URPASS is a modern digital event pass, ticketing, conference scheduling, and verification platform designed for organizers, colleges, tech conferences, and enterprise teams.

Do attendees need to download an app to access their pass or check in?

No app is required. Attendees receive a responsive web pass that opens on any device, with optional Apple Wallet (.pkpass) export. Organizers and staff can scan QR passes using any phone browser at urpass.space/scan.

How does the Multi-Track Conference Engine detect schedule conflicts?

The engine automatically cross-checks speaker allocations and room bookings across all concurrent tracks in real-time. If a speaker is double-booked across parallel sessions or room capacity limits are exceeded, organizers receive instant visual collision warnings.

How does physical event badge printing and zone headcount tracking work?

URPASS Physical Ops features an onsite reception desk for rapid search and check-in, real-time zone occupancy tracking, staff roaming device pairing with 6-digit PINs, and a badge print engine supporting ESC/POS, Zebra, and Brother thermal printers alongside CR80 lanyard badges.

How does Exhibitor Lead Retrieval and B2B Matchmaking work?

Exhibitor booth reps scan attendee badge QR codes to instantly capture qualified leads with real company and designation data, 1-5 star ratings, and follow-up notes. Attendees and exhibitors can also schedule 1:1 B2B matchmaking meetings with automated time slot conflict checks.

How do zero-commission split payouts and GST invoicing work?

URPASS charges 0% per-ticket platform commission. Organizers can configure Route Split Payouts to automatically distribute percentage shares to co-organizers or partners on direct T+2 settlement cycles with automated 18% GST tax invoices.

Does URPASS support virtual and hybrid events?

Yes. URPASS natively supports in-person, online, and hybrid formats. For online and hybrid events, approved attendees can access verified direct-join redirects (/api/join/[passToken]) to Zoom, Google Meet, Microsoft Teams, or custom links.

How does multi-gate check-in and zone access control work?

Organizers can define multiple scanner gates (e.g., Gate A, VIP Entrance, Backstage) and zones. Passes can be restricted so that specific ticket tiers are only admitted at authorized gates.

Are ticket prices stored in rupees or paise in the API?

In accordance with standard Indian payment gateways like Razorpay, all financial amounts in the database and API are denominated in paise (1 INR = 100 paise). For instance, ₹499 is represented as 49900.

How do outbound webhooks work?

Organizers on Pro and Business plans can register HTTPS endpoints in Dashboard → Developer → Webhooks. UrPass signs each webhook using HMAC-SHA256 with your endpoint secret and sends the signature in the X-UrPass-Signature header.

What team roles are supported in Organizations?

URPASS provides role-based access control with 5 distinct roles: Owner, Admin, Event Manager, Check-in Staff, and Viewer.

Production platform · Indian Rupee (₹) · REST API v1 · Outbound Webhooks

URPASS Documentation

Everything you need to create events, issue tiered digital passes, run high-speed multi-gate QR check-ins, and integrate with the URPASS developer platform.

Create free account Explore REST API

Getting started

Platform overview and end-to-end event workflow

What is URPASS?

URPASS is a modern digital pass and check-in platform engineered for conferences, college festivals, exhibitions, corporate summits, and community events. It eliminates cumbersome physical badges, costly dedicated scanner hardware, and proprietary mobile app downloads. Both organizers and attendees interact through responsive, secure web links.

5-Step Quickstart

Create an Organizer Account

Register at urpass.space/signup. Free plans include active event hosting and attendee pass generation with zero setup fees.

Configure Your Event

Click New Event. Choose your event format (In-person, Online, or Hybrid), set dates, capacity, registration options, and optional ticketing tiers.

Collect Registrations or Import Attendees

Share your public application link (/apply/your-event) with custom form fields, or bulk-import existing guest lists via CSV.

Issue Digital Passes

Approved attendees instantly receive an email containing their digital pass link and QR code, with direct Apple Wallet (.pkpass) export.

Run Check-In at the Entrance

Open urpass.space/scan on any smartphone camera. The system verifies passes with sub-second latency, enforces gate-zone permissions, and rejects duplicate entries.

Events & formats

In-person, virtual meetings, hybrid setups, and lifecycles

In-Person

Physical venue with entrance scanning, multi-gate check-in, and zone-based badge validation.

Online (Virtual)

Connect Zoom, Google Meet, Microsoft Teams, or custom links. Approved attendees join with a secure one-click pass link.

Hybrid

Simultaneous physical venue access for local attendees and automated meeting room redirects for remote participants.

Event status lifecycles

Draft

Event configuration is private. The public registration page is hidden and closed.

Active

Registration form is live. Attendees can register, purchase tickets, and passes are active.

Completed

The event has concluded. Registration is locked, while analytics and export archives remain accessible.

Cancelled

The event was called off. Passes are voided and scanning endpoints will reject entries.

Custom registration form fields

Every event can define custom registration fields to collect extra participant information (e.g., College Name, T-shirt size, Dietary preferences, GitHub profile, Roll number). Supported field types include text, number, dropdown select, and checkbox.

Plan Quotas: Free plans support up to 3 custom fields, Starter supports 10, and Pro / Business plans allow unlimited custom registration fields.

Multi-track program & schedule

Timeline builder, speaker directory, real-time conflict detection, and calendar sync

Conference & summit agenda engine

For complex multi-stage summits, hackathons, and academic symposiums, URPASS provides an integrated multi-track program engine. Organizers can configure multiple parallel tracks (e.g., “Main Stage”, “Track A — AI & Cloud”, “Hands-on Workshop Lab”), schedule sessions across multiple days, and publish an interactive live agenda.

Concurrent Tracks

Run parallel stages with custom colors and room allocations.

Conflict Guard

Detects speaker double-bookings and room time collisions automatically.

iCal (.ics) Export

Attendees download and sync sessions to Google Calendar and Apple iCal.

Real-time schedule conflict detection

As organizers drag, edit, or adjust session timings, URPASS runs automated background collision validation:

Speaker Collision Warning: When a speaker is assigned to two concurrent sessions overlapping in time, the timeline card displays a high-visibility warning badge and lists the colliding track and session.

Room & Venue Overlap: Prevents scheduling two distinct talks in the same physical room or hall during overlapping hours.

Capacity Threshold Alerts: Warns when expected session RSVPs exceed room seating capacity so organizers can reassign to larger halls.

Speaker Directory & Bios

Manage headshots, company titles, biographies, social links, and automatically provision VIP Speaker passes for all registered presenters.

Interactive Public Schedule

Public agenda page (/events/[slug]/program) with instant keyword search, track filter buttons, and difficulty level badges (Beginner, Intermediate, Advanced).

Calendar Subscriptions

One-click subscription links generate RFC 5545 compliant iCalendar (.ics) files with venue geolocation and session descriptions.

Attendees & import

Attendee lifecycle, approval pipelines, and bulk CSV operations

Manual Attendee Addition

Add individual VIPs, speakers, or staff members directly from the event dashboard with instantaneous pass generation.

CSV Bulk Import

Starter+

Upload a CSV with name, email, phone, and pass_type to import hundreds of attendees in seconds. Duplicate emails are automatically de-duplicated.

CSV Data Export

Starter+

Export full attendee records with registration status, pass token, ticket tier, check-in timestamp, and custom form responses.

Approval Workflow & Auto-Approve

Toggle auto-approve to immediately issue passes upon registration, or retain manual approval mode to review applications before passes are distributed.

Standard CSV Import Format

attendees.csv

name,email,phone,pass_type
Aarav Patel,aarav@example.com,+919876543210,participant
Meera Nair,meera@example.com,+919876543211,vip
Vikram Singh,vikram@example.com,+919876543212,speaker

Accepted pass types: participant, vip, speaker, and organizer.

Tickets & passes

Tiered ticketing, dynamic QR tokens, Apple Wallet, and online redirects

Multi-tier ticketing

Events can offer multiple ticket tiers (e.g. Early Bird, General Admission, VIP Pass, Student Pass). Each tier configures its own pricing, quota limit, sale window, and assigned zone access.

Currency & Paise Denomination: In the URPASS database and API, all monetary values are stored in paise (1 INR = 100 paise). For example, a ticket priced at ₹499 is represented in API responses and orders as 49900.

Pass features

Dynamic QR Code

Secure, tamper-evident pass token rendered on high-contrast retina canvas.

Apple Wallet (.pkpass)

Attendees on iOS can tap 'Add to Apple Wallet' for quick access from the lock screen.

Live Check-in Status

Pass display updates live from 'Approved' to 'Checked In' with entry timestamp.

Color-Coded Badges

Distinct visual colors for Participant (Purple), VIP (Gold), Speaker (Blue), and Organizer (Green).

White-Label / Custom Branding

Pro and Business tiers remove 'Powered by URPASS' watermarks for a pure brand experience.

Virtual Join Link

For online events, an integrated verified join button safely redirects to Zoom/Meet.

Online event verified join redirect

GET /api/join/[passToken]

Instead of sharing open Zoom/Meet links on social media (which leads to uninvited attendees), URPASS provides a verified redirect endpoint. When an approved attendee opens the link:

1.The server validates the passToken and verifies that the attendee's application status is approved.
2.The server inspects the event's configured meeting platform (Zoom, Google Meet, Teams, or Custom).
3.If verified, the browser is issued a 307 temporary redirect to the live meeting session.

Verified Join URL Pattern

https://urpass.space/api/join/urp_pass_a8f9b2c3d4e5...

Gates & check-in

Multi-gate routing, zone access control, and duplicate prevention

High-speed web scanner

Check-in staff can navigate to urpass.space/scan on any smartphone. No native app installation or permissions other than camera access are needed.

Zero Hardware

Works directly in Safari, Chrome, and Firefox.

Concurrency Safe

Database constraints reject duplicate concurrent scans.

Sub-second Latency

Fast edge verification with immediate visual feedback.

Multi-gate & zone access control

For large venues, organizers can define custom gates (e.g., “North Gate”, “Main Arena Entrance”, “VIP Lounge”) and link them to specific access zones.

How Zone Validation Works:

When a gate is assigned a zone, the check-in engine queries ticket_zone_access. If the attendee's ticket tier does not possess access permissions for that zone, entry is immediately denied with a clear warning: “This pass is not authorized for this gate / zone.”

Check-in verification endpoint

POST/api/verify

Scanners and custom gate hardware submit scanned tokens to this endpoint. The endpoint accepts both the raw token string or a full pass URL (e.g. https://urpass.space/pass/urp_pass_...).

bash

curl -X POST https://urpass.space/api/verify \
  -H "Content-Type: application/json" \
  -H "Cookie: sb-access-token=..." \
  -d '{
    "passToken": "urp_pass_9c4e82b71f...",
    "eventId": "3c84be2e-4b2a-4819-a9a3-5c5f49e19d77",
    "gateId": "7d91e602-0e83-4a11-b0ec-1c8821901a12",
    "checkInMethod": "qr"
  }'

Success Response (200 OK)

json

{
  "success": true,
  "attendee": {
    "name": "Kavitha Sundaram",
    "email": "kavitha@example.com",
    "pass_type": "vip"
  },
  "passType": "vip"
}

Physical operations & badges

Onsite desk check-in, real-time zone headcounts, badge printing, and roaming device pairing

Onsite reception & desk management

For large-scale physical summits and expos, URPASS Physical Ops provides reception staff with an optimized, keyboard-first terminal to search attendees, process walk-in registrations, print physical badges, and monitor zone headcounts.

Rapid Search Desk

Instant lookup by name, email, phone, or reference code with 1-click check-in.

Zone Headcount Telemetry

Live active occupancy tracking across VIP lounges, workshop rooms, and main halls.

Device PIN Pairing

Pair volunteer phones with 6-digit PINs without sharing master organizer passwords.

High-speed badge print queue

ESC/POS · Zebra · Brother · Standard CR80

When attendees check in at reception, URPASS automatically dispatches badge print jobs to connected network thermal printers or desktop queues. Print templates support high-contrast QR tokens, attendee company/designation, and tier-specific color coding.

Thermal Label Printers

Direct ESC/POS and ZPL network drivers for Zebra ZD420/ZD620 and Brother QL-820NWB thermal rolls.

Standard CR80 & Lanyards

High-resolution PDF layouts formatted for standard 440×640 px conference lanyard card stock.

Exhibitors & sponsors hub

Tier deliverable tracking, booth floor plans, team pass provisioning, lead retrieval, and B2B meetings

Sponsorship Tier & Deliverables Matrix

Configure custom packages (Title, Platinum, Gold, Silver) and track contract milestones (Logo on Pass, Keynote Talk, Social Mentions, Booth Space) with proof file approvals.

Interactive Booth Floor Plan

Interactive trade show floor plan map with booth dimensions, power/Wi-Fi amenities, status tracking (Available, Reserved, Occupied), and 1-click exhibitor assignment.

Exhibitor Team Pass Provisioning

Exhibitors receive a branded portal to manage their company profile, assign representative staff passes, and coordinate booth operations.

Real-Time Lead Capture & Qualification

Booth reps scan visitor badge QR codes to immediately capture attendee name, verified email, organization, designation, 1–5 star rating, and custom follow-up notes with instant CSV export.

1:1 B2B Matchmaking Meetings

Attendees and exhibitors can request and schedule dedicated networking sessions in designated meeting rooms with automated conflict checks.

How real-time lead capture works

Every attendee badge QR contains a signed pass token. When scanned via the Exhibitor Portal lead scanner:

1. Token Resolution

Extracts verified attendee details directly from the core database without mock placeholders.

2. Dynamic Form Mapping

Maps custom registration form responses to extract Company and Designation metadata.

3. Live Qualification

Add lead scores (1-5 stars), conversation notes, and export clean CSV lead lists instantly.

Finance & split payouts

Zero platform commissions, multi-stakeholder split settlements, and GST tax compliance

0% Platform commission ticketing

Unlike traditional ticketing aggregators that deduct 3% to 10% per ticket, URPASS operates on a strict 0% ticket commission model. 100% of ticket revenues flow directly to the event organizer, settling on standard T+2 business day cycles.

Route Split Payouts

Automatically divide incoming ticket proceeds among co-organizers, university departments, or commercial partners by percentage shares.

GST Tax Compliance & Invoices

Every ticket purchase automatically generates a compliant GST invoice with 18% tax breakdown, SAC/HSN codes, and B2B GSTIN recording for input tax credits.

Organizations & roles

Multi-tenant teams and granular role-based permissions

Organizations allow companies, student societies, and event agencies to collaborate seamlessly. Invite colleagues via email, manage memberships, and assign role-based permissions tailored to each staff member's duties.

Role	Manage Org & Billing	Create / Edit Events	Approve Attendees	Scan Passes at Gates	View Analytics
Owner
Admin
Event Manager
Check-in Staff
Viewer

Enterprise SSO, SCIM 2.0 & Security Compliance

Enterprise Tier

Identity Provider federation, automated directory provisioning, IP allowlisting, custom domains, and SIEM auditing

1. SAML 2.0 & OpenID Connect (OIDC) Single Sign-On

URPASS supports federated identity with all major enterprise Identity Providers (IdPs) including Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, and JumpCloud. Both SP-Initiated and IdP-Initiated SSO are supported with X.509 certificate validation and SHA-256 signatures.

Service Provider Entity IDhttps://urpass.space/api/auth/sso/saml/metadata/{orgId}

Assertion Consumer Service (ACS) URLhttps://urpass.space/api/auth/sso/saml/acs/{orgId}

Security Provisions:

Just-In-Time (JIT) Provisioning: New employees or students are automatically provisioned with configurable default roles upon first successful login.
Emergency Owner Bypass: Prevents accidental enterprise lockout if IdP X.509 certificates expire or external identity servers suffer downtime.
Domain Ownership Verification: DNS TXT record validation ensures only verified corporate domains can be routed to your SSO connection.

2. Automated Directory Sync & Deprovisioning (SCIM 2.0)

URPASS implements an RFC 7643 and RFC 7644 compliant SCIM 2.0 server. Whenever an employee is onboarded or departs your company, Okta or Entra ID automatically updates URPASS in real time. Deactivated users immediately have all active browser and scanner check-in sessions revoked.

SCIM 2.0 Connector Base URLBearer Token Auth

https://urpass.space/api/scim/v2/{orgId}

Method	Endpoint	Purpose
GET	/ServiceProviderConfig	SCIM 2.0 capability discovery
GET	/Schemas	Core User resource schema
GET	/Users?filter=userName eq "..."	Search directory members by email
POST	/Users	Provision new organization member
PATCH	/Users/{userId}	Instant deactivation (active: false) & session purge

Example: Okta Deprovisioning Request (RFC 7644)

Okta Deprovisioning Request (RFC 7644)

PATCH /api/scim/v2/org-12345/Users/mem-98765 HTTP/1.1
Host: urpass.space
Authorization: Bearer scim_live_8f3a9e1b2c4d...
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}

3. IP / CIDR Network Allowlisting

Lock down admin panels, event configuration, attendee lists, and check-in scanner gateways strictly to authorized corporate VPN networks or campus subnets. Supports both IPv4 and IPv6 notation with custom subnet masks.

Single Dedicated IP

203.0.113.50/32

Corporate Subnet

198.51.100.0/24

IPv6 Network Range

2001:db8::/32

When IP allowlisting is enforced, non-whitelisted requests receive an immediate HTTP 403 Forbidden with security audit logging.

4. Branded Custom CNAME Domains

Deliver a fully white-labeled ticketing and check-in experience under your corporate or university subdomain (e.g., events.acmecorp.com or fest.university.edu).

DNS Configuration Setup:

DNS Record Type / HostCNAME / events

Target Valuecname.urpass.in

Edge routing automatically provisions and renews TLS/SSL certificates with zero downtime.

5. SIEM Audit Streaming & GDPR Retention Schedules

All administrative actions, authentication attempts, door scan results, and configuration changes are recorded in an immutable, tamper-evident audit log.

Splunk CIM & Datadog JSON

Exports audit events aligned with the Common Information Model (CIM) with ISO 8601 timestamps, actor metadata, and IP provenance.

GDPR Article 17 Data Retention

Automate attendee PII anonymization after 30, 90, 180, or 365 days post-event to maintain strict compliance with data minimization mandates.

REST API reference

Pro & Business

Programmatic access for events, attendees, and custom check-in gates

The URPASS REST API follows standard REST principles. All responses return JSON payloads with consistent top-level data and meta pagination envelopes.

BASE URLhttps://urpass.space/api/v1

API key authentication

Authenticate all API requests by supplying your API key in the Authorization header as a Bearer token. Generate keys from Dashboard → Developer → API Keys.

• Production keys start with prefix: urp_live_

• Sandbox test keys start with prefix: urp_test_

bash

curl -X GET https://urpass.space/api/v1/events \
  -H "Authorization: Bearer urp_live_9a7b5c3d2e1f40..."

GET/events

List events

Returns a paginated list of events owned by the authenticated organizer.

Query Parameters

statusstringFilter by status: draft, active, completed, cancelled

limitnumberMax records to return (default 50, maximum 100)

offsetnumberPagination offset index (default 0)

Example Response

json

{
  "data": [
    {
      "id": "e4210d65-3d84-4828-b997-c25f48719230",
      "name": "DevCon India 2026",
      "description": "Annual national developer conference",
      "event_date": "2026-11-20",
      "start_time": "09:30:00",
      "end_time": "18:00:00",
      "venue": "Bengaluru International Exhibition Centre",
      "status": "active",
      "is_paid_event": true,
      "ticket_price": 79900,
      "attendee_limit": 1000,
      "application_enabled": true,
      "apply_slug": "devcon-india-2026",
      "created_at": "2026-09-01T10:15:30.000Z"
    }
  ],
  "meta": {
    "total": 1,
    "limit": 50,
    "offset": 0
  }
}

GET/events/:eventId

Get event details

Retrieve complete metadata for an individual event by its UUID identifier.

bash

curl -X GET https://urpass.space/api/v1/events/e4210d65-3d84-4828-b997-c25f48719230 \
  -H "Authorization: Bearer urp_live_..."

GET/events/:eventId/attendees

List attendees

Retrieve all registered attendees for the specified event, with optional status filtering.

Query Parameters

application_statusstringpending, approved, rejected

pass_statusstringnot_generated, generated, checked_in

limitnumberMax records to return (default 100, maximum 500)

Example Response

json

{
  "data": [
    {
      "id": "7bf31890-1c5e-49b2-9d33-149b1049c402",
      "name": "Ananya Roy",
      "email": "ananya@example.com",
      "phone": "+919123456780",
      "pass_type": "vip",
      "application_status": "approved",
      "pass_status": "checked_in",
      "created_at": "2026-09-12T11:42:00.000Z"
    }
  ],
  "meta": {
    "total": 340,
    "limit": 100,
    "offset": 0
  }
}

Standard HTTP error codes

400Bad RequestMissing or invalid payload parameters or malformed UUID.

401UnauthorizedMissing, invalid, or expired Bearer API token.

403ForbiddenAPI key revoked, or subscription tier does not include developer access.

404Not FoundThe requested event or attendee record does not exist or is not owned by your account.

422Unprocessable EntityAttendee is not in 'approved' status for pass operations.

429Too Many RequestsRate limit exceeded (standard limit is 120 req/minute). Back off and retry.

500Internal Server ErrorUnexpected server error. Check URPASS status or reach out to support.

Webhooks integration

Pro & Business

Real-time outbound event notifications delivered to your servers

URPASS outbound webhooks notify your server in real time when attendees register, complete payments, or scan their passes at venue gates. Configure webhook endpoints from Dashboard → Developer → Webhooks.

HTTPS Required

Webhook endpoints must be served over valid TLS/HTTPS.

Delivery Logs & Retries

Review request headers, response status, and delivery history in your dashboard.

Supported event triggers

registration.createdFired when a new attendee submits a registration form or buys a ticket.

checkin.completedFired when an attendee pass is scanned and successfully verified at any entrance gate.

payment.successFired when ticket checkout or attendee order payment is verified via Razorpay.

pass.issuedFired when a digital pass QR token is generated and prepared for the attendee.

registration.approvedFired when an organizer approves an attendee application.

registration.rejectedFired when an organizer rejects or revokes an attendee application.

HMAC-SHA256 signature verification

Every webhook request sent from URPASS includes an X-UrPass-Signature header in the format sha256=<hash> and an X-UrPass-Event header. Compute the HMAC-SHA256 hash of the raw request payload using your webhook endpoint secret and compare it using a constant-time check.

typescript

import crypto from "crypto";

export async function POST(req: Request) {
  const signature = req.headers.get("x-urpass-signature");
  const eventType = req.headers.get("x-urpass-event");
  const rawBody = await req.text();

  const secret = process.env.URPASS_WEBHOOK_SECRET!;
  const expectedSig = `sha256=${crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex")}`;

  const isValid =
    signature &&
    signature.length === expectedSig.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig));

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  console.log(`Received event ${eventType}:`, payload.data);

  return new Response("OK", { status: 200 });
}

Example webhook payloads

Check-in Completed (checkin.completed)

json

{
  "event_type": "checkin.completed",
  "timestamp": "2026-09-20T11:45:00.000Z",
  "data": {
    "attendee_id": "7bf31890-1c5e-49b2-9d33-149b1049c402",
    "event_id": "e4210d65-3d84-4828-b997-c25f48719230",
    "name": "Ananya Roy",
    "email": "ananya@example.com",
    "pass_type": "vip",
    "checked_in_at": "2026-09-20T11:45:00.000Z"
  }
}

Payment Success (payment.success)

json

{
  "event_type": "payment.success",
  "timestamp": "2026-09-20T10:30:12.000Z",
  "data": {
    "order_id": "order_NXv0b8A1C9dE3f",
    "event_id": "e4210d65-3d84-4828-b997-c25f48719230",
    "amount": 79900,
    "currency": "INR",
    "buyer_name": "Devansh Gupta",
    "buyer_email": "devansh@example.com"
  }
}

Model Context Protocol (MCP)

AI Agents & Tools

Operate events, issue passes, and manage check-ins via Claude Desktop, Cursor, and autonomous agents

The Model Context Protocol (MCP) is an open standard that enables Large Language Models (Claude, Cursor, Antigravity) to safely interact with external systems. URPASS provides an official MCP server exposing 10 production tools for querying events, issuing cryptographic passes, screening applicants, and executing gate check-ins.

Local Stdio Runner

npx urpass-mcp

Remote JSON-RPC 2.0

POST /api/mcp

Auth Requirement

Active Bearer API Key from Developer Settings

Client configuration guide

json

// ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)
// %APPDATA%\Claude\claude_desktop_config.json (Windows)
{
  "mcpServers": {
    "urpass": {
      "command": "npx",
      "args": ["-y", "urpass-mcp"],
      "env": {
        "URPASS_API_KEY": "urpass_live_your_api_key_here"
      }
    }
  }
}

Supported MCP Tools (10 Production Endpoints)

v1.0.0

list_events{ status?: string }List all organizer events with registration counts, date, and venue details.

get_event{ event_id: string }Retrieve full event record, ticket tier configuration, and capacity parameters.

get_event_stats{ event_id: string }Compute live check-in percentage, total checked-in, pending count, and velocity.

list_attendees{ event_id: string, status?: string, query?: string }Search and paginate event attendees by name, email, or registration status.

get_attendee{ attendee_id: string }Fetch full attendee profile, custom form answers, tier, and pass redemption status.

approve_attendee{ attendee_id: string, notes?: string }Approve a pending registration and automatically issue dynamic QR ticket.

reject_attendee{ attendee_id: string, reason?: string }Reject or revoke an attendee registration application with audit logging.

verify_pass{ pass_token: string, gate_name?: string }Non-destructive pass validation: inspects validity, tier, and name without redeeming.

check_in_attendee{ pass_token: string, gate_name?: string }Atomic gate redemption: verifies token, marks checked-in, and guards against duplicate scans.

issue_pass{ event_id: string, name: string, email: string, tier_id?: string }Directly create an approved attendee and issue a cryptographically signed pass.

Example prompts you can ask Claude Desktop or Cursor

“Summarize check-in progress”

“Show me how many attendees checked in for today's tech summit and give me the breakdown across VIP vs General tiers.”

“Approve pending hackathon teams”

“Fetch pending applicants for HackNight 2026 and approve all candidates who provided a valid GitHub URL.”

“Search and check in VIP guest”

“Find attendee Priya Patel and mark her pass checked in at VIP Entrance Lounge.”

“Issue emergency speaker pass”

“Issue a VIP Speaker pass to aris@example.com for the AI Conference and send me the pass link.”

Plans & billing

Transparent Indian Rupee pricing, quota limits, and tax invoices

Free

₹0forever

2 events / month
100 registrations / month
1 organizer seat
3 custom form fields
Responsive digital passes
Mobile web scanner
URPASS branding

Start free

Starter

₹499/month

10 events / month
500 registrations / month
2 organizer seats
10 custom form fields
CSV bulk import & export
Standard analytics
Paid ticket support

Choose Starter

Pro

Popular

₹999/month

Unlimited events
2,500 registrations / month
5 organizer seats
Unlimited custom fields
Remove URPASS branding
Full REST API access
Outbound Webhooks
Priority email support

Choose Pro

Billing & Tax Compliance

• Secure payments processed via Razorpay supporting UPI, Cards, NetBanking, and Corporate Cards.
• Subscription invoices include 18% GST with your organization's GSTIN and state tax breakdown.
• Download PDF tax invoices anytime from Dashboard → Billing → Invoices.
• Upgrades, downgrades, and cancellations are managed directly from the billing portal.

Frequently asked questions

Common questions from organizers, developers, and college teams

Do attendees need to install an app to present their QR pass?

No. The attendee pass is rendered as a lightweight, responsive web pass accessible on any smartphone browser. On iOS devices, attendees can also add the pass directly to Apple Wallet.

Can multiple check-in staff scan at different gates simultaneously?

Yes. Multiple staff members can scan at the same time using their own mobile phones. All check-in attempts are validated atomically against the central database to guarantee zero duplicate admissions.

How are ticket prices handled in the API and payment checkout?

All ticket prices and order amounts in URPASS are denominated in paise (1 INR = 100 paise), matching standard Indian payment systems. For example, a ₹499 ticket is passed as 49900 in the API.

What happens if a scanned attendee tries to enter a restricted zone or wrong gate?

If the gate is configured with an assigned zone and the attendee's ticket tier does not have zone access privileges in ticket_zone_access, the scanner immediately displays an 'Access Denied' alert.

How do virtual / online event passes work?

When you configure an event as 'Online' or 'Hybrid' with a meeting link (Zoom, Google Meet, Teams, or Custom), the attendee's digital pass includes a verified join button that resolves via /api/join/[passToken]. Only approved attendees can access the redirect.

Can I remove the URPASS watermark and branding from passes?

Yes. Pro and Business tier plans provide white-label passes with all URPASS branding and footers removed.

How secure is attendee data?

URPASS is built on Supabase PostgreSQL with rigorous Row-Level Security (RLS) policies. Attendee records and event data can only be accessed by authenticated organizers and team members with appropriate role permissions.

Need dedicated technical help?

Whether you are integrating our REST API, writing custom scanner hardware integrations, or organizing a 5,000+ attendee campus festival, our team is ready to assist.

urpass.space@yespstudio.com Start building for free

curl -X POST https://urpass.space/api/verify \ -H "Content-Type: application/json" \ -H "Cookie: sb-access-token=..." \ -d '{ "passToken": "urp_pass_9c4e82b71f...", "eventId": "3c84be2e-4b2a-4819-a9a3-5c5f49e19d77", "gateId": "7d91e602-0e83-4a11-b0ec-1c8821901a12", "checkInMethod": "qr" }'

Role

Manage Org & Billing

Create / Edit Events

Approve Attendees

Scan Passes at Gates

View Analytics

Owner

Admin

Event Manager

Check-in Staff

Viewer

Method

Endpoint

Purpose

GET

/ServiceProviderConfig

SCIM 2.0 capability discovery

GET

/Schemas

Core User resource schema

GET

/Users?filter=userName eq "..."

Search directory members by email

POST

/Users

Provision new organization member

PATCH

/Users/{userId}

Instant deactivation (active: false) & session purge

PATCH /api/scim/v2/org-12345/Users/mem-98765 HTTP/1.1 Host: urpass.space Authorization: Bearer scim_live_8f3a9e1b2c4d... Content-Type: application/scim+json { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ { "op": "replace", "path": "active", "value": false } ] }

{ "data": [ { "id": "e4210d65-3d84-4828-b997-c25f48719230", "name": "DevCon India 2026", "description": "Annual national developer conference", "event_date": "2026-11-20", "start_time": "09:30:00", "end_time": "18:00:00", "venue": "Bengaluru International Exhibition Centre", "status": "active", "is_paid_event": true, "ticket_price": 79900, "attendee_limit": 1000, "application_enabled": true, "apply_slug": "devcon-india-2026", "created_at": "2026-09-01T10:15:30.000Z" } ], "meta": { "total": 1, "limit": 50, "offset": 0 } }

{ "data": [ { "id": "7bf31890-1c5e-49b2-9d33-149b1049c402", "name": "Ananya Roy", "email": "ananya@example.com", "phone": "+919123456780", "pass_type": "vip", "application_status": "approved", "pass_status": "checked_in", "created_at": "2026-09-12T11:42:00.000Z" } ], "meta": { "total": 340, "limit": 100, "offset": 0 } }

import crypto from "crypto"; export async function POST(req: Request) { const signature = req.headers.get("x-urpass-signature"); const eventType = req.headers.get("x-urpass-event"); const rawBody = await req.text(); const secret = process.env.URPASS_WEBHOOK_SECRET!; const expectedSig = `sha256=${crypto .createHmac("sha256", secret) .update(rawBody) .digest("hex")}`; const isValid = signature && signature.length === expectedSig.length && crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig)); if (!isValid) { return new Response("Invalid signature", { status: 401 }); } const payload = JSON.parse(rawBody); console.log(`Received event ${eventType}:`, payload.data); return new Response("OK", { status: 200 }); }

{ "event_type": "checkin.completed", "timestamp": "2026-09-20T11:45:00.000Z", "data": { "attendee_id": "7bf31890-1c5e-49b2-9d33-149b1049c402", "event_id": "e4210d65-3d84-4828-b997-c25f48719230", "name": "Ananya Roy", "email": "ananya@example.com", "pass_type": "vip", "checked_in_at": "2026-09-20T11:45:00.000Z" } }

{ "event_type": "payment.success", "timestamp": "2026-09-20T10:30:12.000Z", "data": { "order_id": "order_NXv0b8A1C9dE3f", "event_id": "e4210d65-3d84-4828-b997-c25f48719230", "amount": 79900, "currency": "INR", "buyer_name": "Devansh Gupta", "buyer_email": "devansh@example.com" } }

// ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) // %APPDATA%\Claude\claude_desktop_config.json (Windows) { "mcpServers": { "urpass": { "command": "npx", "args": ["-y", "urpass-mcp"], "env": { "URPASS_API_KEY": "urpass_live_your_api_key_here" } } } }