Get your host account and event access

What approval actually creates: a draft event, your user account, and a grant scoped to one event id.

Owned by Host / Promoter · 9 steps · about 15 minutes

Host / PromoterOWNER manual → Venue Manager manual → Admin manual →

Why this exists

This is the moment you stop being an applicant and become a host, and it is worth knowing exactly what the platform does — because it does three things in a single transaction and none of them are done by hand.

Conversion takes your approved application and creates a draft event from it: the name, description and slot times are copied, and the ticket tiers are built from your tier estimates in order (the first opens as soon as the event goes on sale, later ones cascade behind it, with door zones inferred from the tier names). Then it creates-or-reuses your user account. Then it grants you the host role.

Nothing secret is ever put in your inbox. If you had no account, the one made for you is passwordless — it is created with a random hash nobody holds and password_set off — and you receive a magic sign-in link, the same identity machinery the rest of the platform uses. An older build mailed a plaintext temporary password; that was retired on 2026-08-19 after an audit, and the reason is worth carrying: a credential in an email is a credential in a mailbox, a mail server and this platform's own outbound log. Set a password once you are in, from your account page.

This branch is also nearly unreachable, which is why it is easy to be wrong about. Since the application form began requiring an account, every normally-filed application already has a user behind it and conversion simply reuses it. Only staff-entered edge paths land here.

That grant is the thing to understand. It is scoped: it carries an event_id, and every permission check asks "is this person a host of this event". You are not "a host" in general. Two promoters with host grants cannot see each other's events at all — not the dashboard, not the sales, not the guest list, not even the draft page.

And your account carries only that grant. Conversion does not make you a member, so member-only surfaces are not yours by default. Inside your own event you are effectively read-only: you can see it, see its sales, sign its contract and invite guests against the comp buckets allocated to you. You do not price it, transition it, refund it, or touch its money. That separation is what the contract is for — it is the record of what the venue agreed to do on your behalf.

Before you start

  • An approved application (approval and conversion are two separate staff actions).
  • Access to the email address on the application — the magic sign-in link goes there.

Practise with

PersonaEmailPasswordNote
host_promoterhost@club.test host123already holds a scoped host grant on demo-event-0001
venue_managermanager@club.test manager123runs the conversion
adminadmin@club.test admin123grants and revokes roles, and can read the audit trail behind them

Steps 1 — Venue Manager

their manual →

Runs the conversion that creates the event, your account and your scoped grant.

  1. 1
    From the approved application, press the convert button: create the draft event and grant the host role.
    /api/intake/applications/{app_id}/convert POST intake
    Expected result 201 with the new event id. In one transaction: a draft event with tiers built from the tier estimates, the host user (created if new), and a host grant carrying that event id. The application is stamped with the event and host user ids.
    Watch out for 409 application_not_approved if you skipped approval, and 409 already_converted with the existing event id inside the error message if someone beat you to it. It is all-or-nothing: there is no state where an event exists but the host cannot log in.

Steps 2–7 — Host / Promoter

their manual →
  1. 2
    Open the sign-in link from your email, or the login page if you already had an account.
    /login core
    Expected result The standard login form — there is no separate host portal. A brand-new host account has NO password: conversion creates it passwordless and sends a one-time sign-in link instead.
    Watch out for Nothing secret is ever mailed. The account is created with a random hash nobody holds and password_set off, and the link is the same identity machinery the rest of the platform uses — corrected here 2026-08-29, having still described the plaintext temporary password this workflow's own intent says was retired on 2026-08-19. If you already had an account under that email, no new one was created and no link was sent: you log in with the password you already had.
  2. 3
    Log in.
    /auth/login POST core
    Expected result A session. Your account carries exactly one grant: host, scoped to your event.
    Watch out for Set a password from your account page once you are in — a converted account starts without one. The link that got you here is single-use: a replayed one renders 'This link has already been used' rather than signing you in.
  3. 4
    Open your event dashboard by its direct URL. This is your home base for the whole run.
    /admin/events/{event_id} events
    Expected result The event details, its tiers, a live sales panel, the status log and recent platform events — with a banner reading 'Read-only view — management actions require the admin role.'
    Watch out for The events list at /admin/events is admin and venue manager only: you get a 403 there even though your own event's page opens fine. Bookmark the direct URL. Another promoter's event id is a 403, not a 404 — the platform does not pretend their event does not exist, it tells you it is not yours.
  4. 5
    Open the public page for your event to see what the world sees.
    /events/{event_id} events
    Expected result While the event is still draft, only you and staff can load this page.
    Watch out for Everyone else gets a plain 404 on a draft event — not a 403. Drafts are invisible, not forbidden. Once the contract is counter-signed the event is announced and the page is public.
  5. 6
    Check your other scoped surface: the guest list dashboard for your event.
    /admin/guestlist/{event_id} guestlist
    Expected result Your comp buckets and their entries — and only the buckets whose owner is you.
    Watch out for It is normal for this to be empty at first. Allocating a bucket to you is a venue decision and it happens separately.
  6. 7
    Learn the boundary before you hit it. Even on your own event you cannot create or change tiers, prices, capacity or the event status; you cannot refund an order, read the ledger, or take money outside the contracted royalty; and you cannot see any other event or any venue-wide report.
    Expected result 403 forbidden on every one of those, with a message naming the role required.
    Watch out for The one admin-shaped thing you can do is read your own event's sales figures. That is deliberate, and it is the subject of its own workflow.

Steps 8–9 — Admin

their manual →

Owns role grants and revocations — the only person who can fix a grant pointed at the wrong event.

  1. 8
    As an admin, open the host's user record and confirm the grant.
    /admin/users/{user_id} rbac
    Expected result The host group shown as a scoped chip carrying the event id, plus the audit rows behind the grant.
    Watch out for The grant's audit reason records which application approved it, so a grant can always be traced back to paperwork.
  2. 9
    Grant or re-grant a scoped host role by hand when a conversion went to the wrong account.
    /api/rbac/users/{user_id}/groups POST rbac
    Expected result 201 with the new grant, and an audit row naming you as the actor.
    Watch out for A host grant without an event id is meaningless and is rejected. Revoke the wrong grant rather than deleting the user — the revocation is part of the record.
← Create your member account Back to the Host / Promoter manual Leave feedback on any part of the app →