Developer documentation

Build against RemoteRegister

The contract behind learner attendance, identity verification and evidence packs for South African learnerships. Everything below is generated from, or checked against, the code that runs in production.

Preview — read before you integrate

The public endpoints are live and open. The mobile device API is implemented and tested, but device activation is not yet possible in production: it needs Google Play Integrity configuration that is not in place. Machine integrations are implemented, but there is no self-service way to obtain client credentials yet. Each page states its own availability.

At a glance#

Base URL	`https://rr-api.medq.co.zw/api/v1`
Format	JSON over HTTPS. Plain HTTP is redirected (308) to HTTPS.
Contract version	OpenAPI 3.1.0, document version `5.0.0`. Breaking changes are versioned in the path (`/api/v1`).
Staging	`https://rr-staging.medq.co.zw` — access-controlled; integrations may run in simulator or sandbox mode.
Hosting	Hetzner hel1, Finland (EU). Personal information is processed under POPIA s72 safeguards; see the Trust centre.

 Choose an API surface#
   Public endpoints
 No authentication: platform facts, status feed, lead and newsletter forms, record verification.
   Mobile device API
 Android + USB fingerprint scanner: pairing, Ed25519-signed requests, enrolment, matching, offline sync.
   Machine integrations
 OAuth 2.0 client credentials for LMS connectors, edge sync and webhooks (preview).
   Webhooks
 HMAC-SHA256 signed event delivery with retries and a dead-letter list.
  
 Conventions#
  
Responses carry a success boolean. Errors are
{ "success": false, "error": "CODE", "message": "…" } with a stable machine-readable
      code; the device API also returns a requestId you can quote to support.
      The OAuth token endpoint uses the RFC 6749 shape { "error", "error_description" } instead.
 Timestamps are ISO 8601; the device API also accepts epoch seconds or milliseconds in the signing header.
 Mutating device calls are idempotent: send a stable clientRequestId and retry safely.
 See Errors & rate limits for every code and the limits that apply.
 
 Machine-readable contract#
  Live OpenAPI document served by the API.
 Snapshot this site was built from (29 operations).
 Postman collection (live). Its token request targets /api/v1/auth/token once the next API release is deployed.
 
 What is documented#
 
The OpenAPI document currently describes the public and mobile device
surfaces. The machine-accessible routes (integrations, edge sync, webhooks) are documented from the
    access policy in code on the authentication page, without
    request schemas yet. The document also declares 10 further tags
    (OAuth & Access, Learner Registry & POPIA, Biometrics & Liveness, Attendance & Edge Sync, Verification & Overrides, Deterministic Stipend Engine, Banking & Direct PayShap, Webhooks, LMS Connectors, Tax & Regulatory Exports) that have no operations described; treat them as planned,
    not as a contract. The authenticated web application's own endpoints are not a public API.