List watchlist entries
/watchlistReturns your watchlist entries, newest first. Expired entries aren't returned.
Scope: watchlist:read · Plan: Pro and Enterprise in live mode; every plan in test mode.
Send Authorization: Bearer <token> on every request. The token is one of:
| Prefix | What it is | Where it may be used |
|---|---|---|
agoo_sk_live_ | Secret key, live mode | Your servers only |
agoo_sk_test_ | Secret key, test mode | Your servers only |
agoo_pk_live_ | Publishable key, live mode | Browsers and apps: create pre-registrations and bookings, read public booking types (with their intake questions) and their free slots, read the visit types open for pre-registration with their public forms. Never lists people. |
agoo_pk_test_ | Publishable key, test mode | As above, in test mode |
Admins create keys in Console → Developers → API keys and choose each key's scopes. A key is shown once. Never put a secret key in a URL, a browser or a mobile app.
In: header
Scope: watchlist:read
Query Parameters
How many items to return, from 1 to 100.
1 <= value <= 10025The next_cursor from the previous page. Leave it out for the first page.
length <= 512Matches the start of any word in the entry's name or company. Case-insensitive.
2 <= length <= 100Only entries that apply at this site (including entries for all sites).
^site_[0-7][0-9a-hjkmnp-tv-z]{25}$"site_01kjpt3yw0fz0v414608h9x65s"Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/watchlist?limit=25"{ "data": [ { "id": "watch_01m0fqhdr0e31ray1qxa2x5vtk", "name": "Kojo Badu", "phone": null, "has_id_number": true, "reason": "Former employee. Site access withdrawn on 20 August.", "site_ids": [], "expires_at": null, "created_by": "person_01kjsexjt0e9rt8r69a60jzx03", "created_at": "2026-08-20T14:00:00Z" } ], "next_cursor": null, "has_more": false}Withdraw a consent POST
Records that the person withdrew their consent. New capture of that evidence stops straight away, and a method that needs it is no longer offered to them (they use another method, or the kiosk's fallback). For face, every kiosk is told to delete the person's template. Evidence already recorded is kept until its retention date. Acknowledgements can't be withdrawn (`invalid_state`): your organisation requires that evidence. A consent already withdrawn is returned as it is. **Scope:** `attendance:manage` · **Plan:** Pro and Enterprise in live mode; every plan in test mode.
Add a watchlist entry POST
Adds a person to your watchlist. Give a name and a phone number, an ID number or both. When a visit is created for, or someone checks in as, a person matching an entry (on name, allowing for spelling differences, phone number or ID number), Agoo holds the visit, alerts your security team silently and fires `watchlist.matched`. The visitor, the host and the kiosk aren't told why. Every watchlist read and change is in the audit trail. Leave `site_ids` empty to watch for the person at every site. **Scope:** `watchlist:write` · **Plan:** Pro and Enterprise in live mode; every plan in test mode.