REST API for Australian locums

The Sessional REST API gives you read-only access to the core data you already keep in your account, so you can build whatever sits on top. It is a pull API: your code asks for data when it needs it and gets back clean JSON. There is no marketplace, no booking feed, just your own records: the shifts you have worked, the invoices you have raised, the expenses you have logged, and your profile.

Australian locums and contractors typically use it to:

• Pull invoice totals into a personal cash-flow spreadsheet across every agency and direct workplace
• Feed shift history into a Google Sheet or Notion board for your own records
• Push expense data into bookkeeping software that we do not integrate with natively
• Generate a monthly summary for your accountant or BAS agent without copy-pasting

Keys are created from Dashboard > API:

1. Open the API page from the dashboard sidebar (Pro plan required).
2. Create a key and give it a clear label, for example “Sheets sync” or “Accountant export”, so you can tell your keys apart later.
3. Copy it immediately. The full key is shown once, at creation. We store only a SHA-256 hash, so we cannot show it to you again. If you lose it, revoke the key and create a new one.

Every key begins with the prefix sk_live_ followed by a random string. The prefix makes Sessional keys easy to spot in an environment file or a secrets manager, and the first eight characters stay visible in your key list so you can identify a key without revealing the secret. You can hold up to ten active keys per account.

Send your key in the Authorization header using the Bearer scheme on every request:

GET /api/v1/sessions HTTP/1.1
Host: sessional.com.au
Authorization: Bearer sk_live_your_key_here

A missing header, a malformed key, a revoked key, or a key on an account that is no longer on Pro is rejected with a JSON error and an appropriate status code: 401 for an authentication problem, 403 when the account does not (or no longer) has Pro API access, and 403 if the account is suspended. The response body always explains the reason.

The API allows 100 requests per minute on a sliding 60-second window. The limit is shared across every key on your account, so adding more keys does not raise your ceiling. That is comfortably more than a periodic sync needs.

Successful responses carry X-RateLimit-Limit, X-RateLimit-Remainingand X-RateLimit-Reset headers so you can pace your calls. If you go over, you get a 429 Too Many Requests with a Retry-After: 60 header telling you how long to wait. For a live dashboard, cache responses locally and poll on a sensible interval rather than hammering the API.

Four read-only endpoints are available, all returning JSON:

• GET /api/v1/sessions: your shifts, with optional from, to and status filters. Each row carries the shift date, start and end times, the agreed rate and rate type, status, the workplace name, payment terms and site notes.
• GET /api/v1/invoices: your invoices, filterable by status (DRAFT, ISSUED, ACKNOWLEDGED, PAID, OVERDUE, VOID) and date. Returns the invoice number, subtotal and total, status, issued, due and settled dates, the bank payment reference, the workplace, and the line items.
• GET /api/v1/expenses: your expenses, filterable by category and date. Returns the date, category, description, amount, kilometres logged for cents-per-km claims, and the receipt reference.
• GET /api/v1/profile: your profile, including profession, AHPRA registration number, public slug, default payment terms, your current subscription tier, and counts of your workplaces, shifts, invoices and expenses.

All list endpoints paginate with page (default 1) and per_page (default 25, maximum 100). Every list response wraps the results in a data array alongside a pagination object with the page, page size, total count and total pages.

The API page includes a “try it out” panel: pick an endpoint, set any filters, send the request, and see the live response from your own account. It is the fastest way to learn the response shape and test a query before you write a line of code. The page also lists every filter parameter for each endpoint.

To retire a key, revoke it from the same page. Revocation is immediate and permanent: the record is kept for your audit trail but the key stops working at once, returning 401 on the next request. There is no limit on how many keys you create over time, but keep only the ones you are actively using.