API conventions

Requests and responses

• Send and request JSON with Content-Type: application/json and Accept: application/json when a request has a JSON body.
• Identifiers such as project, event, and registration IDs are GUID values unless an operation says otherwise.
• Date and time fields use the format documented by their generated schema. Preserve explicit offsets when sending timestamps.
• Treat response fields according to the reference schema; do not depend on undocumented properties.

Authorization scope

A valid credential does not imply access to every HIO record. Many operations additionally validate the project, event, organization, or user associated with the request.

Contract changes

The public OpenAPI document is the source of truth for supported operations. New endpoints appear only after they are explicitly approved for the public contract. Internal and permanently excluded endpoints are never included.

Use the operation ID when your code generator supports it. Operation IDs are kept stable so generated clients can evolve with the contract.