API Reference

This is the complete reference of every public endpoint exposed by RCM. Each operation has its own page with request/response schemas, examples in multiple languages, and an interactive playground you can use against sandbox right from this site.

The pages in this section are auto-generated from the OpenAPI spec. If you spot a discrepancy with the live API, it's a bug — please email support@osigu.com with the endpoint and the divergence.

Where to start

If you're…	Read first
New to RCM and want the big picture	Introduction → Quickstart → this reference
Implementing a specific operation	Jump straight to the operation page in the sidebar
Comparing v1, v2, and v3 endpoints	API versioning — explains how versioning works and which endpoints are deprecated
Building a webhook receiver	Webhook events (the events RCM emits, separate from this reference)

Resource groups

The endpoints are organised by tag:

Tag	What's there
Accounts	Read account state (`getDeepBaseAccountInfoByOriginId`, `listDispatchPackages`, `getDispatchPackageDetails`), attach metadata (`createAccountAdditionalData`, `createAccountAdditionalDataByOriginEventId`), change the payer/agreement of an admission via v3 (`updateAdmissionAgreement`, `validateAdmissionAgreementChange`).
Events	Update an existing admission by your own `origin_event_id` (`updateEventByOriginEventId`) and poll the async service-type change (`getPendingEventModificationById`). See Events.
Charges	The bread and butter: `createCharge`, `updateCharge`, `deleteCharge`. Every charge POST may implicitly create an Event and an Account behind the scenes — see Charges. Also `getCharge` to read one back by its internal UUID, `assignPackageCharge` (+ its status monitor) for packages that absorb component charges, and `duplicateChargeSupportFiles` to carry documentation onto rebilled charges.
Invoices	`assignChargesToInvoice` to group charges, `getInvoiceAssignmentChargeStatus` to poll the async assignment, `migrateSupportFiles` to reassign documents during re-billing (`getInvoiceChargeReassignmentStatus` polls it), `voidInvoice` to void an invoice and disable its charges.
Support Files	`addSupportFile` (v1, you know the document type) and `addSupportFile` v2 (RCM auto-classifies via DVS when `support_file_code` is omitted; behaves like v1 when it's provided). `getSupportDocumentsConfigured` tells you which `support_file_code` values an agreement actually requires.
Pre-Settlements	The last step of the cycle: validate invoices for bundling (`validateInvoice`, `validateInvoicesBulk`), `generatePreSettlement` to hand them to the payer, `getPreSettlementDetail` to read the bundle back, `deletePreSettlement` to void it or detach invoices. See Pre-settlements.
Integration Events	PULL-mode delivery, the alternative to webhooks: `pullIntegrationEvents` claims a batch, `acknowledgeIntegrationEvents` closes the loop, `getIntegrationEventsStats` reports your backlog. See Audit events → Consumption model.
Payers	Resolve OSIGU's payer catalogue against your own: `getPayers` (optionally by country) and `getPayerByTaxId` to look one up by NIT/CNPJ.
HIS RPA Dispatches	`updateHisRpaDispatchStatus` — the acknowledgement your RPA bot sends back after processing a dispatch.
Webhook Subscriptions	Manage where RCM POSTs events — create, pause, resume, reset circuit-breaker, delete.

Base URLs

Two environments, both versioned under /rcm:

Environment	Base URL	When to use
Sandbox	`https://sandbox.osigu.com/rcm`	Building, testing. Non-billable.
Production	`https://api.osigu.com/rcm`	Live traffic.

Endpoint paths in this reference are listed without the base — /v1/charges means https://sandbox.osigu.com/rcm/v1/charges in sandbox, https://api.osigu.com/rcm/v1/charges in production.

Authentication

Every endpoint requires a bearer token obtained via the OAuth2 client credentials grant. See Obtaining tokens for the full flow. In short:

curl -X POST https://sandbox.osigu.com/v1/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials"

# Then on every RCM call:
curl https://sandbox.osigu.com/rcm/v1/... \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The OAuth token endpoint lives on osigu.com (the SSO server), not under /rcm. Use the same $CLIENT_ID / $CLIENT_SECRET you got at onboarding.

Versioning

Public endpoints carry an explicit major version in the path: /v1/, /v2/, /v3/. Within a major, additive changes don't bump the version; breaking changes do, and the old endpoint is deprecated with a Sunset date.

Today's mix:

/v1/ — the bulk: charges, accounts, invoices, support files (v1), webhook subscriptions.
/v2/ — support file upload with optional auto-classification (DVS when support_file_code is omitted; synchronous like v1 when it's provided).
/v3/ — the current change-of-payer endpoint, successor of a deprecated v1 endpoint.

See API versioning for the full deprecation rules.

Error format

Every error response uses a consistent shape:

{
  "error_code": "071-XXX",
  "message": "Human-readable explanation in English",
  "additional_information": {
    "field": "value that helps debug, e.g. the bad charge_code"
  }
}

error_code is a stable identifier you can match against in your client. message may be tweaked across releases for clarity — log it for debugging but don't switch on it.

Common HTTP statuses across endpoints:

Status	Meaning
`200 OK`	Success with response body.
`202 Accepted`	Async work started — body or `Location` header points to a monitor endpoint.
`204 No Content`	Success, no body (typical for upload-style endpoints).
`400 Bad Request`	Request malformed (missing required fields, wrong content-type, etc.).
`401 Unauthorized`	Token missing, invalid, or expired.
`403 Forbidden`	Token valid but lacks the scope for this action.
`404 Not Found`	Resource not found, or scoped out by your provider's permissions.
`406 Not Acceptable`	File exceeds 200 MB on upload endpoints.
`409 Conflict`	State conflict (e.g. trying to modify an invoiced charge).
`422 Validation error`	Body parsed but failed business validation. `additional_information` includes the field.
`5xx`	Server-side issue. Safe to retry with exponential backoff.

Rate limits

Sandbox rate limits are set per client_id at:

50 requests / minute on most endpoints
10 requests / minute on the OAuth token endpoint (so cache your tokens!)
20 uploads / minute on support file uploads

Hitting the limit returns 429 Too Many Requests with a Retry-After header (seconds). Production limits are higher and are configured per integration during onboarding.

Interactive playground

Every operation page in the sidebar has a "Send API Request" panel. It pre-fills the path and headers from the OpenAPI spec; you fill in the body, paste your sandbox token, and hit Send. Useful for one-off verifications without writing code.

The playground uses sandbox by default. If you want to try a production endpoint, change the server in the dropdown — but be careful, production is billable and audited.

OpenAPI spec download

The raw OpenAPI 3.0 spec backing this reference is at:

https://rcm-docs.osigu.com/openapi.json

Drop it into Postman, Insomnia, openapi-generator, or any other tool that consumes OpenAPI. We bump this spec on every release.

Next steps

First-time integrators: Quickstart walks the end-to-end loop in under 10 minutes.
Need a step-by-step guide for a specific flow? See Guides.
Building an async-heavy integration? Start with Webhook events.

Where to start​

Resource groups​

Base URLs​

Authentication​

Versioning​

Error format​

Rate limits​

Interactive playground​

OpenAPI spec download​

Next steps​