Events Manager

Events Manager is a WordPress plugin for event calendars, bookings and ticketing. From version 7.3 it publishes a REST API under the events-manager/v1 namespace, and this connector is a curated slice of it: reading the calendar, checking availability, managing events, locations, tickets and categories, and taking or changing bookings.

You tell it which site, not which endpoint. When you add the connection you give the site's address, and your gateway reads the site's REST index to find where the Events Manager API lives, then pins that address for good. A site that uses plain permalinks works too: the gateway routes each call through ?rest_route= instead.

If you also run Events Manager Pro, or want WordPress itself alongside it, connect the site as any WordPress site with the Abilities API selected. Events Manager and Events Manager Pro register their actions as abilities, and Permaura has reviewed them, so they arrive with the same levels as this connector rather than the stricter ones an unreviewed ability gets. See Abilities Permaura has reviewed.

What you need

Events Manager 7.3 or later, and a WordPress Application Password (built into WordPress 5.6 and later), sent as HTTP Basic auth. The credential is the pair username:application-password.

1. Decide which WordPress user the agent should act as. Bookings and events it creates carry that user's name, so a dedicated account is usually clearer than your own.
2. Sign in as that user and go to Users → Profile, scroll to Application Passwords, give it a name such as permaura, and choose Add New Application Password.
3. Copy the generated password. WordPress shows it once, in space-separated groups of four; the spaces are ignored.

Least privilege

Every action runs as that user and passes Events Manager's own permission check, so the user's role is the real ceiling on what an agent can do, whatever you switch on here:

To use	The user needs
Reads, including bookings visible to the user	To be signed in (any role)
events.create, events.update, tickets.* writes	edit_events
events.delete	delete_events or delete_others_events
locations.create, locations.update	edit_locations
locations.delete	delete_locations or delete_others_locations
bookings.update, bookings.status, bookings.delete	manage_bookings or manage_others_bookings
categories.delete, tags.delete	delete_event_categories
media.upload	upload_files

An agent that only answers questions about your calendar needs a user that can sign in and nothing more. Give it booking management only if you intend to switch those actions on.

Add the connection

In the console, open Access → Connections → Add connection and pick Events Manager from the catalog. Enter the Site URL, the address you open the site at in a browser, then the WordPress username and the application password. The console seals them together on your gateway, and they are never displayed again. The success message shows the address the gateway pinned.

The reads arrive switched on and every write arrives switched off. Nothing is usable until a grant allows it.

What the agent can do

Capabilities are namespaced under the connection id, so an agent sees events.list as <connection>.events.list.

Action	What it does	On by default
events.list	Lists events, filtered by scope, status, category, tag, location_id, town, country, near and more	Yes
events.read	Reads one event; an id with a timeslot suffix, such as 123:4, reads one timeslot	Yes
events.availability	Reads booking availability and ticket spaces for one event	Yes
events.tickets.list	Lists an event's tickets	Yes
tickets.read	Reads one ticket	Yes
locations.list	Lists locations, filtered like events	Yes
locations.read	Reads one location	Yes
locations.countries, .regions, .states, .towns	Lists the places your locations are in	Yes
bookings.list	Lists bookings visible to the user, filtered by event_id, status, person and more	Yes
bookings.read	Reads one booking by id or UUID	Yes
categories.list, categories.read, tags.list, tags.read	Reads event categories and tags	Yes
events.create, events.update	Creates or edits an event	No
tickets.create, tickets.update	Adds a ticket to an event or edits one	No
locations.create, locations.update	Creates or edits a location	No
categories.create, .update, tags.create, .update	Creates or edits a category or tag	No
media.upload	Uploads an image from a public URL or base64 bytes	No
bookings.create	Takes a booking	No, approval-gated
bookings.update	Changes a booking	No, approval-gated
bookings.status	Approves, rejects or cancels a booking, optionally emailing the attendee	No, approval-gated
events.delete, tickets.delete, locations.delete, categories.delete, tags.delete	Trashes or deletes	No, approval-gated
bookings.delete	Permanently deletes a booking	No, approval-gated

Anything that touches a booking asks for a human approval on every call, even after you switch it on, because it reaches a real attendee: a new or changed booking can send them an email, and a status change can cancel their place. The deletes are marked critical for the same reason.

Good to know

• Contact details are redacted. email, user_email, dbem_phone, phone and IP addresses are stripped from responses before the agent sees them. An agent can tell you who has booked; it cannot read their email address or phone number.
• Bookings take no overrides. bookings.create and bookings.update do not forward Events Manager's capacity override, payment amount or tax rate fields, so an agent cannot book past a full event or mark a booking paid. Change a status with bookings.status.
• Timeslots have their own ids. An event with timeslots answers to 123 for the whole event and 123:4 for one slot; the colon travels encoded and WordPress reads it back.
• Events Manager has its own MCP server too. The plugin can serve its abilities to an AI client directly. Connecting through Permaura instead keeps the application password on your gateway, puts every call under your policies and grants, and records it in the audit log.
• The kill switch is instant. Disabling the connection in the console refuses every call through it immediately, across every agent and grant.