Developer Docs
Wire FSMA 204 traceability into any supply-chain system. Preflight supplier data, surface gaps, fix missing KDEs, and commit records to an FDA-oriented sortable export workflow. Your operation remains responsible for compliance.
https://regengine.co/api/v1X-RegEngine-API-Key: rge_live_.../webhooks/ingestIngest traceability records with CTE/KDE data. Needs a signed body and an Idempotency-Key. Each record is hash-chained so you can detect tampering between ingest and export.
/recordsQuery canonical records, filtered by lot code, event type, source system, status, and date range. Pages with limit and offset.
/records/{event_id}One record with its provenance, rule evaluations, exception cases, and amendment chain.
/fda/exportExport FDA-oriented sortable records for a lot code as a package, CSV, or PDF. Needs tenant_id, the fda.export scope, and an active subscription.
/fda/trace/{tlc}Trace the transformation graph around a traceability lot code: upstream sources and downstream products. Needs tenant_id and the fda.read scope.
Send a traceability event to the POST /webhooks/ingest endpoint. Set REGENGINE_API_KEY and REGENGINE_SIGNING_SECRET to the values RegEngine issues to you.
This call writes a permanent record and can be billed. Use a test workspace and keep the TEST- lot prefix. To check your key first with a read, follow the Quickstart.
NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
TODAY=$(date -u +%Y-%m-%d)
BODY=$(cat <<EOF
{
"source": "<your source system id>",
"events": [
{
"cte_type": "receiving",
"traceability_lot_code": "<the lot code you assigned>",
"product_description": "<product name>",
"quantity": "<number greater than 0>",
"unit_of_measure": "<cases | lbs | kg | pallets | each>",
"location_name": "<your facility name>",
"timestamp": "$NOW",
"kdes": {
"receive_date": "$TODAY",
"receiving_location": "<where the lot arrived>",
"immediate_previous_source": "<who sent it to you>",
"reference_document": "<your ASN or receipt id>",
"tlc_source_reference": "<the lot reference your supplier gave you>"
}
}
]
}
EOF
)
# Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$REGENGINE_SIGNING_SECRET" -hex | sed 's/^.* //')"
curl -X POST https://regengine.co/api/v1/webhooks/ingest \
-H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \
-H "X-Webhook-Signature: $SIGNATURE" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
--data-binary "$BODY"import hashlib
import hmac
import json
import os
import uuid
from datetime import datetime, timezone
import requests
now = datetime.now(timezone.utc)
payload = {
"source": "<your source system id>",
"events": [
{
"cte_type": "receiving",
"traceability_lot_code": "<the lot code you assigned>",
"product_description": "<product name>",
"quantity": "<number greater than 0>",
"unit_of_measure": "<cases | lbs | kg | pallets | each>",
"location_name": "<your facility name>",
"timestamp": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
"kdes": {
"receive_date": now.strftime("%Y-%m-%d"),
"receiving_location": "<where the lot arrived>",
"immediate_previous_source": "<who sent it to you>",
"reference_document": "<your ASN or receipt id>",
"tlc_source_reference": "<the lot reference your supplier gave you>"
}
}
]
}
# Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
body = json.dumps(payload).encode()
signature = "sha256=" + hmac.new(
os.environ["REGENGINE_SIGNING_SECRET"].encode(), body, hashlib.sha256
).hexdigest()
resp = requests.post(
"https://regengine.co/api/v1/webhooks/ingest",
headers={
"X-RegEngine-API-Key": os.environ["REGENGINE_API_KEY"],
"X-Webhook-Signature": signature,
"Idempotency-Key": str(uuid.uuid4()),
"Content-Type": "application/json",
},
data=body,
)
print(resp.status_code, resp.json())import { createHmac, randomUUID } from "node:crypto";
const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
const payload = {
"source": "<your source system id>",
"events": [
{
"cte_type": "receiving",
"traceability_lot_code": "<the lot code you assigned>",
"product_description": "<product name>",
"quantity": "<number greater than 0>",
"unit_of_measure": "<cases | lbs | kg | pallets | each>",
"location_name": "<your facility name>",
"timestamp": now,
"kdes": {
"receive_date": now.slice(0, 10),
"receiving_location": "<where the lot arrived>",
"immediate_previous_source": "<who sent it to you>",
"reference_document": "<your ASN or receipt id>",
"tlc_source_reference": "<the lot reference your supplier gave you>"
}
}
]
};
// Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
const body = JSON.stringify(payload);
const signature =
"sha256=" + createHmac("sha256", process.env.REGENGINE_SIGNING_SECRET).update(body).digest("hex");
const resp = await fetch("https://regengine.co/api/v1/webhooks/ingest", {
method: "POST",
headers: {
"X-RegEngine-API-Key": process.env.REGENGINE_API_KEY,
"X-Webhook-Signature": signature,
"Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body,
});
console.log(resp.status, await resp.json());{
"accepted": 1,
"rejected": 0,
"total": 1,
"events": [
{
"traceability_lot_code": "<the lot code you sent>",
"cte_type": "receiving",
"status": "accepted",
"event_id": "<event UUID>",
"sha256_hash": "<event hash>",
"chain_hash": "<chain hash>",
"errors": []
}
],
"ingestion_timestamp": "<server time, ISO 8601>",
"ingestion_run_id": null
}Developer access is request-gated. Tell us about your integration and we'll provision your API key.