SourceRX sits between the businesses that sell and the manufacturers that make and ship. This describes what moves in each direction. Every exchange below is live and can be built against today.
| Exchange | Direction | Status |
|---|---|---|
| Product catalog | SourceRX reads yours, hourly | Live |
| Order despatch | SourceRX → Manufacturer | Live |
| Shipping & tracking | Manufacturer → SourceRX | Live |
| Customer notification | SourceRX → customer | Live |
Technical questions about anything in this document go to [email protected] and reach someone who can answer them. If an endpoint is behaving differently from what is written here, that is worth telling us — the document is meant to be accurate, and where it is not, we would rather fix it than have you work around it.
SourceRX takes the payment, through our own merchant account and gateway. There is no payment integration for you to build, no card data reaches you, and no checkout sits on your side.
You are also sent no pricing. An order tells you the products and where to ship them — what anyone paid is not in it.
Three things, and nothing else:
You can build against every endpoint in this document today. Nothing is waiting on us. A section marked Specified is an optional alternative that is not built — the path beside it is, and is the one to use.
A product in SourceRX is a compound with one or more sizes. Each size is priced separately, at every volume tier. So "BPC-157" is one product with two sizes, and four prices each — not four products.
If pricing between us is settled in the agreement, leave them out entirely and send products, sizes and stock. Nothing breaks.
If you do send them they are read as your price to SourceRX — not retail. What a partner charges their own customer is set by them and is no part of this.
Expose one endpoint that returns your catalog. We call it every hour, and whenever an operator asks for it. There is nothing to push and nothing to retry — if we cannot reach you, that is our alert, not your problem to notice.
GET https://api.yourcompany.com/sourcerx/catalog
Authorization: Bearer <credential you issue us, if you want one>Return the whole catalog every time, not a delta. That is what lets a line you have stopped making be withdrawn — a partial list leaves us unable to tell "discontinued" from "not mentioned this hour", and we would keep sending you orders for it.
If your endpoint returns [] we record a failed sync and change nothing. An
endpoint answering empty during a deploy is far likelier than a supplier discontinuing their
entire range at once, and acting on it would take every one of your lines offline.
{
"products": [
{
"sku": "BPC157-10",
"compound": "BPC-157",
"size": "10mg",
"form": "vial",
"classification": "RUO",
"category": "Recovery & Repair",
"available": true,
"prices": { "1": "39.60", "2": "36.85", "3": "34.10" }
}
]
}| Field | Required | Notes |
|---|---|---|
| sku | Yes | Your identifier. Stable across updates — it is how we recognise the same line next time. |
| compound | Yes | The product name without the size. BPC-157, not BPC-157 10mg. |
| size | Yes | The fill, verbatim: 10mg, 5mg/5mg, 36IU. |
| form | No | vial, pen, nasal or ancillary. Defaults to vial. |
| classification | No | RUO for research use only, or 503A / 503B for compounded products. Defaults to RUO — leave it out unless a line genuinely is compounded. |
| category | No | One of the nine below, by name. Unrecognised names are reported, not guessed at. |
| available | No | false deactivates a line without deleting it or its order history. |
| prices | No | Keyed by volume tier, as decimal strings. Tiers are agreed with us beforehand, so send these only once a tier schedule exists — otherwise the key has nothing to attach to. Leave the field out entirely if pricing is settled in your agreement. |
Sent by name. They exist so a storefront can group a long catalog into sections a shopper can scan; a line without one still sells, it simply sits under "Other".
Not a delta. We diff it against what we hold and report what changed, so a missed message cannot leave the two sides disagreeing. A line you stop sending is deactivated, never deleted — order history has to keep resolving.
You can ask for a dry run, which returns the diff without applying it. Use it the first time and after any change to your export.
Send "39.60", not 39.6 and not 3960. We store money
as integer cents and parse from the text, because 39.60 × 100 in binary floating
point is 3959.9999999999995. Sending a string removes the ambiguity entirely.
When a partner places an order containing your products, we send you the lines that are yours, along with the address it ships to.
By the time an order reaches you it is already paid for. SourceRX has taken the payment through our own merchant account. An order arriving at your endpoint is an instruction to ship, not a request to collect — there is nothing for you to authorise, capture or settle.
POST https://api.yourcompany.com/sourcerx/orders
Authorization: Bearer <credential you issue us>
Content-Type: application/json
{
"orderId": "SRX-1001",
"placedAt": "2026-08-26T14:02:00Z",
"lines": [
{ "sku": "BPC157-10", "compound": "BPC-157", "size": "10mg", "qty": 2 }
],
"shipTo": {
"name": "Dana Reed",
"line1": "12 Elm St",
"line2": "",
"city": "Austin",
"region": "TX",
"postalCode": "78701",
"country": "USA"
}
}No payment information. No card data, no payment method, no total. We take the payment; you are never in that path, so nothing about it is in the payload.
No pricing. Not what the partner paid us, not what they charge their customer. You invoice us on your own terms; the retail price is the partner's business and the wholesale price is ours.
No partner identity unless we have agreed otherwise. You are shipping to an address, not being told who the reseller's customer belongs to.
No customer email. We send the despatch notice, not you. It keeps one voice in front of the customer and means a bounce is our problem.
Any 2xx means you have it; we record the dispatch as delivered and stop.
Anything else is recorded as failed with the status and the first part of your response body,
and an administrator can retry it without the partner reordering.
Your endpoint must be idempotent on orderId. A retry of an
order you already hold should be a success that does nothing, not a second order. We time out
after ten seconds.
Your URL must be https. We refuse to store a plain-http one: this payload
carries a named person and their home address.
Then, when it ships, you call the shipping endpoint. That one is live today and is described in the next tab.
One call per parcel. We mark the order shipped and email the customer their tracking — you do not send that email.
A SourceRX administrator issues it. It is shown to them once and cannot be looked up afterwards, so store it wherever you keep other production secrets.
Authorization: Bearer srx_378293bc9b83f1a2_Xk3nQpR7...Rotating or revoking a key takes effect immediately, as does your record being
deactivated — in all three cases calls begin returning 401.
SourceRX will not ask you to send a key, a password or a certificate over email or chat, and no SourceRX webhook will ever contain one. If you receive such a request, it did not come from us.
POST https://app.sourcerx.us/api/fulfilment/shipments
Authorization: Bearer <your key>
Content-Type: application/json
{
"orderId": "SRX-1001",
"trackingNumber": "1Z999AA10123456784",
"carrier": "UPS",
"status": "shipped",
"shippedAt": "2026-08-26T14:02:00Z"
}| Field | Required | Notes |
|---|---|---|
| orderId | Yes | Exactly as it appears on the order. |
| trackingNumber | Yes | Also the idempotency key — see below. |
| carrier | No | UPS, USPS, FedEx, DHL produce a tracking link in the customer's email. Anything else shows the bare number. |
| status | No | Defaults to shipped. |
| shippedAt | No | ISO 8601. Defaults to when we receive the call. |
| Code | Meaning |
|---|---|
| 201 | Recorded. { ok, orderId, notified, notifyReason } |
| 200 | Already had this exact despatch. { ok, duplicate: true } |
| 400 | orderId or trackingNumber missing |
| 401 | Key missing, wrong, rotated, revoked — or your record is inactive |
| 403 | That order contains none of your products |
| 404 | No such order |
Idempotent on (order, tracking number). The same despatch twice returns
200 duplicate and does nothing — no second parcel, no second email. Retry freely
on timeouts, resets and 5xx.
A different tracking number on the same order records a second parcel. That is how you report a split despatch: one call per parcel.
notified: false is not a failureIt means the customer email did not go — usually no address on the order, or our mail provider was briefly unavailable. The despatch is still recorded and the order is still marked shipped. Do not retry on it; you would be retrying something that already succeeded.
GET https://app.sourcerx.us/api/fulfilment/shipments
Authorization: Bearer <your key>Your own despatches only. Compare against your records after an outage on either side and re-send anything missing.
201.200 duplicate.GET /shipments.200 nor notified: false as a failure.Your account gives you a workspace: a storefront to build, a catalog priced for you, an order history and your own client list. Nothing here needs a developer.
Every price in your catalog is what you pay SourceRX, at the tier set for you. It already includes the SourceRX fee, so there is nothing further to add on our side.
What you charge your own customers is entirely yours. Set it wherever you like above your cost — we do not record it, calculate it, or show it to anyone.
You do not see what SourceRX pays the manufacturer. That is commercially confidential between us and that supplier, and it is not sent to your browser at all.
You cannot see other partners, and no other partner can see you, your clients or your orders.
You do not ship. The manufacturer despatches direct to your client and reports the tracking to us; we email your client the carrier and tracking number. That email carries no pricing.
Tracking appears against the order in your order history as soon as we receive it.
Anything about pricing, products or approvals goes to your SourceRX contact. This document is the technical reference for the manufacturers who supply the catalog; as a partner you should not need any of the other tabs.