Repromatronic API for workshops and resellers

How it works

Plans

Monthly price excluding VAT. Files are paid with the account's credits at the same price as in the panel. No lock-in: cancel from the panel.

Test keys (rp_test_) are included in every plan: they never create orders or spend credits.

Authentication

Every request carries an Authorization: Bearer header with a key created in Panel › API. rp_live_ keys create real orders; rp_test_ keys validate everything but create nothing. Treat the key as a password and revoke it in the panel if it leaks.

Authorization: Bearer rp_live_0123456789abcdef0123456789abcdef

Quick start

# 1) Upload permission / Permiso de subida
curl -X POST https://app.repromatronic.es/api/v1/uploads \
  -H "Authorization: Bearer rp_live_XXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{"filename":"original.bin","size":1048576}'
# → { "file_path": "...", "upload_url": "https://...", "method": "PUT" }

curl -X PUT "<upload_url>" -H "Content-Type: application/octet-stream" \
  -H "x-upsert: false" --data-binary @original.bin

# 2) Create the order / Crear el pedido
curl -X POST https://app.repromatronic.es/api/v1/orders \
  -H "Authorization: Bearer rp_live_XXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "file_path": "<file_path>",
    "vehicle_category_id": "<id from /services>",
    "plate": "1234ABC", "make": "Audi", "model": "A4", "engine": "2.0 TDI 150 CV",
    "year": 2019, "power_hp": 150, "km": 85000, "gearbox": "manual",
    "tool": "KESS3", "ecu": "Bosch EDC17C74",
    "services": ["<service_id>"], "external_ref": "OT-2026-0412"
  }'
# → 201 { "order": { "id": "…", "status": "queued", "credits": 2, … } }

# 3) When order.completed arrives / Cuando llega order.completed
curl https://app.repromatronic.es/api/v1/orders/<id>/file \
  -H "Authorization: Bearer rp_live_XXXXXXXX"
# → { "url": "https://…", "filename": "…", "expires_in": 3600 }

Endpoint reference

Base: https://app.repromatronic.es/api/v1 · All responses are JSON · Dates in ISO 8601 (UTC)

POST /orders fields

Order states

Webhooks

Register an https URL and the events you want (or none to receive all). Every delivery is a signed JSON POST. Reply 2xx within 8 seconds; otherwise we retry up to 7 times with growing delays (1 min → 12 h).

Events

Verifying the signature

Header X-Repromatronic-Signature: t=<unix>,v1=<hex>. v1 is the HMAC-SHA256 of the string `${t}.${body}` using the webhook secret without the rpwh_ prefix. Reject signatures older than 5 minutes.

// Node.js
const crypto = require("crypto");
function verify(secret, header, rawBody) {
  const m = /t=(\d+),v1=([0-9a-f]+)/.exec(header || "");
  if (!m) return false;
  if (Math.abs(Date.now() / 1000 - Number(m[1])) > 300) return false;
  const expected = crypto.createHmac("sha256", secret.replace(/^rpwh_/, ""))
    .update(`${m[1]}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(m[2], "hex"));
}

<?php // PHP
function verify(string $secret, string $header, string $rawBody): bool {
  if (!preg_match('/t=(\d+),v1=([0-9a-f]+)/', $header, $m)) return false;
  if (abs(time() - (int)$m[1]) > 300) return false;
  $expected = hash_hmac('sha256', $m[1] . '.' . $rawBody, preg_replace('/^rpwh_/', '', $secret));
  return hash_equals($expected, $m[2]);
}

{
  "id": "evt_9f2c…",
  "type": "order.completed",
  "created_at": "2026-10-11T16:20:00.000Z",
  "data": { "order": { "id": "…", "reference": "A1B2C3D4", "status": "completed", "external_ref": "OT-2026-0412", "links": { "file": "/api/v1/orders/…/file" } } }
}

Errors and limits

Errors return { error: { code, message, fields? } }. Limits: 120 calls per minute per key, plus the plan's daily calls and monthly files. Exceeding them returns 429 (with retry_after) or 402 (plan quota or insufficient credits).

Test mode

With an rp_test_ key every read works on your real data, and writes (orders, messages, revisions, cancellations) are validated and return the same shape as production without creating anything or spending credits. To test webhook delivery use POST /webhooks/{id}/test.

FAQ