End-to-End Walkthrough

Post a complete supplier-to-shipping flow, see it on your dashboard, and produce a review-ready export. Builds on the 5-minute Quickstart.

Before you start

You should have completed the Quickstart and have:

$REGENGINE_API_KEY and $REGENGINE_SIGNING_SECRET in your shell
A test workspace. Accepted events are permanent and can be billed, so keep the TEST- prefix on your lot codes
A working curl with openssl, and ~15 minutes

The flow: one receiving event, one transformation event, one shipping event. That is three events in a single supplier-to-shipping chain. Fill each request-body skeleton with your own lot codes, locations, and quantities, then list the events and export them.

Post the Receiving event

Post a Receiving CTE for a lot that arrived at your facility — the starting anchor for the chain. Fill the skeleton's <traceability_lot_code>, immediate_previous_source, and the other fields with your own values.

bash

NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
TODAY=$(date -u +%Y-%m-%d)

BODY=$(cat <<EOF
{
  "source": "<your source system id>",
  "events": [
    {
      "cte_type": "receiving",
      "traceability_lot_code": "<the lot code you assigned>",
      "product_description": "<product name>",
      "quantity": "<number greater than 0>",
      "unit_of_measure": "<cases | lbs | kg | pallets | each>",
      "location_name": "<your facility name>",
      "timestamp": "$NOW",
      "kdes": {
        "receive_date": "$TODAY",
        "receiving_location": "<where the lot arrived>",
        "immediate_previous_source": "<who sent it to you>",
        "reference_document": "<your ASN or receipt id>",
        "tlc_source_reference": "<the lot reference your supplier gave you>"
      }
    }
  ]
}
EOF
)

# Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$REGENGINE_SIGNING_SECRET" -hex | sed 's/^.* //')"

curl -X POST https://regengine.co/api/v1/webhooks/ingest \
  -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  --data-binary "$BODY"

Expected response

json

{ "accepted": 1, "rejected": 0, "total": 1, "events": [
  { "traceability_lot_code": "<the lot code you sent>",
    "cte_type": "receiving", "status": "accepted",
    "event_id": "...", "sha256_hash": "...", "chain_hash": "..." }
] }

If it didn't work

503 with "Document storage is not configured": this endpoint doesn't need object storage; you shouldn't hit this. If you do, the 503 is from a different path; ping support.
401: the key is missing or not recognized, or X-Webhook-Signature is missing or wrong. The key header is X-RegEngine-API-Key (not Authorization). Sign the exact bytes you send, which is why the sample uses --data-binary. 403: the key lacks the webhooks.ingest scope.
200 with status: "rejected": read errors on that event, for example a missing KDE. Fix it and resend with a new Idempotency-Key.
422: the whole request failed validation and nothing was stored. error.details names the field, for example a missing quantity or a timestamp more than 24 hours ahead.

Post the Transformation event

Post a Transformation CTE for the lot you process. Set cte_type to transformation and point kdes.input_lot_codes at the Receiving lot from Step 1; the output lot is new.

bash

NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
TODAY=$(date -u +%Y-%m-%d)

BODY=$(cat <<EOF
{
  "source": "<your source system id>",
  "events": [
    {
      "cte_type": "receiving",
      "traceability_lot_code": "<the lot code you assigned>",
      "product_description": "<product name>",
      "quantity": "<number greater than 0>",
      "unit_of_measure": "<cases | lbs | kg | pallets | each>",
      "location_name": "<your facility name>",
      "timestamp": "$NOW",
      "kdes": {
        "receive_date": "$TODAY",
        "receiving_location": "<where the lot arrived>",
        "immediate_previous_source": "<who sent it to you>",
        "reference_document": "<your ASN or receipt id>",
        "tlc_source_reference": "<the lot reference your supplier gave you>"
      }
    }
  ]
}
EOF
)

# Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$REGENGINE_SIGNING_SECRET" -hex | sed 's/^.* //')"

curl -X POST https://regengine.co/api/v1/webhooks/ingest \
  -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  --data-binary "$BODY"

Expected response

Same shape as Step 1. The new event chains to the receiving event via kdes.input_lot_codes.

Post the Shipping event

Post a Shipping CTE when the lot leaves for its next destination. Set cte_type to shipping with the same lot code. This closes the chain for the lot.

bash

NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
TODAY=$(date -u +%Y-%m-%d)

BODY=$(cat <<EOF
{
  "source": "<your source system id>",
  "events": [
    {
      "cte_type": "receiving",
      "traceability_lot_code": "<the lot code you assigned>",
      "product_description": "<product name>",
      "quantity": "<number greater than 0>",
      "unit_of_measure": "<cases | lbs | kg | pallets | each>",
      "location_name": "<your facility name>",
      "timestamp": "$NOW",
      "kdes": {
        "receive_date": "$TODAY",
        "receiving_location": "<where the lot arrived>",
        "immediate_previous_source": "<who sent it to you>",
        "reference_document": "<your ASN or receipt id>",
        "tlc_source_reference": "<the lot reference your supplier gave you>"
      }
    }
  ]
}
EOF
)

# Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest.
SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$REGENGINE_SIGNING_SECRET" -hex | sed 's/^.* //')"

curl -X POST https://regengine.co/api/v1/webhooks/ingest \
  -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  --data-binary "$BODY"

Check your dashboard

Open /dashboard/compliance. You should see:

3 events in your workspace, with the lot codes you posted
The traceability lot code visible in the events list
A compliance score (early-stage; will improve as more lots flow through)

Empty dashboard? Confirm you are signed in to the workspace your API key belongs to. Events are scoped to that workspace.

Produce an FDA-oriented export

For the lot you just shipped, generate an FDA-oriented sortable spreadsheet for operator review:

bash

curl -G https://regengine.co/api/v1/fda/export \
  -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \
  -d "tenant_id=YOUR_WORKSPACE_ID" \
  -d "tlc=<the lot code you shipped>" \
  -d "format=csv" \
  -o lot-export.csv

# Inspect:
head -20 lot-export.csv

The export needs the fda.export scope and an active subscription. Your workspace ID is the one RegEngine sent with your key. A 409 with kde_coverage_below_threshold means the lot's events are missing required KDEs; the response lists them. Fix the data, or add allow_incomplete=true to acknowledge the gap (the bypass is recorded in the audit trail).

You should see header rows mapping to FDA's 1.1455(c) requirements, with one row per CTE event for the lot. Production records, not legal advice. Your operation remains responsible for compliance.

What you just proved

Three CTE events with chained SHA-256 hashes are now in your tenant scope.
The compliance dashboard reflects them within seconds.
An FDA-oriented export can be produced for any subset by lot code.

Where to go from here

Before you start

You should have completed the Quickstart and have:

$REGENGINE_API_KEY and $REGENGINE_SIGNING_SECRET in your shell

A test workspace. Accepted events are permanent and can be billed, so keep the TEST- prefix on your lot codes

A working curl with openssl, and ~15 minutes

NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ) TODAY=$(date -u +%Y-%m-%d) BODY=$(cat <<EOF { "source": "<your source system id>", "events": [ { "cte_type": "receiving", "traceability_lot_code": "<the lot code you assigned>", "product_description": "<product name>", "quantity": "<number greater than 0>", "unit_of_measure": "<cases | lbs | kg | pallets | each>", "location_name": "<your facility name>", "timestamp": "$NOW", "kdes": { "receive_date": "$TODAY", "receiving_location": "<where the lot arrived>", "immediate_previous_source": "<who sent it to you>", "reference_document": "<your ASN or receipt id>", "tlc_source_reference": "<the lot reference your supplier gave you>" } } ] } EOF ) # Sign the exact bytes you send: sha256= plus the HMAC-SHA256 hex digest. SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$REGENGINE_SIGNING_SECRET" -hex | sed 's/^.* //')" curl -X POST https://regengine.co/api/v1/webhooks/ingest \ -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \ -H "X-Webhook-Signature: $SIGNATURE" \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ --data-binary "$BODY"

{ "accepted": 1, "rejected": 0, "total": 1, "events": [ { "traceability_lot_code": "<the lot code you sent>", "cte_type": "receiving", "status": "accepted", "event_id": "...", "sha256_hash": "...", "chain_hash": "..." } ] }

curl -G https://regengine.co/api/v1/fda/export \ -H "X-RegEngine-API-Key: $REGENGINE_API_KEY" \ -d "tenant_id=YOUR_WORKSPACE_ID" \ -d "tlc=<the lot code you shipped>" \ -d "format=csv" \ -o lot-export.csv # Inspect: head -20 lot-export.csv