API Overview

ARBEC exposes a small set of external integration surfaces for developers who need published conference data or event notifications.

Choose an integration surface

Surface	Use it for	Authentication
Plugin manifest API	Registering and managing an edition-scoped plugin declaration	Authorized conference-manager token
Public REST agenda	Reading published sessions for a companion app	x-api-key header with agenda:read scope
Public GraphQL API	Querying the published agenda with GraphQL	Authorization: Bearer <api_key> with agenda:read scope
Webhook subscriptions	Receiving signed event notifications	Authorized conference-manager token to create the subscription

Public agenda APIs

Both public agenda surfaces return published sessions for an edition owned by the organization associated with the API key. Draft or unpublished sessions are not returned.

REST

GET /api/public/v1/editions/{editionId}/agenda
x-api-key: arbec_<api-key-secret>

GraphQL

POST /graphql/public
Authorization: Bearer arbec_<api-key-secret>
Content-Type: application/json

{
  "query": "query Agenda($editionId: ID!) { agenda(editionId: $editionId) { id title description roomName startTime endTime status } }",
  "variables": { "editionId": "<edition-id>" }
}

GraphQL subscriptions are not supported. The current public schema exposes the agenda(editionId) query and returns session fields including id, title, description, roomName, startTime, endTime, and status.

API keys

An organization administrator creates an API key with a label, one or more scopes, and an optional future expiry. The secret is returned only when the key is created. Store it in a secret manager, never in plugin metadata or browser code.

The current agenda integration requires the agenda:read scope. Invalid, expired, or revoked keys are rejected. API requests update usage counters, and failed requests are recorded for organization-level monitoring.

Rate limits

Read and write limits are configured by the ARBEC environment and are not values a client should assume. When a limit is exceeded, the API returns HTTP 429 Too Many Requests. Build clients to respect the response and retry with backoff where appropriate.

Next steps

• Use Plugin Integration for the manifest contract, lifecycle endpoints, and webhook setup.
• Use Plugin System to understand the current plugin boundary and planned execution capabilities.