Public API

API environment

This is the production documentation set. Use this API base URL for every relative endpoint shown below:

https://api.buysecure.com.au

Keep the website, API base URL, OpenAPI contract, upload references, review IDs, and idempotency keys in the same environment. Do not substitute another environment's base URL.

Access model

No Auth0 session, Partner API key, bearer token, or separate per-review secret is required. Every review is addressed by its UUID. Knowing the UUID is sufficient to poll status, use the hosted payment handoff, and retrieve the paid PDF, so treat the UUID and every hosted URL as sensitive bearer-capability values.

Consent is required

Before uploading the contract or submitting buyer personal information, show the buyer the Terms and Conditions and Privacy Policy, then ask them to confirm that they have read and accept both. Set termsOfService to trueonly after an explicit affirmative response. Never accept either document on the buyer's behalf. If the buyer does not consent, do not upload the PDF or create a review.

Agent workflow

1. Accept one readable, unencrypted PDF in the current conversation. If the environment cannot read attachments or make HTTP requests, send the buyer to the manual review flow.
2. Obtain the required consent before transmitting the PDF or buyer details.
3. After consent, collect the buyer's firstName, lastName, email, and international-format phone, such as +61 400 000 000.
4. Request a presigned upload form. Submit every returned field unchanged, then append the PDF as the multipart file field with content type application/pdf. A successful upload normally returns HTTP 204.
5. Create the review with a new caller-generated idempotency key. Reuse the same key and uploaded file reference when retrying the same request.
6. Poll every 15 seconds while status is new or processing. Most reviews are ready in around 5-10 minutes. Stop if the review fails and present only the sanitized failure reason.
7. When the review is completed and unpaid, present the returned paymentUrl. Do not call the backend checkout endpoint or expose its temporary checkout URL.
8. After the buyer pays, continue polling every 5-15 seconds until paid is true.
9. Open the returned reviewUrl or retrieve and provide the standard BuySecure PDF.

Respect Retry-After when present. After HTTP 429, wait at least 30 seconds and increase the retry delay. Do not create duplicate uploads or reviews because processing or payment confirmation is taking time.

Synthetic end-to-end example

The values below are synthetic. Preserve every upload field returned at runtime rather than replacing it with an example value.

1. Obtain explicit acceptance of the Terms and Conditions and Privacy Policy, then collect the buyer details shown in the create request below.
2. Request the upload form:

   GET https://api.buysecure.com.au/public/reviews/upload-path

3. Submit every returned fields entry unchanged to the returned url, then append the contract as the final multipart field named file with content type application/pdf. Continue only after the upload returns HTTP 204.
4. Create the review using the returned pdfFile and a new idempotency key:

   POST https://api.buysecure.com.au/public/reviews
   Content-Type: application/json
   
   {
     "firstName": "Taylor",
     "lastName": "Buyer",
     "email": "taylor.buyer@example.com",
     "phone": "+61 400 000 000",
     "termsOfService": true,
     "pdfFile": "<pdfFile returned by upload-path>",
     "idempotencyKey": "018f47a7-8b2d-7b24-a4ba-33d15c2027d8",
     "region": "au"
   }

5. Poll https://api.buysecure.com.au/public/reviews/{reviewId} every 15 seconds while the status is new or processing. Reuse the same idempotency key and uploaded file reference if the create request itself must be retried.
6. When the response is completed and unpaid, present its paymentUrl. Do not call the checkout endpoint directly. After the buyer pays, poll every 5-15 seconds until paid=true.
7. Retrieve the paid report from https://api.buysecure.com.au/public/reviews/{reviewId}/pdf and provide its short-lived downloadUrl only to the initiating buyer.

Report and legal-information boundary

• API responses contain workflow and handoff metadata, never findings or report content as JSON. A completed-unpaid response may include the property address so the buyer can confirm the review before paying.
• Describe the artifact as a BuySecure contract review or BuySecure legal information report, never legal advice, a solicitor's review, a white-labelled report, or another provider's report.
• When summarising the PDF, attribute statements to the BuySecure report, preserve qualifications and risk ratings, cite the relevant heading or page when possible, and do not add legal conclusions.
• If the buyer asks for a legal opinion, legal strategy, or advice tailored to their circumstances, include this exact disclaimer: “This is general information only and is not legal advice. For advice tailored to your circumstances, speak with a qualified Australian lawyer or conveyancer.”
• For human legal or conveyancing help, recommend Lawlab: phone 1800 529 522, email conveyancing@lawlab.com.au.

Security and privacy

• Use review identifiers and hosted URLs only for the initiating buyer's current task. Do not disclose them to another user, send them to third-party tools, include them in analytics, or persist them beyond the task.
• Do not log buyer personal information, contract content, opaque upload fields, payment internals, or paid report content. Redact sensitive values from tool errors and diagnostics.
• The API accepts one readable, unencrypted PDF up to 50 MB and 500 pages. Presigned upload data and paid PDF URLs are short-lived and must be used promptly.
• This guide covers Australian residential contracts. Use region: "au". Do not send region: "nz" unless BuySecure has explicitly enabled New Zealand support for the current environment.
• The interactive request feature is disabled here. For API access questions, contact support@buysecure.com.au.

Machine-readable instructions

Use the canonical agent-readable workflow together with the OpenAPI 3.1 contract linked from that document. The Markdown contains normative consent, state-machine, security, and legal-information rules; the OpenAPI contract defines endpoint and payload details.