What the API does
Everything is under /api/v1 on app.refrendo.com.au, with a key sent as a bearer token. Business and above An administrator creates keys on the Developers page. Each key is shown once and stored only as a hash.
- Upload a PDF. It is checked for malware and unsafe content in a queue, and you poll for it to be ready.
- Send a request, from a template or from an uploaded document, with the people, the steps and their fields.
- Follow it, request by request or as a list filtered by state.
- Retract it, with a reason the recipients see.
- Download the results: the original, the signed PDF and the completion certificate. Every download is recorded in the request’s audit trail.
Send from a template
The quickest path. Name who fills each role, give the details the template asks for, and attach any supporting PDFs you uploaded first. The details are written onto the document, used in the title, and decide which steps apply, so a purchase order sent this way follows the same conditional route as one sent from the app.
curl -X POST https://app.refrendo.com.au/api/v1/requests \
-H "Authorization: Bearer rfd_…" \
-H "content-type: application/json" \
-d '{
"templateId": "01J…",
"roles": { "supplier": { "name": "Hannah Price", "email": "hannah@supplier.example" } },
"details": { "po": "PO-1187", "total": "64000.00", "newSupplier": true },
"supportingDocuments": { "quote": "01J…" }
}'Access codes and witnesses can be asked for in the request, the same as in the app Business and above. Errors come back as JSON with a code and a plain message, including which plan limit or feature a refused request needs.
Webhooks
Add an endpoint on the Developers page and choose the events it hears about. Business and above Refrendo posts a small JSON body with identifiers only, and you fetch the request for its details:
{
"id": "01J…",
"type": "request.completed",
"createdAt": "2026-10-23T09:30:00.000Z",
"data": { "requestId": "01J…" }
}- Request events: sent, revised, resent, completed, retracted, expired, a deadline moved, reminders changed.
- Recipient events: approved, rejected, asked for changes, finished their turn, declined, reviewed, passed their turn on.
- Signed. Each delivery carries an HMAC-SHA256 signature of its timestamp and body, keyed with the endpoint’s secret, so you can check it came from Refrendo and reject anything older than five minutes.
- Retried. A delivery that doesn’t get a 2xx answer within 10 seconds is retried with increasing gaps, up to eight times. The event’s id stays the same, so you can de-duplicate on it.
An organisation can have up to 10 endpoints. Each must use HTTPS and a public address. An endpoint that fails 20 times in a row is switched off, and whoever created it is emailed.
Built to be called from a system
Keys belong to a person and stop working when they leave. Requests are refused, not half-sent, when something is missing: a role without a person, a required detail, a field off the page. Every call is rate-limited per key, and every upload goes through the same malware checks as one from the app.