Incoming webhooks API reference

Incoming PACS webhooks let your access-control system tell UnSpot when employees enter or leave the office. UnSpot uses these events for automatic check-in of bookings and attendance analytics. Events are sent to a universal JSON endpoint that works with any PACS.

1. Create a connection

In Manage > Integrations, create a PACS connection of type JSON. You define which fields of your payload contain the data — so you can adapt UnSpot to whatever your PACS sends:

After saving, UnSpot generates a unique endpoint token — your PACS will POST events to the URL containing it.

2. Send events — POST /api/scud/json/{token}

curl -X POST -H "Content-Type: application/json" -H "Un-Token: <access token>" \
  https://acme.unspot.com/api/scud/json/3f2a...-connection-token \
  -d '{
    "space": "HQ Berlin",
    "user": "jane.doe@example.com",
    "status": "in_office"
  }'

curl -X POST -H "Content-Type: application/json" -H "Un-Token: <access token>" \
  https://acme.unspot.com/api/scud/json/3f2a...-connection-token \
  -d '{
    "space": "HQ Berlin",
    "user": "jane.doe@example.com",
    "status": "in_office"
  }'

• User identification: if the user value is an email, the user is matched by email only, and no other method is tried when that misses. When the value does not look like an email, UnSpot tries the pass number, then the full name, then the display name — the display-name step was added on 7 September 2026. An ambiguous match at any step is rejected.
• The display-name match compares the whole string: leading and trailing spaces are trimmed, several spaces in a row count as one, and case is ignored — " Anna Smith " finds the employee whose display name is Anna Smith. Unlike the full-name match it drops no words and does not try the reverse word order, and a single-word value is looked up as well. The rule is the same for JSON and for Sigur.
• Status: the value must resolve to “in office” or “out of office”. The event time is the moment UnSpot receives the request.
• Events are processed asynchronously; each event (including errors) is recorded in the integration log (Reports > Integration history).

3. What UnSpot does with an event

• Marks the user as present in / absent from the office.
• Confirms check-in for the user’s bookings when check-in policies require office presence.
• Feeds office-attendance analytics and reports.

Errors

• Integration not found — wrong endpoint token.
• Access to subscription denied — the Un-Token header does not match the configured access token.
• Subscription deactivated — the connection is disabled in UnSpot.
• User not found / Multiple users found by pass number — the user identifier could not be resolved unambiguously.
• Missing office/user/status keys — the event is rejected and logged.

For a hands-on example of the JSON variant, see Incoming Webhooks: Connecting PACS via JSON.