Skip to main content

API access (Automate)

The Automate tier includes full API access for read and write operations. Use the ReFresh API to build custom integrations, automate workflows, and sync data between ReFresh and external systems.

Written by Harrison Kennedy

API access is included on the Automate tier. Documentation is provided under NDA. Use API access for custom integrations beyond the standard supported list.

(Confirm internally: customer-facing API access provisioning UI and developer documentation distribution flow.)

  • Available on the Automate tier only

  • Custom integrations beyond the standard supported tools

  • Documentation provided under NDA

  • Provisioned by your ReFresh account contact during onboarding (or on request afterwards)

  • OAuth 2.0 authentication

When to use API access

Use the API when:

  • Your existing toolchain is not in the standard ReFresh integrations list and the Request Integration workflow is too slow for your timeline

  • You need to push data into ReFresh from an internal system (custom HRIS, custom incident reporting tool)

  • You need to pull ReFresh data into a custom dashboard or reporting tool

  • You are building an integration with a tool ReFresh has not yet built native support for

For most needs, a standard integration (Slack, Salesforce, BambooHR, etc.) is faster and easier.

Provisioning

API access is provisioned by your ReFresh account contact. The flow:

  1. Contact your ReFresh account contact and request API access

  2. Sign the NDA covering API documentation

  3. Receive your API credentials (client ID and secret)

  4. Receive the API documentation

  5. Build and test your integration

  6. Deploy

API authentication uses OAuth 2.0 (client credentials flow for server-to-server, or authorisation code flow for user-facing apps).

What the API exposes

The API exposes the same domain entities you see in the UI:

  • Risks, risk assessments, controls, evidence

  • Incidents, investigations, consultations

  • Tasks, reviews, audits

  • Documents, policies

  • Users, groups, org chart

Specific endpoints, rate limits, and field models are detailed in the API documentation.

Rate limits and best practices

Rate limits are documented in the API documentation. As a general guide:

  • Use webhooks where possible rather than polling

  • Cache reference data (frameworks, controls, scenarios) on your side

  • Batch operations where the API supports it

  • Handle 429 (rate limited) responses gracefully

Related articles

  • Subscription tiers and what is included (8.9)

  • Connecting an HRIS (2.5)

  • Working with your existing WHS system (8.7)

Related Articles
Setting up SSO
Working with your existing WHS system
Subscription tiers and what is included
Did this answer your question?