Creating an event returns a public signing URL and a tokenized roster URL. They serve different audiences. The signing route is for guests; the roster is an operational view for staff. Do not store them as one interchangeable “event link” field in your application.
Name the links by purpose
Use separate application properties and interface labels for publicUrl and rosterUrl. A copy button should say which link it copies. This reduces the chance that an organizer prints the staff route on a public QR sign.
The creation request requires events:manage; event inspection uses events:read. Review the create-event response and keep the returned roster URL protected according to its access role.
publicUrl -> guest invitation or public signing entry point
rosterUrl -> authorized operational handoff
This is an audience map, not a claim that your application’s own authorization can be skipped because a URL contains a token.
Limit exposure in logs and previews
Avoid logging complete tokenized URLs in analytics, exception messages or general support tickets. If diagnostics need to identify the event, use its stable ID and request identifier. A link included in an email preview or shared chat can be forwarded beyond the intended staff group.
Do not place the roster URL in Open Graph metadata, a public sitemap or a marketing page. Public page-generation code should never consume private event responses as if they were ordinary content assets.
Respect the retrieval boundary
The event retrieval endpoint returns invitees without their email, phone or personal invite token. Design your interface around the fields actually supplied. It is not an API for recovering the original uploaded contact list.
If your integration needs to maintain a booking-contact mapping, store the necessary relationship in your own protected application and define its lifecycle. Do not assume that adding broader scopes will make intentionally omitted response fields appear.
Include closure in the handling plan
Closing an event stops its signing routes and further invitations, but the roster link remains read-only under the current contract. Treat that remaining access deliberately rather than assuming closure revokes every historical link.
Test guest-link copying, staff-link copying and event closure with controlled data. Confirm no public page, log or generic email template receives the roster URL. Pair this work with partner-venue instructions so the human handoff preserves the same distinction.