# Splash

> Splash is an event marketing platform (a Cvent company since September 2024) for marketing, managing and measuring live, virtual and hybrid event programs. Its REST API covers events, event guests (group contacts), organization-level contacts, unsubscribes, event approval workflows, team management and registration forms. Splash publishes no OpenAPI: the machine-readable contract is a public Postman collection, "Splash API v2.2". API credentials are issued manually by a Customer Success Manager — there is no developer self-signup.

Generated by API Evangelist from apis.yml and the artifacts in this repository. Splash serves no /llms.txt of its own: https://api-docs.splashthat.com/llms.txt returned 404 and https://api.splashthat.com/llms.txt returned 401 on 2026-08-13.

## APIs

- [Splash API](https://api-docs.splashthat.com/): REST API for events, guests, contacts, unsubscribes, workflows, team manager and forms. Base URL https://api.splashthat.com
- [Splash CRM API](https://api-docs.splashthat.com/): Separate event-creation endpoint at https://splashthat.com/api/v2/crm/events, authenticated with a distinct `AUTHORIZATION: SplashCRM <key>` header

## Contract

- [Postman collection (verbatim)](postman/splashthat-api.postman_collection.json): "Splash API v2.2", Postman Collection schema v2.0.0, published by Splash 2019-10-22, 30 documented requests across 9 folders
- No OpenAPI, Swagger, GraphQL, AsyncAPI, gRPC or MCP contract is published — see conformance/splashthat-conformance.yml for the probe record

## Authentication

- [Authentication profile](authentication/splashthat-authentication.yml): OAuth 2.0 resource-owner password grant at https://api.splashthat.com/oauth/v2/token (client_id, client_secret, username, password, scope=user); bearer token in the Authorization header; refresh_token grant for renewal; documented 8-hour token lifetime
- [OAuth scopes](scopes/splashthat-scopes.yml): one scope, `user` — authorization granularity comes from Team Manager roles and admin privileges, not scopes

## Runtime semantics

- [Conventions](conventions/splashthat-conventions.yml): meta/data/success response envelope, page+limit pagination, viewGroups[] field expansion, bracket-indexed array query parameters, no idempotency support
- [Error catalog](errors/splashthat-problem-types.yml): proprietary envelope (meta.code / meta.message / meta.errorCode), not RFC 9457; note that Splash returns 403 for unknown ids and 500 for some caller errors
- [Rate limits](rate-limits/rate-limits.yml): 2 requests/second per Client ID, 250 per 15 minutes, 1000 per hour, plan-dependent daily cap; 429 with RateLimit-Reset, X-RateLimit-Limit-Second, X-RateLimit-Remaining-Second; 503 when the daily cap is hit
- [Data model](data-model/splashthat-data-model.yml): Event, EventSetting, GroupContact (guest), EventRsvp, Contact, Unsubscribe, EventWorkflow, User, Group, Role, Form
- [Lifecycle](lifecycle/splashthat-lifecycle.yml): mixed path versioning (/oauth/v2, /v1, unversioned core), no deprecation policy, no published SLA

## Events

- [Webhooks](asyncapi/splashthat-webhooks.yml): "Simple Postback" outgoing HTTP integration, configured in the Splash UI at organization, event or theme level; deliveries do not count against the API quota; no signing, retry or replay semantics published

## Commercial

- [Plans and pricing](plans/plans.yml): annual subscription, custom quote only; API access is an Enterprise-tier entitlement
- [FinOps](finops/finops.yml): estimated annual cost bands and transaction/platform fees
- [Pricing page](https://splashthat.com/pricing)

## Docs and support

- [API reference (Postman documenter)](https://api-docs.splashthat.com/)
- [Help center](https://support.splashthat.com/)
- [Rate limiting guide](https://support.splashthat.com/hc/en-us/articles/13759878758541-What-is-API-rate-limiting-and-what-are-the-benefits-and-impacts)
- [HTTP Request Integration guide](https://support.splashthat.com/hc/en-us/articles/360043539711-HTTP-Request-Integration-Guide)
- [Integrations](https://splashthat.com/platform/integrations)

## Notes for agents

- Every path on https://api.splashthat.com answers `401 {"message":"Unauthorized"}` without a bearer token, including /.well-known/* — there is no anonymous discovery surface.
- There is no MCP server and no A2A agent card. mcp/splashthat-mcp.yml is an API-Evangelist-derived CANDIDATE tool list, not a callable server.
- No SDK is published by Splash in any package registry; the only npm package matching the name is an abandoned third-party wrapper last released 2023-02-03.
- Irreversible operations exist: PUT /contacts/:id/anonymize cannot be undone, and POST /groupcontact can email a real guest.