Run your drops from your own tools: create sign-ups, see who's in, approve or release spots — and get an event the moment something changes. Free for hosts, within the limits below.
No code? Use dibbed with Zapier or Make.
Authentication
Make an API key in Profile → Developers and send it with every request:
Authorization: Bearer dbk_…
Apps that connect on someone's behalf can use OAuth 2.1 instead (the same sign-in as dibbed's AI-assistant connector; discovery at https://dibbed.app/.well-known/oauth-authorization-server). Keys act as your account, so keep them secret; revoke one any time.
Endpoints
Base URL https://dibbed.app/api/v1. JSON in and out. A drop's {code} is the end of its link: dibbed.app/d/k7m2qx.
GET
/me
Who the key belongs to.
GET
/drops
Your drops, newest first. Add ?include_past=true for closed and ended ones.
POST
/drops
Create a drop (body below). Returns the drop with its link.
GET
/drops/{code}
A drop: details, what's free, questions — and for its host, everyone signed up.
PATCH
/drops/{code}
Edit a drop: title, details, times, open / closed, public listing.
GET
/drops/{code}/signups
Who's in, pending and waitlisted (?status=all adds released and passed).
POST
/drops/{code}/signups/{id}/approve
Approve a pending sign-up (drops where you approve each).
POST
/drops/{code}/signups/{id}/pass
Pass it to the next person in line.
DELETE
/drops/{code}/signups/{id}
Release a spot or waitlist place; the next person moves up.
kind — "single" (one kind of thing, so many of them — give spots) or "roster" (different things — give items). Required.
title — Up to 100 characters. Required.
details — What people see: what to bring, price, instructions.
spots / spot_label — Single drops: how many, and what one is called ("Spot", "Shift", "Cake").
items — Rosters: up to 20 of { name, spots or unlimited, limit_per_person, description }.
limit_per_person — Spots one person may take in all (default 1).
host_approves — true: you approve or pass each sign-up. Default: confirmed instantly.
event_at / event_ends_at — When the event starts and finishes (ISO 8601 with offset).
signups_close_at — The deadline for signing up — separate from the event, by its start at the latest.
location — Where it is.
questions — Up to 10 of { type: text | single | multi | yes, label, required, options }.
public_in_city — List it in a city's public feed; leave out to share by link only.
host_name — Name shown as the host (default: your account's name).
Unknown fields are refused, so typos don't pass silently. Edits (PATCH) take title, details, spot_label, host_name, signups_close_at, event_at, event_ends_at (null clears), status ("open" or "closed") and public_in_city.
Sign-ups
{
"id": "Xk2…",
"name": "Sam Lee",
"status": "confirmed", // pending | waitlisted | released | passed
"spot": "Drivers #2",
"spot_number": 2,
"waitlist_position": null, // 1, 2… while waitlisted
"note": "Can bring a trailer",
"answers": { "T-shirt size?": "M" },
"phone": "+61412345678", // only for keys / webhooks that opted in
"created_at": "2026-10-16T02:14:00.000Z"
}
Phone numbers are left out unless the key (or webhook) was made with Include phone numbers ticked. Apps connected with OAuth never get them.
Webhooks
Add an endpoint in Profile → Developers, pick its events, and dibbed POSTs each one as it happens:
signup.created — Someone called dibs: confirmed, pending your approval, or on the waitlist.
signup.promoted — Someone moved up from the waitlist into a spot.
signup.approved — You approved a pending sign-up.
signup.passed — You passed a sign-up to the next person.
signup.released — A spot or waitlist place was given up.
drop.created — A new drop.
drop.full — Every spot is taken.
drop.closed — Closed by you, or its sign-up deadline passed.
Deliveries are signed the Standard Webhooks way, which most libraries, Zapier and Make verify for you. Answer with any 2xx within 10 seconds. Failures are retried with backoff for about a day; use webhook-id to ignore repeats. An endpoint that keeps failing is switched off — turn it back on in Developers. The last 7 days of deliveries are listed there.
import { Webhook } from "standardwebhooks"; // npm i standardwebhooks
const wh = new Webhook(process.env.DIBBED_WEBHOOK_SECRET); // "whsec_…"
const event = wh.verify(rawBody, request.headers); // throws if forged or stale
// Or by hand: HMAC-SHA256 of `${id}.${timestamp}.${rawBody}`, keyed with the
// base64-decoded secret (after "whsec_"), base64-encoded, compared to the
// "v1,…" signature.
Use with Zapier or Make
No code needed: Zapier's Webhooks by Zapier and Make's Webhooks and HTTP modules work with dibbed today. Webhooks start your Zap or scenario when something happens; the API lets it change your drops.
Zapier
New sign-up → a row in Google Sheets
1
In Zapier, create a Zap. Trigger: Webhooks by Zapier → Catch Hook. Copy the webhook URL it gives you.
2
In dibbed → Profile → Developers, add a webhook with that URL and the signup.created event (tick Include phone numbers only if your sheet needs them).
3
Back in Zapier, click Test trigger, then in dibbed press Send test (or call dibs on one of your drops) so Zapier sees an example.
4
Action: Google Sheets → Create Spreadsheet Row. Map columns to data__drop__title, data__signup__name, data__signup__spot, data__signup__status and data__signup__created_at.
5
Turn the Zap on. Every new sign-up adds a row.
Zapier
Post in Slack when a drop fills up, or someone drops out
1
Trigger: Webhooks by Zapier → Catch Hook; add its URL in dibbed with drop.full and signup.released.
2
Add a Filter or Paths step on type (drop.full vs signup.released).
3
Action: Slack → Send Channel Message, e.g. “{{data__drop__title}} is full 🎉” or “{{data__signup__name}} released {{data__signup__spot}} — the next person has moved up.”
Make
New sign-up → anything (Sheets, Airtable, email…)
1
In Make, start a scenario with Webhooks → Custom webhook. Add a webhook, copy its address.
2
In dibbed → Developers, add a webhook with that address and the events you want.
3
In Make, click Redetermine data structure, then press Send test in dibbed so Make learns the fields.
4
Add your next module (Google Sheets → Add a Row, Airtable, Gmail…) and map data.signup.name, data.drop.title and the rest.
Zapier or Make
Create a drop from another tool (a form, a calendar event…)
1
Zapier: Webhooks by Zapier → Custom Request. Make: HTTP → Make a request.
2
Method POST, URL https://dibbed.app/api/v1/drops, header Authorization: Bearer dbk_… (an API key from Developers), and Content-Type: application/json.
3
Body: the JSON from “Create a drop” above, with your tool's fields mapped in — e.g. title from the form, event_at from the calendar event.
4
The response includes the new drop's link — send it on in the next step (email, Slack, a reply to the form).
Zapier shows nested fields with double underscores (data__signup__name); Make shows them as data → signup → name. Both skip checking the signature, which is fine for these — keep the webhook URL private.
Errors and limits
Errors look like {"error": {"code": "invalid_argument", "message": "…"}} with a matching status: 400 bad input, 401 bad or missing key, 403 not your drop, 404 not found, 409 not possible right now (e.g. the spot was just taken), 429 too many requests (see Retry-After).
Limits: 120 requests a minute per key, 30 new drops an hour per account, 10 keys and 10 webhooks per account. Need more? Email support@dibbed.app.