REST API for Australian locums

The Sessional REST API gives you read-only access to the core data you already keep in your account, so you can build whatever sits on top. It is a pull API: your code asks for data when it needs it and gets back JSON containing your own records: the shifts you have recorded, the invoices you have raised, the expenses you have logged, and your profile.

You could write your own code to:

• Pull invoice totals into a personal cash-flow spreadsheet across every agency and direct workplace
• Feed shift history into a Google Sheet or Notion board for your own records
• Push expense data into bookkeeping software that we do not integrate with natively
• Generate a monthly summary for your accountant or BAS agent without copy-pasting

Keys are created from Integrations > REST API:

1. Open Integrations in the dashboard (Pro plan required for API access).
2. Enter a clear Key label, for example “Sheets sync” or “Accountant export”, then select Generate key.
3. Copy it immediately. The full key is shown once, at creation. We store only a SHA-256 hash, so we cannot show it to you again. If you lose it, revoke the key and create a new one.

Every key begins with the prefix sk_live_ followed by a random string. The prefix makes Sessional keys easy to spot in an environment file or a secrets manager, and the first eight characters stay visible in your key list. Those characters are the same prefix for every key, so use the label to tell keys apart. You can hold up to ten active keys per account.

Send your key in the Authorization header using the Bearer scheme on every request:

GET /api/v1/sessions HTTP/1.1
Host: sessional.com.au
Authorization: Bearer sk_live_your_key_here

A missing header, a malformed key, a revoked key, or a key on an account that is no longer on Pro is rejected with a JSON error and an appropriate status code: 401 for an authentication problem, 403 when the account does not have Pro API access, and 403 if the account is suspended. These JSON responses include an error message.

The API allows 100 requests per minute in a 60-second window. The limit is shared across every key on your account, so adding more keys does not raise your ceiling. Check the response headers when scheduling your requests.

Successful responses carry X-RateLimit-Limit, X-RateLimit-Remainingand X-RateLimit-Reset headers so you can pace your calls. If you go over, you get a 429 Too Many Requests with a Retry-After: 60 header telling you how long to wait. For a live dashboard, cache responses locally and poll on a sensible interval rather than hammering the API.

Four read-only endpoints are available, all returning JSON:

• GET /api/v1/sessions: your shifts, with optional from, to and status filters. Each row carries the shift date, start and end times, the agreed rate and rate type, status, the workplace name, payment terms and site notes.
• GET /api/v1/invoices: your invoices, filterable by status (DRAFT, ISSUED, ACKNOWLEDGED, PAID, OVERDUE, VOID, DISPUTED) and issue date. Returns the invoice number, subtotal and total, status, issued, due and settled dates, the bank payment reference, the workplace, and the line items.
• GET /api/v1/expenses: your expenses, filterable by category and date. Returns the date, category, description, amount, kilometres logged for mileage entries, and the receipt reference.
• GET /api/v1/profile: your profile, including profession, AHPRA registration number, public slug, default payment terms, subscription information, and counts of your workplaces, shifts, invoices and expenses.

All list endpoints paginate with page (default 1) and per_page (default 25, maximum 100). Every list response wraps the results in a data array alongside a pagination object with the page, page size, total count and total pages.

Use your own HTTP client or script to request an endpoint with the Bearer header above. Start with one page of results and inspect the response before building a larger export. Check dates, statuses and missing values against the records in your dashboard.

To retire a key, select Revoke in Integrations > REST API and confirm. The record is kept for your audit trail but the key stops working at once, returning 401 on the next request. There is no limit on how many keys you create over time, but keep only the ones you are actively using.

On Pro, API docs in the dashboard menu opens the reference at /dashboard/api-docs. It lists each endpoint, its parameters and the rate-limit headers, with example responses.

The Try it section lets you test a request without writing code. Paste one of your API keys, choose an endpoint and select Send request; the JSON response appears below. The page uses the key only for that request from your browser and does not save it. Requests sent this way count towards the same rate limit as your scripts.