fepli
deen
DevelopersAPI resources

Participants

A participant is the person who takes part in an offer, usually a child whose family has an account. Participants can also exist without an account, for example when a young person applies on their own.

Endpoints

All participant endpoints need ROLE_ADMIN and ROLE_PARTICIPANTS_ADMIN.

Where the tenant encrypts end to end, the names and the date of birth travel only sealed: they are in sealed, not in firstname, lastname and dateOfBirth, and name is the pseudonym. A write may add dateOfBirth in the clear beside its envelope; the server does not store it. See End-to-end encryption.

The participant model

  • Name
    uuid
    Type
    string
    Description

    The participant's identifier.

  • Name
    firstname
    Type
    string
    Description

    The first name. Missing where it is sealed (encrypted).

  • Name
    lastname
    Type
    string
    Description

    The last name. Missing where it is sealed (encrypted).

  • Name
    name
    Type
    string
    Description

    The full name; for a sealed participant the pseudonym, such as 487X.

  • Name
    dateOfBirth
    Type
    timestamp
    Description

    The date of birth (midnight of that day).

  • Name
    age
    Type
    integer
    Description

    The age in years, today.

  • Name
    email
    Type
    string
    Description

    The e-mail address in effect: the participant's own, or else the account's.

  • Name
    ownEmail
    Type
    string
    Description

    The participant's own e-mail address, if one was entered.

  • Name
    phone, mobile
    Type
    string
    Description

    The phone numbers in effect: the participant's own, or else the account's.

  • Name
    ownPhone, ownMobile
    Type
    string
    Description

    The participant's own phone numbers, if entered.

  • Name
    address
    Type
    object
    Description

    The postal address, with street, postalCode, city and country.

  • Name
    account
    Type
    reference
    Description

    The account the participant belongs to. Missing for participants without an account.

  • Name
    attendances
    Type
    object
    Description

    How many attendances the participant has, by state: confirmed, waitlisted, waiting and rejected. total counts every attendance except withdrawn and unfulfilled ones.

  • Name
    createdAt
    Type
    timestamp
    Description

    When the participant was created.

  • Name
    piiMasked
    Type
    boolean
    Description

    Whether personal data was left out because you may not see it. See Masked personal data.

  • Name
    encrypted
    Type
    boolean
    Description

    true where the tenant encrypts the participant's names, date of birth and notes end to end.

  • Name
    sealed
    Type
    object
    Description

    The sealed fields by name, each an envelope {v, iv, ct}. Only where encrypted.

  • Name
    keys
    Type
    object[]
    Description

    The record key, sealed for your own key: {recipientKeyId, enc, iv, ct}. Empty while the record is not shared with your key. Only where encrypted.

  • Name
    ownerKey
    Type
    object
    Description

    The family's own key, where the participant's account has one: {keyId, encPub, signPub, userUuid, directoryEntry, directorySig}. Once the team has signed it, directorySig is the Ed25519 signature of the team signing key over the canonical JSON of directoryEntry. Missing where the account is a team account or has no active family key. See Write participants.

GET/participants

List all participants

Returns a page of participants, ordered by last name and first name. Outside your own tenant, and where the tenant encrypts end to end, they are ordered by creation.

Optional filters

  • Name
    q
    Type
    string
    Description

    Only participants whose name contains this text. Matches nothing outside your own tenant. Where the tenant encrypts end to end, it is refused with 400: decrypt the list and filter it yourself.

  • Name
    account
    Type
    string
    Description

    Only participants of this account (UUID, or e-mail address within your own tenant).

  • Name
    edition
    Type
    string
    Description

    Only participants who applied for an offer of this edition (UUID or alias).

  • Name
    offer
    Type
    string
    Description

    Only participants who applied for this offer (UUID).

  • Name
    withoutAccount
    Type
    boolean
    Description

    true for participants without an account, false for those with one.

  • Name
    createdSince
    Type
    timestamp
    Description

    Only participants created since this moment.

  • Name
    page, itemsPerPage
    Type
    integer
    Description

    See Pagination.

GET/participants
curl -G https://example.fepli.eu/api/participants \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  --data-urlencode "account=familie.mueller@example.org"

Response

[
  {
    "uuid": "0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06",
    "firstname": "Lena",
    "lastname": "Müller",
    "name": "Lena Müller",
    "dateOfBirth": "2015-04-12T00:00:00+02:00",
    "age": 11,
    "email": "familie.mueller@example.org",
    "mobile": "030 23125 456",
    "address": {
      "street": "Lindenallee 12",
      "postalCode": "12345",
      "city": "Elmsbrück",
      "country": "de"
    },
    "account": {
      "uuid": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
      "name": "Anna Müller"
    },
    "attendances": {
      "confirmed": 2,
      "waitlisted": 1,
      "waiting": 0,
      "rejected": 0,
      "total": 3
    },
    "createdAt": "2025-06-02T19:20:11+02:00",
    "piiMasked": false
  }
]
GET/participants/{uuid}

Retrieve a participant

Returns one participant. Their attendances are listed with GET /attendances?participant={uuid}.

GET/participants/{uuid}
curl https://example.fepli.eu/api/participants/0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06 \
  -H "Authorization: Bearer $FEPLI_TOKEN"
POST/participants

Create a participant

Creates a participant, with or without an account. A participant without an account needs their own email.

Where the tenant encrypts end to end, send uuid, sealed and keys instead of the names, with an envelope for every field GET /e2e lists in sealedFields; sealed fields in the clear are refused (422). dateOfBirth may come in the clear beside its envelope. See Write participants.

Required attributes

  • Name
    firstname
    Type
    string
    Description

    The first name, up to 255 characters.

  • Name
    lastname
    Type
    string
    Description

    The last name, up to 255 characters.

Optional attributes

  • Name
    dateOfBirth
    Type
    date
    Description

    The date of birth, such as 2015-04-12. Must be in the past.

  • Name
    account
    Type
    string
    Description

    The account (UUID or e-mail address).

  • Name
    email
    Type
    string
    Description

    The participant's own e-mail address. Leave it out to use the account's.

  • Name
    phone, mobile
    Type
    string
    Description

    The participant's own phone numbers.

  • Name
    address
    Type
    object
    Description

    street, postalCode, city and country (two letters, defaults to de).

POST/participants
curl -X POST https://example.fepli.eu/api/participants \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "firstname": "Paul",
    "lastname": "Müller",
    "dateOfBirth": "2018-11-03",
    "account": "familie.mueller@example.org"
  }'

The response (201 Created) holds the new participant.

PATCH/participants/{uuid}

Update a participant

Changes a participant. The attributes are the same as for creating a participant; send only what you want to change.

Where the tenant encrypts end to end, new values of sealed fields arrive in sealed, with an envelope for every sealed field, and with keys if you used a new record key.

account moves the participant to another account; "account": null detaches them from their account. Where the tenant encrypts, the family they leave no longer holds their record key. email, phone and mobile set the participant's own contact details; null falls back to the account's.

PATCH/participants/{uuid}
curl -X PATCH https://example.fepli.eu/api/participants/0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06 \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"dateOfBirth": "2015-04-21"}'
DELETE/participants/{uuid}

Delete a participant

Deletes a participant. Their attendances for offers that haven't begun are withdrawn. A withdrawn attendance keeps its fee (payable) where the family's own withdrawal would: past the free cancellation period, and where the settings refuse withdrawals. Unpaid fees don't stop the deletion, though afterwards nobody can be billed for them. Responds with 204 No Content; afterwards, the participant is a 404.

Consents they gave are not revoked and not deleted: each stays in force, as its own record with the name of the person, until it is revoked or over. To revoke along with the deletion, revoke the consents first. See Consents after a deletion.

If processing of the participant is restricted (Art. 18 GDPR), the participant can't be deleted (409).

DELETE/participants/{uuid}
curl -X DELETE https://example.fepli.eu/api/participants/0191c7b3-2e3f-7a4b-9c5d-6e7f8a9b0c16 \
  -H "Authorization: Bearer $FEPLI_TOKEN"
POST/participants/{uuid}/pseudonymize

Pseudonymise a participant

Deprecated: does the same as Delete a participant. Use DELETE /participants/{uuid} instead.

The request has no body, and the response is 204 No Content.

POST/participants/{uuid}/pseudonymize
curl -X POST https://example.fepli.eu/api/participants/0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06/pseudonymize \
  -H "Authorization: Bearer $FEPLI_TOKEN"

Was this page helpful?