Quickstart

1. Create an API key

API keys are managed in the Backoffice by a global admin.

Open the Integrations page

Go to backoffice.vizito.be → Integrations and open the API keys section.

Create the key

Give it a name that says which integration it is for, tick the locations it may reach, and optionally set an expiry date and a list of IP addresses it may be used from.

Copy the key

The key is shown once. Store it in your secret manager right away — Vizito only keeps a hash of it and cannot show it again.

A key looks like vzk_1a2b3c4d5e6f7890_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Treat it like a password: it is a global admin on the locations you picked.

More detail — expiry, IP restrictions, Microsoft Entra ID — in Authentication.

2. Check that it works

curl https://api.vizito.eu/api/companiesList \
  -H "Authorization: Bearer $VIZITO_API_KEY"

Response

[
  {
    "_id": "5f2a1b9c4d3e2f0011223344",
    "name": "Head office",
    "location_code": "HQ",
    "tier": "Enterprise",
    "mod_date": "2026-08-01T09:12:44.000Z"
  }
]

This is the one endpoint that needs no location id, and it tells you exactly which locations your key covers. Keep the _id — it is the company_id every other endpoint asks for.

Nothing came back? An empty array means the key is valid but attached to no location you can see. A 403 Invalid API key means the credential itself was refused — see Errors.

3. Read today’s visitors

curl -G https://api.vizito.eu/api/visitors/bycompany/5f2a1b9c4d3e2f0011223344 \
  -H "Authorization: Bearer $VIZITO_API_KEY" \
  -d count=25 \
  -d page=1 \
  --data-urlencode "sorting[signed_in]=desc"

Response

{
  "total": 128,
  "visitors": [
    {
      "_id": "66b0f1a2c3d4e5f600112233",
      "first_name": "Ada",
      "last_name": "Lovelace",
      "company": "Analytical Engines Ltd",
      "email": "ada@example.com",
      "recipient": "Jane Doe",
      "visit_type": "5f2a1b9c4d3e2f0011223399",
      "signed_in": "2026-08-29T07:58:11.000Z",
      "signed_in_source": 1
    }
  ]
}

count and page are required on this endpoint. Pass count=25&page=1 if you just want the most recent page.

4. Sign someone in

curl -X POST https://api.vizito.eu/api/visitors \
  -H "Authorization: Bearer $VIZITO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "company_id": "5f2a1b9c4d3e2f0011223344",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "company": "Analytical Engines Ltd",
    "email": "ada@example.com",
    "recipient": "Jane Doe",
    "recipient_mail": "jane.doe@example.com"
  }'

The visit is created exactly as if it happened on a kiosk: the host is notified, the badge is printed if the visit type prints one, and the sign-in email goes out.

Where to go next

Core concepts

What a visit type is, and why almost everything hangs off a location.

Sign in a visitor

The full sign-in flow, custom fields included.

Pre-register visitors

Create the visit up front and send the invitation.

API reference

Every endpoint in detail.

Get started

Guides

1. Create an API key

2. Check that it works

3. Read today’s visitors

4. Sign someone in

Where to go next

Core concepts

Sign in a visitor

Pre-register visitors

API reference

​1. Create an API key

​2. Check that it works

​3. Read today’s visitors

​4. Sign someone in

​Where to go next

Core concepts

Sign in a visitor

Pre-register visitors

API reference

1. Create an API key

2. Check that it works

3. Read today’s visitors

4. Sign someone in

Where to go next