# One Click Audit — Class-to-Provider Requests

The One Click Audit integration is bi-directional. While the [API Reference](/products/class/apis/auditor/one-click-audit/one-click-audit) documents the endpoint your system POSTs to on Class, this page documents the requests that **Class POSTs to your endpoint**.

You must host an HTTPS endpoint (registered with Class) that accepts two types of requests:

- **Create** — When a Class user requests an audit.
- **Cancel** — When a Class user cancels an in-progress audit.


Both are HTTP `POST` requests with the same overall envelope shape, differing only in the `RequestAction` value.

## Request format

Class supports both `xml` and `json` request formats. Your preference is set during registration.

### JSON — Create

```json
{
  "Platform": {
    "RequestId": "a9e9cfce-e3b5-4077-b824-77d23a109ae3",
    "ReturnUrl": "/api/1.0/f/demo-business/demo-fund/externalproviders/demo-auditor/AuditService/submit/a9e9cfce-e3b5-4077-b824-77d23a109ae3"
  },
  "RequestData": {
    "FundCode": "demo-fund",
    "BusinessCode": "demo-business",
    "UserName": "john.smith@example.com.au",
    "ExternalAuditRequestId": "59a0b452-8c67-4696-af9a-c081557c3c09",
    "FyCode": "FY2026",
    "RequestAction": "Create"
  }
}
```

### JSON — Cancel

```json
{
  "Platform": {
    "RequestId": "a9e9cfce-e3b5-4077-b824-77d23a109ae3",
    "ReturnUrl": "/api/1.0/f/demo-business/demo-fund/externalproviders/demo-auditor/AuditService/submit/a9e9cfce-e3b5-4077-b824-77d23a109ae3"
  },
  "RequestData": {
    "FundCode": "demo-fund",
    "BusinessCode": "demo-business",
    "ExternalAuditRequestId": "59a0b452-8c67-4696-af9a-c081557c3c09",
    "FyCode": "FY2026",
    "RequestAction": "Cancel"
  }
}
```

Note that `UserName` is only sent on `Create`.

## Field reference

### Platform

| Field | Type | Description |
|  --- | --- | --- |
| `RequestId` | string (uuid) | The unique identifier for this audit request. Used later in the callback URL as `{requestId}`. |
| `ReturnUrl` | string | The Class callback URL your system will POST updates back to. This is the fully-formed URL — you do not need to construct it yourself, though you may reconstruct it from the other fields if desired. |


### RequestData

| Field | Type | Sent on | Description |
|  --- | --- | --- | --- |
| `FundCode` | string | Create, Cancel | The Class fund code the audit relates to. |
| `BusinessCode` | string | Create, Cancel | The Class business code the fund belongs to. |
| `UserName` | string | Create only | The email address of the Class user who requested the audit. |
| `ExternalAuditRequestId` | string (uuid) | Create, Cancel | The unique identifier for this audit request. Your system uses this to correlate the callback with the original request. |
| `FyCode` | string | Create, Cancel | The financial year the audit relates to (e.g. `FY2026`). |
| `RequestAction` | string | Create, Cancel | Either `Create` or `Cancel`. |


## Expected response format

Class expects your system to respond with the following envelope for **both** Create and Cancel:

### JSON — Create response

```json
{
  "ResponseStatus": {
    "Message": ["Request received successfully"],
    "Warning": [],
    "Error": []
  },
  "ResponseData": {
    "ExternalAuditRequestId": "59a0b452-8c67-4696-af9a-c081557c3c09",
    "ProviderRequestUrl": "https://provider.example.com.au/request?id=12345"
  }
}
```

### JSON — Cancel response

```json
{
  "ResponseStatus": {
    "Message": ["Cancellation received"],
    "Warning": [],
    "Error": []
  },
  "ResponseData": {
    "ExternalAuditRequestId": "59a0b452-8c67-4696-af9a-c081557c3c09"
  }
}
```

### Response fields

| Field | Sent on | Description |
|  --- | --- | --- |
| `ResponseStatus.Message` | Create, Cancel | Zero or more informational messages. |
| `ResponseStatus.Warning` | Create, Cancel | Zero or more warnings. |
| `ResponseStatus.Error` | Create, Cancel | Zero or more errors. |
| `ResponseData.ExternalAuditRequestId` | Create, Cancel | Echo of the audit request identifier. |
| `ResponseData.ProviderRequestUrl` | Create only | The URL your system provides for the Class user to click through and complete provisioning / acceptance. Displayed as a link in the Class UI. |


## What your system should do

### On receiving a Create

1. Authenticate the caller if required (mechanism agreed during onboarding).
2. Persist the `RequestId`, `ExternalAuditRequestId`, `BusinessCode`, `FundCode`, `FyCode`, and `ReturnUrl` — you will need these for the callback.
3. Provision the audit engagement in your system.
4. Return a `ProviderRequestUrl` for the Class user to click through and complete any acceptance steps.
5. Once the user has completed acceptance in your system, POST a `Requested` update back to Class via the callback endpoint (see [API Reference](/products/class/apis/auditor/one-click-audit/one-click-audit)).


### On receiving a Cancel

1. Authenticate the caller if required (mechanism agreed during onboarding).
2. Locate the audit request using `ExternalAuditRequestId`.
3. Cancel any in-progress work on your side.
4. Return an acknowledgement response. You do **not** need to send a `Cancelled` callback back to Class — Class already knows.


## Related

- **Callback endpoint your system POSTs to Class** — see the [API Reference](/products/class/apis/auditor/one-click-audit/one-click-audit).
- **State machine and transitions** — see [Workflow](/products/class/apis/auditor/one-click-audit/workflow).
- **How to obtain a bearer token for the callback direction** — see [Authentication](/products/class/apis/auditor/one-click-audit/authentication).