visited. - name: Visit types description: The sign-in flows, and the questions they ask. - name: Entry points description: The doors and desks within a location. - name: Agreements description: The documents visitors sign, and the signed PDFs that come out. - name: Devices description: The kiosks at a location. - name: Reporting description: Counters, graphs and exports. - name: Webhooks description: The endpoint Vizito calls when something happens. paths: /visitors: post: tags: - Visitors summary: Signing in a visitor description: > Creates a visit, running the complete sign-in flow: the host is notified, the badge is printed if the visit type prints one, the confirmation email goes out, and every integration and webhook fires. Required fields and validation rules are enforced in the front office, not here — a visit created through the API with a required field missing is accepted as-is. There is no idempotency key yet: a retried request creates a second visit. operationId: signInVisitor requestBody: required: true content: application/json: schema: type: object additionalProperties: true required: - company_id properties: company_id: $ref: '#/components/schemas/ObjectId' visit_type: allOf: - $ref: '#/components/schemas/ObjectId' description: Falls back to the location's default visit type. first_name: type: string last_name: type: string company: type: string email: type: string format: email phone: type: string description: | Prefixed with the visit type's default country code when it does not start with `+`. recipient: type: string description: | Name of the host. Match an existing host's `cn` and their contact details are filled in automatically. recipient_mail: type: string format: email known_visitor_id: allOf: - $ref: '#/components/schemas/ObjectId' description: > Links the visit to a registered visitor. Hidden fields stored on that record are carried over. entrypoint_id: $ref: '#/components/schemas/ObjectId' signed_in_source: type: string enum: - '0' - '1' - '2' default: '1' description: '`0` Backoffice or API, `1` kiosk, `2` contactless.' signed_in_frombo: type: string format: date-time description: Backdates the sign-in. Defaults to now. fo_language: type: string description: Language for the visitor's emails. examples: minimal: summary: A visitor at the default visit type value: company_id: 5f2a1b9c4d3e2f0011223344 first_name: Ada last_name: Lovelace company: Analytical Engines Ltd email: ada@example.com recipient: Jane Doe recipient_mail: jane.doe@example.com signed_in_source: '0' responses: '200': description: The visit that was created. content: application/json: schema: type: object properties: message: type: string example: Visitor added! data: $ref: '#/components/schemas/Visitor' '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Unauthorized' components: schemas: ObjectId: type: string pattern: ^[0-9a-fA-F]{24}$ description: A 24-character hexadecimal id. example: 5f2a1b9c4d3e2f0011223344 Visitor: type: object description: | One visit. Every custom field the visit type defines is also present, under its own `field_name`. additionalProperties: true properties: _id: $ref: '#/components/schemas/ObjectId' company_id: $ref: '#/components/schemas/ObjectId' first_name: type: string example: Ada last_name: type: string example: Lovelace company: type: string description: The organisation the visitor comes from. email: type: string format: email phone: type: string description: International format. recipient: type: string description: Name of the host being visited. recipient_mail: type: string format: email visit_type: $ref: '#/components/schemas/ObjectId' entrypoint_id: $ref: '#/components/schemas/ObjectId' known_visitor_id: $ref: '#/components/schemas/ObjectId' signed_in: type: string format: date-time signed_out: type: string format: date-time description: Absent while the visitor is still inside. signed_in_source: type: integer enum: - 0 - 1 - 2 description: '`0` Backoffice or API, `1` kiosk, `2` contactless.' signed_out_source: type: integer enum: - 0 - 1 - 2 approval: type: string enum: - pending - approved - rejected description: Present on visit types that screen visitors. safe: type: boolean description: Marked safe during an evacuation. agreements: type: array description: Ids of the agreements signed during this visit. items: $ref: '#/components/schemas/ObjectId' photo: type: string description: Base64-encoded image. Only on a single-visitor fetch. signature: type: string description: Base64-encoded image. Only on a single-visitor fetch. mod_date: type: string format: date-time Message: type: object properties: message: type: string responses: BadRequest: description: The request was understood but could not be carried out. content: application/json: schema: $ref: '#/components/schemas/Message' Unauthorized: description: | The credential was refused, or the endpoint is off limits to API keys. Every refusal answers identically — see the Authentication page. content: application/json: schema: type: object properties: error: type: string example: Invalid API key securitySchemes: apiKey: type: http scheme: bearer description: > An API key issued in the Backoffice, sent as `Authorization: Bearer vzk__`. A Microsoft Entra ID access token obtained with the client credentials grant is accepted on the same header. The same value is also accepted in an `X-API-Key` header. ```` ## Related topics - [Signing a visitor in and out](/documentation/signing-in-a-visitor.md) - [Signing out a visitor](/api-reference/visitors/signing-out-a-visitor.md) - [Signing in registered visitors](/api-reference/registered-visitors/signing-in-registered-visitors.md) - [Signing out several visitors](/api-reference/visitors/signing-out-several-visitors.md) - [Core concepts](/documentation/concepts.md)