Every claim on this page has a file path.
Event Schedule is open source under the Attribution Assurance License. Selfhost the whole thing on your own server, or drive the hosted version through the REST API. Either way, the code you are trusting is code you can read.
eventschedule/eventschedule
PublicAttribution Assurance License
OSI-approved, adapted from the BSD licence. Permissive, not copyleft. One condition: keep the credit.
Twenty-four authenticated endpoints
Schedules, sub-schedules, events, categories, sales, and read access to attendee feedback.
Laravel 11 on PHP 8.2
MySQL for storage, Vue for the front end, Vite for the build. Nothing exotic to stand up.
Nothing on this page is behind a support ticket. If a sentence below makes a claim, the path next to it is where you check it.
The licence
Permissive, with one condition: keep the credit.
The Attribution Assurance License is OSI-approved and adapted from the BSD licence. It fits on one screen, which is the best argument for reading it instead of a summary.
Use it and change it
Redistribution and use in source and binary forms, with or without modification, are permitted. Commercially too. Fork it, strip out what you do not need, run it for a client.
Carry the notice
Redistributed source has to display the licence text. A binary redistribution carries it in the documentation and shows the author name, "Event Schedule" and the project URL when the program launches.
Not MIT, not AGPL
Permissive rather than copyleft, so your changes are yours to keep private. Also not MIT, which asks for no attribution display. If that distinction matters to a legal team, hand them the file.
The package manifest declares it as AAL, and the licence is listed at opensource.org. None of this is legal advice, and none of it is a substitute for reading the file.
The diff
Selfhost, and the plan tiers disappear.
This is not a marketing promise, it is two early returns in one model. isPro() and isEnterprise() both return true the moment the app is not running hosted, so a selfhosted install resolves to the top tier and nothing on it sits behind a paywall.
app/Models/Role.php
Selling tickets with Stripe payouts
Free, up to 25 paid tickets a month
Included, no cap
QR check-in, waitlists, promo codes and passes
Pro, five dollars a month
Included
REST API and webhooks
Pro
Included
Custom domain
Enterprise
The install is your domain
Team members on one schedule
Up to five, on Enterprise
No cap
Newsletter sends
10, 100 or 1,000 recipients a month
No monthly cap
The "Powered by" credit
Removed on Pro
Already gone
Import from a URL or a city search
Not available
Selfhost only
AI parsing and translation
Our key, with a daily cap per plan
Your own Gemini or OpenAI key, no daily cap
The line that goes the other way
YoursYou take on the server, the database, the backups, the TLS certificate, the cron entry and the upgrade window. On eventschedule.com those are ours, and the bill is five dollars a month, or fifteen for the two Enterprise lines above. Selfhosting is not free, it is differently priced, and pretending otherwise would be the first false claim on this page.
The API
Twenty-four endpoints, one header.
Send an X-API-Key header, get JSON back. Here is the whole surface, transcribed from the route file rather than described.
| Method | Path | Resource | What it does |
|---|---|---|---|
| GET | /api/schedules | Every schedule the key can reach | |
| GET | /api/schedules/{subdomain} | One schedule, by subdomain | |
| POST | /api/schedules | Create a schedule | |
| PUT | /api/schedules/{subdomain} | Update it | |
| DELETE | /api/schedules/{subdomain} | Delete it | |
| GET | /api/schedules/{subdomain}/groups | List the sub-schedules | |
| POST | /api/schedules/{subdomain}/groups | Create one | |
| PUT | /api/schedules/{subdomain}/groups/{group_id} | Rename or recolour it | |
| DELETE | /api/schedules/{subdomain}/groups/{group_id} | Delete it | |
| GET | /api/events | List events, paginated | |
| GET | /api/events/{id} | One event | |
| POST | /api/events/{subdomain} | Create an event on a schedule | |
| PUT | /api/events/{id} | Update it | |
| DELETE | /api/events/{id} | Delete it | |
| POST | /api/events/flyer/{event_id} | Attach a flyer image | |
| GET | /api/categories | The system category list | |
| GET | /api/categories/{subdomain} | The effective list for one schedule | |
| GET | /api/sales | List ticket sales | |
| GET | /api/sales/{id} | One sale | |
| POST | /api/sales | Record a sale | |
| PUT | /api/sales/{id} | Update it | |
| DELETE | /api/sales/{id} | Delete it | |
| GET | /api/feedback | Post-event ratings and comments | |
| GET | /api/fan-content | Fan photos, video and comments |
Three routes sit outside the table because they are how you get a key in the first place, so they take none themselves: send a verification code, register, log in. routes/api.php
The key
Generate a key in your account settings and send it in the header. Only a prefix is indexed for the lookup and the key itself is verified against a bcrypt hash, so the database never holds the usable value. A key can carry an expiry date.
The limits
Three hundred reads a minute per IP, thirty writes a minute per IP. Ten failed attempts with the same key value block that key for fifteen minutes. Creating an event carries its own tighter throttle of thirty a minute.
The gate
On eventschedule.com the API is a Pro feature at five dollars a month, and the check runs on reads too: a single-resource route answers 403, a list route filters non-Pro schedules out. On a selfhost the same check passes by default.
The spec
The surface is published, not described.
Four files, served straight out of the public directory. Point a client generator or an agent at them and skip the prose entirely.
Sixteen paths, twenty-six operations, request and response schemas.
The product in one page: schedule types, auth, plans, rate limits.
The same, expanded, for a model with room to read.
Four named flows with their steps written out: register and set up, create an event with tickets, sell tickets, manage a schedule.
Agents get their own page, with the flows written out. Event Schedule for AI agents
The install
Three ways in.
Pick by how much of the stack you want to touch.
Softaculous
If your host runs cPanel with Softaculous, Event Schedule is in the installer library. Database, files and permissions are handled for you.
Open the listingDocker
Images and a Compose file live in their own repository, so the application repo stays free of deployment plumbing. On Alpine images the web user is the numeric UID 82, not www-data.
eventschedule/dockerfilesFive steps
Database, files, permissions, environment, cron. The guide names the PHP extensions, the ownership commands and the things that usually go wrong first.
Installation guideThe PHP version and the extension list are not a recommendation, they are the requirements block of the package manifest. composer.json
The exit
The proof of no lock-in is the door.
Every vendor says you are not locked in. The test is whether the way out is a feature you can use today, on the free plan, without asking.
Take the data
Backup and restore exports a schedule with its events, sub-schedules, ticket types, sales and appointment types, optionally with the images, and imports the same archive into another install.
Take the code
What is on GitHub is the product, not a trimmed demo of it. eventschedule.com runs this application, which is why a selfhost gets the features rather than a subset of them.
Update when you choose
A selfhosted install can pull the next release from the admin area, or you can ignore the button and deploy from the tag yourself. Nobody moves your version for you.
Underneath all of it is a MySQL database on hardware you chose, which is the part no export format can replace.
Also in the tree
Things you only find by reading.
Webhooks, signed
Twelve event types, from sale.created through ticket.scanned to feedback.submitted. Each delivery carries an HMAC-SHA256 signature computed over the exact body, so you can verify it came from your install and not from somebody who guessed your endpoint.
Three attempts, backing off thirty then sixty seconds. The secret is stored encrypted. Webhook reference
Twelve interface languages
Arabic, German, English, Spanish, Estonian, French, Hebrew, Italian, Dutch, Portuguese, Romanian and Russian, with right-to-left handled properly. The language list is one array in the config, so adding a thirteenth is a translation job, not a code change.
Its own audit log
Every schedule keeps a searchable log of what changed, filterable by date and category. A commit log for your calendar, in other words, and it is not a paid add-on.
Federation, off by default
A selfhosted install can share its public events with the eventschedule.com listings, and every listing links back to the event on your own site. It is off until an administrator turns it on, and any individual schedule can opt out again.
It is a setting on the instance, not a plan tier. eventschedule.com is the receiving end and runs a moderation queue instead.
Bring your own everything
SMTP, Stripe, Google or Microsoft calendar credentials, an AI key, a push app id. Each one is an environment variable you set, or leave unset, and the feature that needs it stays out of the way until you do.
No third-party calls you did not ask for
Front-end libraries are vendored into the repository rather than pulled from a CDN, and the interface font is served from your own install. The third-party scripts that exist at all, analytics and web push, each sit behind an environment variable that ships empty, so a fresh install calls nobody.
Outbound URL fetches go through a guard that refuses private and link-local addresses, inline scripts carry a nonce, and user markdown is purified before it renders. The one font request the app can still make is a guest-page typeface a schedule owner picked by name.
Key features
Free forever. Upgrade when you're ready.
Zero platform fees on ticket sales. You only pay Stripe's processing fee.
See all plansFrequently asked questions
What developers ask before they clone it.
What licence is Event Schedule under?
The Attribution Assurance License, an OSI-approved licence adapted from the BSD licence. composer.json declares it as AAL and the full text is the LICENSE file in the repository root. It is permissive rather than copyleft: use, modify and redistribute in source or binary form, provided the licence text travels with the code, and provided a binary redistribution displays the author name, "Event Schedule" and the project URL when the program launches. It is short. Read it rather than taking a paragraph on a marketing page for it.
Do I get every feature if I selfhost?
Yes. Role::isPro() and Role::isEnterprise() both return true the moment config('app.hosted') is false, so ticketing, the REST API, webhooks, custom fields, event graphics, custom domains, unlimited team members and uncapped newsletter sends are simply on. Two things you supply yourself: an AI key if you want the parsing and translation features, and your own Stripe account for payouts.
Is the REST API free on eventschedule.com?
No. API access is a Pro feature at five dollars a month, and the check runs on reads as well as writes: under app/Http/Controllers/Api a single-resource route answers 403 for a free schedule, and a list route filters non-Pro schedules out with the wherePro() scope. On a selfhosted install it is on by default, because a selfhost resolves to the top tier.
What are the API rate limits?
Three hundred GET requests a minute per IP and thirty writes a minute per IP, counted in ApiAuthentication. Ten failed attempts with the same key value block that key for fifteen minutes, and a key can carry an expiry date after which it stops working. Creating an event has a second, tighter throttle of thirty a minute.
How do I install it on my own server?
Three ways. Softaculous does a one-click install on a cPanel host, the eventschedule/dockerfiles repository has images and a Compose file, or you install by hand: PHP 8.2 or newer, MySQL or MariaDB, Apache or Nginx with rewrites, HTTPS, and one cron entry running the scheduler every minute. The installation guide walks through all of it.
Can I take my data out again?
Yes, on every plan. Backup and restore exports a schedule with its events, sub-schedules, ticket types, sales and appointment types, optionally with its images, and imports the same archive into another install. That is the honest test of no lock-in, and it is not behind a paywall.
Do you accept contributions?
Issues and pull requests are open on GitHub. Read the code first: it is a fairly ordinary Laravel 11 application with Vue on the front end, and the parts most people want to change - views, translations, integrations - are where you would expect to find them.
HEAD
The next entry is yours.
Clone it and run it on your own hardware, or take a subdomain here and skip the server entirely. Publishing a calendar is free forever either way.
Clone it, read it, open an issue. No credit card, and no account needed to look.