Dispatch bookings
Send medical/D&A referrals in one API call. Get a bookingRef back instantly.
Daily catalogue sync
Fetch available test types so your appointment UI always reflects current offerings.
HMAC webhooks
Receive completion results via signed webhook. Includes your clientRef for easy matching.
Bearer token auth
Simple API key authentication. Keys are SHA-256 hashed - never stored in plaintext.
Authentication
All endpoints require a Bearer token in the Authorization header. Request access from your account settings and we'll issue a key within 1 business day.
Authorization: Bearer rcsk_your_api_key_hereKeys are prefixed with rcsk_ and scoped per organisation. Contact support@refchecks.co to rotate or revoke.
Endpoints
Base URL: https://www.refchecks.co/api/v1
Outbound Webhooks
When a booking is completed, RefChecks fires a signed POST to your configured webhook endpoint.
Signature verification
import crypto from 'crypto'
function verifySignature(rawBody: string, signature: string, secret: string): boolean {
const expected = 'sha256=' + crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex')
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
)
}
// In your webhook handler:
const signature = req.headers['x-refchecks-signature']
const isValid = verifySignature(req.rawBody, signature, YOUR_WEBHOOK_SECRET)
if (!isValid) return res.status(401).send('Invalid signature')Payload
{
"event": "booking.completed",
"bookingRef": "19f7b353-8857-498e-aff3-ffbe908bdcaf",
"clientRef": "your-appointment-uuid",
"tenantId": "your-tenant-uuid",
"workerName": "Jane Smith",
"workerEmail": "jane.smith@example.com",
"testTypeCode": "URINE_DA_AS4308",
"status": "completed",
"result": "negative",
"scheduledAt": "2026-04-15T09:00:00+10:00",
"completedAt": "2026-04-15T10:15:00+10:00",
"clinicName": "WorkHealthy Kalgoorlie",
"timestamp": "2026-04-15T10:16:02.341Z"
}