# Vizito

> REST API documentation for Vizito visitor management: read and write visitors, registered visitors, hosts and configuration with an API key.

- [Welcome](https://developers.vizito.eu/index.md): Read and write your Vizito visitor data over HTTPS.
- [Introduction](https://developers.vizito.eu/api-reference/introduction.md): Base URL, conventions and everything that is true of every endpoint.
- [Authentication](https://developers.vizito.eu/api-reference/authentication.md): API keys, what they can reach, and how to keep them safe.
- [Core concepts](https://developers.vizito.eu/documentation/concepts.md): The handful of objects the whole API is built on.
- [Errors](https://developers.vizito.eu/api-reference/errors.md): What each status means, and what to do about it.
- [Webhooks](https://developers.vizito.eu/documentation/webhooks.md): Have Vizito call your endpoint the moment something happens.
- [Listing locations](https://developers.vizito.eu/api-reference/locations/listing-locations.md): Every location your credential covers. The one endpoint that needs no location id — start here, and keep the ids it hands back.
- [Fetching a location](https://developers.vizito.eu/api-reference/locations/fetching-a-location.md): The full configuration of one location: address, timezone, languages and the `app_settings` block that drives the kiosk.
- [Listing visitors](https://developers.vizito.eu/api-reference/visitors/listing-visitors.md): The visitor log — the same data the Backoffice grid shows. Photos and signatures are left out; fetch a single visitor for those.
- [Signing in a visitor](https://developers.vizito.eu/api-reference/visitors/signing-in-a-visitor.md): Creates a visit, running the complete sign-in flow: the host is notified, the badge is printed if the visit type prints one, the confirmation email goes out, and every integration and webhook fires.
- [Fetching a visitor](https://developers.vizito.eu/api-reference/visitors/fetching-a-visitor.md): One visit in full, including the `photo` and `signature` that the list endpoints leave out. Both are base64-encoded images.
- [Signing out a visitor](https://developers.vizito.eu/api-reference/visitors/signing-out-a-visitor.md): Closes a visit. The sign-out email and any sign-out notification go out exactly as they would from a kiosk.
- [Updating a visit](https://developers.vizito.eu/api-reference/visitors/updating-a-visit.md): Changes an existing visit — a corrected name, a filled-in badge number, a screening decision. Despite the `PUT` this is a partial update: fields you leave out keep their value.
- [Anonymising a visit](https://developers.vizito.eu/api-reference/visitors/anonymising-a-visit.md): Strips every personal detail from a visit, irreversibly. What remains is the shape of the visit — id, visit type, entry point, host, sign-in and sign-out times, and `erased: true`. The photo and signature are deleted outright and the first name becomes `Anonimized`.
- [Listing visitors inside](https://developers.vizito.eu/api-reference/visitors/listing-visitors-inside.md): Everyone signed in and not yet signed out, honouring the location's multi-day sign-out interval. This is the list an evacuation report should be built on.
- [Listing visitors inside, paged](https://developers.vizito.eu/api-reference/visitors/listing-visitors-inside-paged.md): The same list as `/visitors/signed_current/{company_id}`, paged and filterable.
- [Listing recent visits](https://developers.vizito.eu/api-reference/visitors/listing-recent-visits.md): The 30 most recently modified visits, newest first. A webhook tells you the same thing as it happens, and without the 30-row ceiling.
- [Signing out several visitors](https://developers.vizito.eu/api-reference/visitors/signing-out-several-visitors.md): Closes several visits at once. Answers per id, so a visit that was already closed is reported as `skipped` rather than failing the batch — which makes the call safe to repeat.
- [Reprinting a badge](https://developers.vizito.eu/api-reference/visitors/reprinting-a-badge.md): Sends the visit's badge to a kiosk printer. Vizito picks a kiosk serving the visit's entry point, preferring one that is online and has a printer configured; when none matches, any connected kiosk at the location is used. A `200` means the job reached the kiosk, not that paper came out.
- [Marking a visitor safe](https://developers.vizito.eu/api-reference/visitors/marking-a-visitor-safe.md): Sets the `safe` flag the emergency list reads.
- [Marking a visitor not safe](https://developers.vizito.eu/api-reference/visitors/marking-a-visitor-not-safe.md): Clears the `safe` flag the emergency list reads.
- [Creating a registered visitor](https://developers.vizito.eu/api-reference/registered-visitors/creating-a-registered-visitor.md): Creates a registered visitor: somebody you expect. When they arrive and sign in, a visit is created from this record and the record itself stays as it is.
- [Listing registered visitors](https://developers.vizito.eu/api-reference/registered-visitors/listing-registered-visitors.md): Every registered visitor at a location. Unlike the visitor log this endpoint also requires `sorting`; without it you get `400 Please include count, page and sorting query parameters.`
- [Listing expected visitors](https://developers.vizito.eu/api-reference/registered-visitors/listing-expected-visitors.md): Everyone expected at a location on one day — the list a kiosk offers when a visitor says they are expected. Records without a `visiting_on`, the persistent ones, are always included.
- [Fetching a registered visitor](https://developers.vizito.eu/api-reference/registered-visitors/fetching-a-registered-visitor.md): One registered visitor in full, including any photo and signature stored for prefilling their sign-in.
- [Updating a registered visitor](https://developers.vizito.eu/api-reference/registered-visitors/updating-a-registered-visitor.md): Only the fields you send are touched. Sending a field as an empty string removes it. `_id`, `create_date`, `mod_date` and `pre_registration_by_visitor` are ignored.
- [Deleting a registered visitor](https://developers.vizito.eu/api-reference/registered-visitors/deleting-a-registered-visitor.md): Removes a registered visitor — a cancelled meeting, a contractor who is no longer coming. Visits already created from the record are untouched.
- [Sending an invitation](https://developers.vizito.eu/api-reference/registered-visitors/sending-an-invitation.md): Sends the invitation email: the QR code that signs them in on arrival, the calendar item, the wallet pass and the pre-registration link — whichever the visit type is configured to include.
- [Sending invitations in bulk](https://developers.vizito.eu/api-reference/registered-visitors/sending-invitations-in-bulk.md): Sends the invitation to a list of registered visitors at once. Records without a usable email address are skipped rather than failing the call, and bulk invitations are rate-limited per location — check `queued` against `requested` rather than assuming a `200` means everybody was mailed.
- [Signing in registered visitors](https://developers.vizito.eu/api-reference/registered-visitors/signing-in-registered-visitors.md): Creates a visit from each registered visitor, exactly as scanning their QR code at the kiosk would. Somebody already inside is skipped, not signed in twice, so the call is safe to repeat.
- [Deleting registered visitors in bulk](https://developers.vizito.eu/api-reference/registered-visitors/deleting-registered-visitors-in-bulk.md): Removes several registered visitors at once. A `POST` because the ids travel in the body. A record whose visitor is currently signed in is skipped.
- [Fetching the current visit](https://developers.vizito.eu/api-reference/registered-visitors/fetching-the-current-visit.md): The open visit created from a registered visitor, or `null` when they are not inside. Useful for an access control system deciding whether to open a door.
- [Reprinting a badge for a registered visitor](https://developers.vizito.eu/api-reference/registered-visitors/reprinting-a-badge-for-a-registered-visitor.md): Prints the badge for a registered visitor without waiting for them to sign in — for reception preparing badges for a group in the morning.
- [Listing hosts](https://developers.vizito.eu/api-reference/hosts/listing-hosts.md): Every managed host at a location, sorted by name.
- [Listing hosts, paged](https://developers.vizito.eu/api-reference/hosts/listing-hosts-paged.md): The same list, paged and filterable.
- [Creating a host](https://developers.vizito.eu/api-reference/hosts/creating-a-host.md): Adds a managed host. There is no duplicate check on `cn` — if your directory is the source of truth, replace the whole list instead.
- [Fetching a host](https://developers.vizito.eu/api-reference/hosts/fetching-a-host.md): One managed host. A host that does not exist answers `200` with `{ "message": "no visitee found" }`, not a `404`.
- [Updating a host](https://developers.vizito.eu/api-reference/hosts/updating-a-host.md): Only the fields you send are touched; sending one as an empty string clears it. Renaming `cn` does not rewrite past visits: their `recipient` keeps the old spelling.
- [Deleting a host](https://developers.vizito.eu/api-reference/hosts/deleting-a-host.md): Removes a managed host. Visits that named them keep their `recipient`, so history is unaffected.
- [Replacing the host list](https://developers.vizito.eu/api-reference/hosts/replacing-the-host-list.md): Replaces the location's **external** host list with what you send. The previous external set is deleted first, so this is a full sync rather than a merge. An empty array clears the list.
- [Listing visit types](https://developers.vizito.eu/api-reference/visit-types/listing-visit-types.md): The sign-in flows a location offers — ids and names, in the order the kiosk shows them. Visit type ids never change: resolve them once at setup and store them rather than matching on the name.
- [Fetching a visit type](https://developers.vizito.eu/api-reference/visit-types/fetching-a-visit-type.md): The complete configuration of one visit type, including its `fields` array, its notification settings and its email templates.
- [Listing fields](https://developers.vizito.eu/api-reference/visit-types/listing-fields.md): Every question asked at a location, merged across its visit types. This is what tells you which keys a visitor or registered visitor accepts.
- [Listing entry points](https://developers.vizito.eu/api-reference/entry-points/listing-entry-points.md): The entrances within a location. Deleted entry points are included — check `deleted` if you only want the live ones.
- [Creating an entry point](https://developers.vizito.eu/api-reference/entry-points/creating-an-entry-point.md): Assigning a kiosk to an entry point is done on the device, in the Backoffice.
- [Fetching an entry point](https://developers.vizito.eu/api-reference/entry-points/fetching-an-entry-point.md): One entry point. Deleted ones are not returned — the body is `null`.
- [Updating an entry point](https://developers.vizito.eu/api-reference/entry-points/updating-an-entry-point.md): Visits point at the entry point by id, so a rename applies to history as well as to new visits.
- [Deleting an entry point](https://developers.vizito.eu/api-reference/entry-points/deleting-an-entry-point.md): Marks the entry point deleted. Visits that came through it keep their `entrypoint_id`, so reporting per entrance stays intact.
- [Listing agreements](https://developers.vizito.eu/api-reference/agreements/listing-agreements.md): The documents visitors sign, in presentation order. Deleted and archived agreements are left out.
- [Listing agreements of a visit type](https://developers.vizito.eu/api-reference/agreements/listing-agreements-of-a-visit-type.md): The active agreements a visitor of that visit type has to sign.
- [Fetching an agreement](https://developers.vizito.eu/api-reference/agreements/fetching-an-agreement.md): One agreement in full, including its text in every configured language.
- [Downloading a blank PDF](https://developers.vizito.eu/api-reference/agreements/downloading-a-blank-pdf.md): The agreement as a PDF with no visitor data in it — the version to send in advance.
- [Downloading a signed PDF](https://developers.vizito.eu/api-reference/agreements/downloading-a-signed-pdf.md): The same document rendered with one visit's details and the visitor's signature in it — the copy you archive.
- [Listing devices](https://developers.vizito.eu/api-reference/devices/listing-devices.md): Every kiosk registered at the location. Rather than polling this on a timer, subscribe to the `device_online` and `device_offline` webhook events — they arrive the moment the state changes.
- [Fetching a device](https://developers.vizito.eu/api-reference/devices/fetching-a-device.md): One kiosk. Adding, renaming, moving and removing kiosks is Backoffice work — a mistake takes a tablet out of service at an entrance.
- [Listing visit types of a device](https://developers.vizito.eu/api-reference/devices/listing-visit-types-of-a-device.md): The visit types this kiosk shows, which can be a subset of the location's. A kiosk with no explicit selection returns the full list.
- [Fetching statistics](https://developers.vizito.eu/api-reference/reporting/fetching-statistics.md): The five numbers behind the Backoffice dashboard, counted server-side. One call instead of four — prefer it over the individual counters.
- [Counting visitors signed in](https://developers.vizito.eu/api-reference/reporting/counting-visitors-signed-in.md)
- [Counting visitors inside](https://developers.vizito.eu/api-reference/reporting/counting-visitors-inside.md)
- [Counting visitors signed out](https://developers.vizito.eu/api-reference/reporting/counting-visitors-signed-out.md)
- [Counting visitors that month](https://developers.vizito.eu/api-reference/reporting/counting-visitors-that-month.md)
- [Fetching visits per day](https://developers.vizito.eu/api-reference/reporting/fetching-visits-per-day.md): Visit counts for the last ten days, one entry per day, oldest first. Days with no visits are included with `count: 0`. The window is fixed: for any other range, page through the visitor log with a date filter.
- [Fetching the dashboard](https://developers.vizito.eu/api-reference/reporting/fetching-the-dashboard.md): The ten-day graph and the 30 most recently changed visits together.
- [Exporting the visitor log](https://developers.vizito.eu/api-reference/reporting/exporting-the-visitor-log.md): The visitor log as an XLSX file, with the same columns and translated headers as the Backoffice export.
- [Fetching the webhook](https://developers.vizito.eu/api-reference/webhooks/fetching-the-webhook.md): The webhook configured for the location — one per location.
- [Configuring the webhook](https://developers.vizito.eu/api-reference/webhooks/configuring-the-webhook.md): Creates the webhook or replaces the existing one. Saving also clears the consecutive-failure counter, so this is how you re-enable a webhook that was switched off.
- [Pre-registering visitors](https://developers.vizito.eu/documentation/pre-registering-visitors.md): Announce a visitor from your own system and send them an invitation with a QR code.
- [Signing a visitor in and out](https://developers.vizito.eu/documentation/signing-in-a-visitor.md): Create a visit from your own system, custom fields included.
- [Keeping hosts in sync](https://developers.vizito.eu/documentation/syncing-hosts.md): Push the people who can be visited straight from your directory.

## OpenAPI Specs

- [openapi](https://vizito.eu/openapi.yaml)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.