PAT Control API

Read and write your organisation's clients, sites, appliances and test results, and read instruments and invoices.

Authentication. Create a key in Settings → API & webhooks and send it as Authorization: Bearer pat_…. Each key belongs to one organisation and has scopes; a write scope includes read. Changes made with a key are recorded in the audit log against the person who created it.

Pagination. Lists return data, has_more and next_cursor, oldest first. Pass cursor to get the next page. To sync changes, poll with updated_since (or recorded_since for tests), or subscribe to webhooks.

Rate limits. 120 requests a minute per key. X-RateLimit-Remaining and X-RateLimit-Reset are on every response; a 429 carries Retry-After.

Test records are legal evidence: they can be recorded and voided (with a reason) but never edited or deleted.

Webhooks. Endpoints receive a POST with a JSON event for: client.created, appliance.created, appliance.updated, test.recorded, test.voided, invoice.issued, invoice.paid. Verify the X-Webhook-Signature header: t=<unix time>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" using your endpoint secret>; reject timestamps more than 5 minutes old. Reply with any 2xx within 10 seconds; failures are retried for about 2 days.

curl https://<your address>/api/v1/appliances?due_before=2026-12-31 \
  -H "Authorization: Bearer pat_…"

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody: the request body exactly as received (a string), before JSON parsing.
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const age = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (!parts.t || !parts.v1 || age > 300) return false;
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}