Submit via API
Sponsors and CROs can send submissions straight from their own systems. Create a submission, upload the documents, submit, and get a reference number back. The committee receives it exactly as if it came through the submitter portal.
The sandbox is open to organisations submitting on behalf of Vial Australia Pty Ltd, the only sponsor this committee reviews for (SOP 1). Live submissions open once virus scanning is switched on. To get a key, email contact@vialhrec.com.
01
How it works
Get a key. The HREC coordinator issues your organisation a sandbox key and, when you are ready, a live key. Sandbox submissions never reach the committee.
Start a submission. Send the study details and get back the full submission package checklist from SOP 1: 24 items, 14 of them required.
Upload documents. Ask for an upload link, send the file straight to secure storage, then confirm. We check size and fingerprint before it counts.
Submit. Confirm three declarations. If anything is missing we say exactly what. Otherwise the submission locks and you get a reference number.
Track it. Check the status and the full audit trail at any time. Webhooks for queries and decisions are coming next.
Same review. Submissions made through the API join the same queue and the same review process as everything else.
02
Basics
Requests
REST over HTTPS at /api/v1 on this site. JSON in and out. The full reference is generated from a single OpenAPI 3.1 file.
Authentication
Send your key as Authorization: Bearer hrec_live_…, or hrec_test_… for the sandbox. Keys belong to your organisation, can only see its submissions, and can be revoked instantly.
Rules
Send an Idempotency-Key with every POST so a retry never creates a duplicate. Errors use application/problem+json and name the field at fault. 60 requests a minute per key.
Files
Up to 500 MB each and 3 GB per submission, uploaded straight to storage. You declare each file's SHA256 up front and storage rejects anything that does not match, so the committee always reviews exactly what you sent.
03
Endpoints
| Endpoint | What it does |
|---|---|
GET /checklist | The submission package: every item, and which are required |
POST /submissions | Start a submission and get its document checklist |
GET /submissions | List your organisation's submissions |
GET /submissions/:id | Status, checklist and documents |
PATCH /submissions/:id | Edit study details, or mark optional items not applicable with a reason |
POST /submissions/:id/documents | Register a document and get an upload link, valid for an hour |
POST /submissions/:id/documents/:doc/complete | Confirm the upload; we verify size and fingerprint |
DELETE /submissions/:id/documents/:doc | Remove a document before submitting |
POST /submissions/:id/submit | Confirm declarations, lock and submit; returns the reference, or what is missing |
GET /submissions/:id/events | Full audit trail |
All paths are under /api/v1. Every POST accepts an Idempotency-Key; replays return the original response. Webhooks for received, query and decision events are next on the roadmap.
04
Example
Start a submission, upload the protocol, submit.
# 1. Start a submission
POST /api/v1/submissions
{ "type": "new_application",
"study": { "title": "Phase 1 study of ABC 123", "protocol_number": "ABC123-001",
"sponsor": "Vial Australia Pty Ltd",
"principal_investigator": { "name": "Dr A Investigator", "email": "pi@site.example" } } }
201 { "id": "sub_…", "checklist": [ { "document_type": "protocol", "required": true }, … ] }
# 2. Register the document, then PUT the file to upload_url
POST /api/v1/submissions/sub_…/documents
{ "item": "protocol", "filename": "ABC123-001_Protocol_v2.0.pdf", "content_type": "application/pdf",
"size_bytes": 4182233, "sha256": "9f86d0…", "version_label": "v2.0" }
201 { "id": "sdoc_…", "upload": { "method": "PUT", "url": "https://…", "headers": { … } } }
PUT <upload.url> (send the file with the headers given)
POST /api/v1/submissions/sub_…/documents/sdoc_…/complete
# 3. Repeat for every required item, mark optional ones not applicable, then submit
PATCH /api/v1/submissions/sub_…
{ "not_applicable": { "gmo_licence": "No genetically modified organisms used" } }
POST /api/v1/submissions/sub_…/submit
{ "declarations": { "accurate": true, "authorised": true,
"no_identifiable_participant_data": true } }
200 { "reference": "HREC-2026-0042", "status": "received" }