List the roster
/v1/projects/{project}/pass-roster in the Pass Roster API.
curl "https://api.subscriby.net/v1/projects/$PROJECT_ID/pass-roster?plan_id=$PLAN_ID&from=2026-11-01T00:00:00Z" \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN"A page of the members holding at least one date of the span, by name, 25 per page (per_page 1 to 100). The span is eight weeks behind now through eight weeks ahead unless from or to says otherwise: a date is a column when it ends after from and starts before to. plan_id keeps to one plan's dates and holders, as Filter by Plan does; search keeps the members whose name or email contains the text, as the page's search box does.
The gate is project-user:view-any, the members list's own, because the rows are members. email and billing_email appear only for a token that also holds project-user:view, exactly as on the members endpoint.
| Field | Type | Notes |
|---|---|---|
member | object | The member as the members endpoint shows them. |
dates | array | One entry per date held among the columns, in the columns' order: window_id, standing, claim_id, subscription_id, plan_name, from_series, moved_from_window_id and last_reminded_at. |
departures | array | One entry per cancelled column the member was moved off: window_id (the date left), to_window_id (null when the pass was ended instead), reason, moved_at and move_id, the hop pass.holder_moved carries. |
standing is one of the roster's words:
| Standing | Meaning |
|---|---|
in | Admitted to the date. |
queued | In the join queue, admitted when the date opens. |
holds | Holds the date and has not joined the queue yet: the one to nudge. |
missed | Held the date and never joined; the date ran without them. |
ended | The date ended, or access to it was taken away. |
covered | Holds the date through another purchase as well, and that purchase is the one that admits them. |
A member who holds one date through two purchases carries the entry that says most about the day, so a season's covered claim never hides the admitted one.
Under meta, beside the paging, ride span (from and to, ISO 8601), dates (the columns, each with id, plan_id, plan_name, starts_at, ends_at, timezone, local_range and status), moved_to_dates (the dates beyond the span that holders were moved onto, in the same shape) and relocations (every move off a column folded by destination: from_window_id, to_window_id, count and last_moved_at). For whether a date is on sale and how many hold it, read it on the pass windows endpoint by its id.
Requires ability
The token must hold this ability, or the call is refused with 403.
MCP tool
Runs the same action from an agent, behind the same ability.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The project, resolved by the route binder.
uuidQuery Parameters
One pass or series plan of the project only; the dates and the members narrow together, as Filter by Plan does.
uuidKeep the members whose name or email contains this text, up to 100 characters, as the page's search box does.
length <= 100The earliest instant a date may end to be among the columns, ISO 8601; eight weeks before now when omitted.
date-timeThe latest instant a date may start to be among the columns, ISO 8601; eight weeks after now when omitted.
date-timeThe 1-based page to return. A page past the last answers an empty data array with meta.total still filled, so a loop can stop without guessing.
1 <= value1Rows per page, 1 to 100. A higher value clamps to the cap silently. Defaults to 25.
1 <= value <= 10025The column to order by. Defaults to created_at; a column the endpoint does not offer falls back to the default rather than failing.
"created_at"asc or desc. Defaults to desc.
"desc"Value in
- "asc"
- "desc"
Legacy alias of per_page, kept for clients that predate it. per_page wins when both are sent.
1 <= value <= 100Responses
200OKapplication/json
The page of rows, with the span, its dates and the folded moves under meta.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
422Validation failedVALIDATION_FAILEDapplication/json
The payload broke a rule, and error.fields maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with error.message saying why and no fields.
On this endpoint: VALIDATION_FAILED: when plan_id is not a UUID, search is longer than 100 characters, or from or to is not a date.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
How is this guide?
Last updated on
Pass Roster API
The Pass Roster is a project's members against the dates its pass plans sell: who holds which date, where each of them stands on it, and who was moved from where when a date was cancelled.
Pass Windows API
A pass window is one dated stretch of access on a kind: pass plan: the Saturday 09:00–12:00 a buyer of a match-day pass actually gets.