ADITUS/Webhooks/Ticket entry and validation

Ticket entry and validation

In the Ticket Entry and Validation area, webhooks are used to notify external systems in real time about all relevant events related to ticket validation and access control. This enables connected applications to immediately react—for example, to trigger logging, perform security checks, or start follow-up processes.

A central example is the aserv.[*]granted event, which is triggered once an entry action has been successfully validated and granted. Similarly, aserv.[*]denied events are triggered when an action is rejected. This ensures that third-party applications are always kept up to date without requiring polling or manual queries.

Ticket validation is the core process of the entry flow. Once a ticket has been checked, the system triggers the appropriate event:

  • granted events → when an action is successful

  • denied events → when an action is rejected


Granted Events

When a process completes successfully, the corresponding granted event is triggered. This allows external systems to ensure that all downstream processes (e.g., visitor tracking, CRM updates, or security logs) are executed consistently and in real time.

Supported Granted Events

  • aserv.entryGranted – Entry granted

  • aserv.exitGranted – Exit granted

  • aserv.blockGranted – Block successfully applied

  • aserv.unblockGranted – Block successfully removed

  • aserv.badgePrintGranted – Badge print granted

  • aserv.badgeReprintGranted – Badge reprint granted

  • aserv.customAction1Granted – Custom action 1 granted

  • aserv.customAction2Granted – Custom action 2 granted

  • aserv.customAction3Granted – Custom action 3 granted

  • aserv.customAction4Granted – Custom action 4 granted

  • aserv.customAction5Granted – Custom action 5 granted

  • aserv.getHistory – Retrieve event history

Typical Use Cases:

  1. A visitor scans their ticket (barcode/QR code) at an entry terminal.

  2. The system validates the ticket (authorization, validity period, blocks).

  3. Entry is granted (code: 0, message: "OK").

  4. The system triggers the aserv.entryGranted event and sends the webhook to all registered endpoints.

  5. Receiving systems can process the entry data — e.g., update visitor counts, create CRM entries, or write security logs.

Trigger Condition

  • The aserv.entryGranted event is triggered when a ticket is scanned at an access control point and the entry validation is successful (Entry Granted).

Webhook payload sample for a granted entry

{
"event": "aserv.entryGranted",
"event_id": "3d19df0c-4d4e-446d-9a53-49edf3ab6ca1",
"event_time": "2026-06-02T14:14:24.6951064+02:00",
"endpoint_url": "https://aditus-integration.replit.app/api/webhook/receive/aditus_dev_aditus_aserv_cvent_2",
"data": {
"response": {
"code": 0,
"message": "OK.",
"executePrint": true,
"timestamp": "2026-06-02T14:14:24.183978+02:00"
},
"request": {
"timestamp": "2026-06-02T14:14:24.154+02:00",
"barcode": "6864686510000178",
"messageId": 385992265,
"messageGuid": "8540754c-f01f-43f9-9f7d-c9c5ba0db6ba",
"barcodeType": "Unknown",
"isOnline": true,
"command": "entry",
"isTest": false,
"user": "msv-admin@aditus.de",
"faireventId": "203",
"terminalId": "6960"
},
"fairevent": {
"id": 203,
"uniqueId": "7caf52f9-87ef-f011-93e3-00155d960409",
"name": "Rdr baut nur ...",
"year": "2026",
"externalId1": "test-id-1",
"externalId2": "Rdr26",
"externalId3": "test-id-3"
},
"terminal": {
"id": 112,
"number": "6960",
"description": "POS-0112 @ Salzburg — standby",
"device": {
"id": 133,
"number": "50",
"dataObjectType": "Framework.Speedys",
"identifier": "C4:C6:E6:98:57:78"
}
},
"article": {
"id": 2989,
"uniqueId": "e0538711-89ef-f011-93e3-00155d960409",
"name": "Rdr baut nur Mist",
"type": "Ticket",
"number": "865",
"ticketType": "VisitorTicket",
"badgeCategory": "VISITOR",
"externalId1": "test-id-1",
"externalId2": "test-id-2",
"externalId3": "test-id-3"
},
"ticket": {
"id": 6767905,
"uniqueId": "0b5a81fe-89ef-f011-93e3-00155d960409",
"ticketNumberFull": "6864686510000178",
"owner": {
"id": 287,
"uniqueId": "189a84a8-7bf4-ed11-93c6-00155d960409",
"firstName": "Maxime",
"lastName": "Musterlicher",
"nationalityLookup": "DE",
"spokenLanguage": "de",
"company": "Muster GmbH",
"jobTitle": "Schuldner",
"salutationLookup": "Frau",
"partyNo": "OB0000204"
},
"user": {
"id": 146,
"uniqueId": "132d086b-c7e8-ed11-93c4-00155db54d03",
"name": "l.rueder@aditus.de",
"email": "l.rueder@aditus.de",
"lastName": "Musterlicher",
"firstName": "Maxime",
"externalId3": "132d086b-c7e8-ed11-93c4-00155db54d03"
}
},
"user": {
"id": 8842,
"uniqueId": "08f984a1-808c-ef11-93d8-00155d96040a",
"name": "msv-admin@aditus.de",
"email": "msv-admin@aditus.de"
}
}
}

Fields in Detail

response – Result of the Entry Validation

Contains the system's decision regarding the entry request.

FieldTypeDescriptionExample Value
codeintegerReturn code of the entry validation. 0 means "successful". Other values indicate errors or rejections.0
messagestringHuman-readable status message describing the result of the validation.OK.
executePrintbooleanIndicates whether a print action (e.g., badge printing) should be triggered as part of this entry event. true = print should be executed.true
timestampstring (ISO‑8601)Timestamp at which the system made the entry decision.2026-06-02T14:14:24.183978+02:00

request – Entry Request (Scan)

Details of the actual scan operation at the terminal.

FieldTypeDescriptionExample Value
timestampstring (ISO‑8601)Timestamp at which the barcode was scanned at the terminal.2026-06-02T14:14:24.154+02:00
barcodestringFull content of the scanned barcode/QR code. May contain encrypted ticket data or a plain ticket number.6864686510000178
messageIdintegerInternal, sequential message ID for associating the request within the system.385992265
messageGuidstring (UUID)Unique GUID of the scan request. Used for deduplication and traceability.8540754c-f01f-43f9-9f7d-c9c5ba0db6ba
barcodeTypestringDetected type of the barcode (e.g., aztec, qrcode, Unknown). Unknown means the type could not be automatically determined.Unknown
isOnlinebooleanIndicates whether the scan was performed in online mode (true) or offline mode (false). In offline mode, validation is performed locally.true
commandstringThe executed command. Possible values: entry, exit, block, unblock, badgePrint, badgeReprint, customAction1customAction5.entry
isTestbooleanIndicates whether this is a test scan (true) or a production scan (false).false
userstringEmail address of the user who initiated the scan at the terminal.msv-admin@aditus.de
faireventIdstringInternal ID of the event to which the scan belongs.203
terminalIdstringID of the terminal at which the scan was performed.6960

fairevent – Event Information

Information about the fair/event in whose context the entry takes place.

FieldTypeDescriptionExample Value
idintegerInternal numeric ID of the event.203
uniqueIdstring (UUID)Global, unique UUID of the event. Used for cross-system referencing.7caf52f9-87ef-f011-93e3-00155d960409
namestringName of the event.Rdr baut nur ...
yearstringYear of the event.2026
externalId1stringFirst external reference ID (e.g., SAP or Salesforce ID). Enables mapping to third-party systems.test-id-1
externalId2stringSecond external reference ID. May be empty.Rdr26
externalId3stringThird external reference ID. May be empty.test-id-3

terminal – Access Terminal

Information about the terminal at which the scan was performed.

FieldTypeDescriptionExample Value
idintegerInternal ID of the terminal.112
numberstringTerminal number for identification in on-site operations.6960
descriptionstringHuman-readable description of the terminal, typically including location and status information.POS-0112 @ Salzburg — standby

device – Device (within terminal)

Details about the physical device deployed at the terminal.

FieldTypeDescriptionExample Value
idintegerInternal device ID.133
numberstringDevice number.50
dataObjectTypestringType of the device in the system. Possible values: Framework.MobileScanners, Framework.Speedys, etc.Framework.Speedys
identifierstringUnique hardware identifier of the device (e.g., MAC address, serial number, or Android ID).C4:C6:E6:98:57:78

article – Ticket Article

Information about the article (ticket type) underlying the scanned ticket.

FieldTypeDescriptionExample Value
idintegerInternal article ID.2989
uniqueIdstring (UUID)Global UUID of the article.e0538711-89ef-f011-93e3-00155d960409
namestringShort name of the article.Rdr baut nur Mist
typestringArticle type. Typical values: Ticket, Badge, Product.Ticket
numberstringArticle number.865
ticketTypestringSpecific ticket type. Possible values: VisitorTicket, ExhibitorTicket, PressTicket, etc.VisitorTicket
badgeCategorystringBadge category assigned to this article. Used for visual differentiation and access control rules. Typical values: VISITOR, EXHIBITOR, PRESS, VIP.VISITOR
externalId1stringFirst external article reference (e.g., product ID in an ERP system).test-id-1
externalId2stringSecond external reference. May be empty.test-id-2
externalId3stringThird external reference. May be empty.test-id-3

ticket – Ticket Information

Information about the specific ticket that was scanned.

FieldTypeDescriptionExample Value
idintegerInternal ticket ID.6767905
uniqueIdstring (UUID)Global UUID of the ticket. Used for cross-system referencing.0b5a81fe-89ef-f011-93e3-00155d960409
ticketNumberFullstringFull ticket number (e.g., as printed on the ticket or encoded in the barcode).6864686510000178

owner – Ticket Owner (within ticket)

The person to whom the ticket belongs (registration data).

FieldTypeDescriptionExample Value
idintegerInternal ID of the ticket owner.287
uniqueIdstring (UUID)Global UUID of the ticket owner.189a84a8-7bf4-ed11-93c6-00155d960409
firstNamestringFirst name of the ticket owner.Maxime
lastNamestringLast name of the ticket owner.Musterlicher
nationalityLookupstringNationality as ISO country code (e.g., DE, US, FR).DE
spokenLanguagestringPreferred language as ISO language code (e.g., de, en).de
companystringCompany/organization of the ticket owner.Muster GmbH
jobTitlestringJob title/position of the ticket owner.Schuldner
salutationLookupstringSalutation (e.g., Herr, Frau, Divers).Frau
partyNostringUnique participant number of the ticket owner in the CRM system.OB0000204

user – Ticket User (within ticket)

The user who uses the ticket (may differ from the owner, e.g., for transferred tickets).

FieldTypeDescriptionExample Value
idintegerInternal user ID.146
uniqueIdstring (UUID)Global UUID of the user.132d086b-c7e8-ed11-93c4-00155db54d03
namestringUsername (typically the email address).l.rueder@aditus.de
emailstringEmail address of the user.l.rueder@aditus.de
lastNamestringLast name of the user.Musterlicher
firstNamestringFirst name of the user.Maxime
externalId3stringThird external user reference. May be empty.132d086b-c7e8-ed11-93c4-00155db54d03

user – System User (Top-Level)

The user who physically performed the scan at the terminal (e.g., security personnel or an automated device account).

FieldTypeDescriptionExample Value
idintegerInternal user ID of the scan operator.8842
uniqueIdstring (UUID)Global UUID of the scan operator.08f984a1-808c-ef11-93d8-00155d96040a
namestringUsername of the scan operator.msv-admin@aditus.de
emailstringEmail address of the scan operator.msv-admin@aditus.de

Note on Additional Events

The same payload structure applies analogously to all other Granted events in the Ticket Entry and Validation area. Only the value of the event field and the command value in request change:

Eventcommand ValueDescription
aserv.entryGrantedentryEntry successfully granted
aserv.exitGrantedexitExit successfully granted
aserv.blockGrantedblockBlock successfully applied
aserv.unblockGrantedunblockBlock successfully removed
aserv.badgePrintGrantedbadgePrintBadge print successfully granted
aserv.badgeReprintGrantedbadgeReprintBadge reprint successfully granted
aserv.customAction1GrantedcustomAction5GrantedcustomAction1customAction5Custom action 1–5 successfully executed

Denied Events

When an action is rejected, the system triggers the corresponding denied event. This allows security mechanisms, monitoring systems, or user feedback processes to be executed immediately and reliably.

For Denied events (e.g., aserv.entryDenied), the response object contains a code ≠ 0 and a corresponding error message in the message field.

Supported Denied Events

  • aserv.entryDenied – Entry denied

  • aserv.exitDenied – Exit denied

  • aserv.blockDenied – Block operation failed

  • aserv.unblockDenied – Unblock operation failed

  • aserv.badgePrintDenied – Badge print denied

  • aserv.badgeReprintDenied – Badge reprint denied

  • aserv.customAction1Denied – Custom action 1 denied

  • aserv.customAction2Denied – Custom action 2 denied

  • aserv.customAction3Denied – Custom action 3 denied

  • aserv.customAction4Denied – Custom action 4 denied

  • aserv.customAction5Denied – Custom action 5 denied

Webhook payload sample for a denied entry

Depending on the reason for the denial, not all data is available in the response.

{
"event": "aserv.exitDenied",
"event_id": "c8ad1bab-5970-4127-a751-f8a7269c6fc0",
"event_time": "2026-04-24T09:52:51.8349371+02:00",
"endpoint_url": "https://webhook.site/7d30a00f-b27b-4e22-96bd-a56201f80bcb",
"data": {
"response": {
"code": 20003,
"message": "User not available.",
"timestamp": "2026-04-24T09:52:51.1914722+02:00"
},
"request": {
"timestamp": "2026-04-24T09:52:51.116+02:00",
"barcode": "HTTP://QUICO.DE/RRWBWZP97MQCTMDTB/C/| ∀|/T/ADITUS-DEV-0",
"messageId": 703472083,
"messageGuid": "e6ff71f7-444c-4a41-b2de-f9b8eb1ba5cf",
"barcodeType": "Unknown",
"isOnline": true,
"command": "exit",
"isTest": false,
"user": "565",
"locationId": "6",
"faireventId": "203",
"terminalId": "35081"
},
"fairevent": {
"id": 203,
"uniqueId": "7caf52f9-87ef-f011-93e3-00155d960409",
"name": "Rdr baut nur ...",
"year": "2026",
"externalId2": "Rdr26"
},
"location": {
"id": 6,
"name": "Ausgang Ost",
"number": "LCEN0003",
"uniqueId": "6af5cdc0-4a0f-ee11-93c7-00155d96040a"
},
"terminal": {
"id": 750,
"number": "35081",
"device": {
"id": 1808,
"number": "1230",
"dataObjectType": "Framework.MobileScanners",
"identifier": "b882b166f1ae4d61"
}
}
}
}

Note on Additional Denied Events

The same payload structure applies analogously to all other Denied events. Only the value of the event field and the command value in request change:

Eventcommand ValueDescription
aserv.entryDeniedentryEntry denied
aserv.exitDeniedexitExit denied
aserv.blockDeniedblockBlock operation failed
aserv.unblockDeniedunblockUnblock operation failed
aserv.badgePrintDeniedbadgePrintBadge print denied
aserv.badgeReprintDeniedbadgeReprintBadge reprint denied
aserv.customAction1DeniedcustomAction5DeniedcustomAction1customAction5Custom action 1–5 denied

Key Differences from Granted Events

AspectGranted EventsDenied Events
response.codeAlways 0Always ≠ 0 (specific denial reason)
response.messageOK.Describes the denial reason (e.g., Ticket already used.)
response.executePrintMay be true or falseTypically absent (no print on denial)
Data completenessAll objects are always presentSome objects may be absent depending on the denial reason
Typical consumersVisitor tracking, CRM, loggingSecurity alerts, monitoring, fraud detection, audit logs