get https://api.poap.tech/actions/scan/
This endpoint returns a list of POAPs held by an address and the event details, token ID, chain, and owner address for each. A 400 error is returned if the address does not hold any POAPs.
If you already know the event ID, you can use GET /actions/scan/{address}/{eventID} to check if an address holds that POAP.