Sell staff medical certificates from inside your product

Restaurant billing and POS software

Restaurants, cloud kitchens, caterers and bakeries. FSSAI asks for a medical certificate for every food handler each year.

Certificate: food handler (FSSAI)

Driving school and fleet software

Driving schools, cab and bus operators and logistics fleets. A driver needs Form 1A from a doctor to get or renew a licence.

Certificate: driver Form 1A

HR, payroll and hiring platforms

Employers who ask new joiners, security guards, housekeeping or kitchen staff for a fitness certificate.

Certificate: employee fitness

Staffing and recruitment agencies

Firms placing security, facility, hotel and kitchen staff with clients in India, who need the certificate before a person starts.

Certificate: employee fitness or food handler

Marketplaces and aggregators

Platforms that sell supplies or services to many small kitchens, shops or transport operators, and want one more thing to offer them.

Certificate: any of the three

Buying for your own staff?

You do not need a partnership. Order certificates for your own team at company certificates, or read about health checks for employers.

Sending nurses or students abroad? That is a different programme: see nurse recruiters for Germany or the referral code for recruiters.

Our order page opens in a new tab or as a full page, never inside a frame. Card and UPI apps often fail inside frames, our site refuses to be framed, and phone numbers are safer typed on our page.

Consent

Each person applies on our site themselves and agrees there to the doctor's examination. The business and you see a status, not what was asked or found.

Identity

A link only works for the mobile number the business gave, with a matching name and a one-time SMS code. If a certificate is issued to a different name or number, we flag it and do not report it to you as issued.

Orders typed on our page

When the business adds its staff on our page through your link, you see counts and statuses only: no names, numbers or references.

Your agreement

The written agreement with each partner sets what each side may do with the data. API keys are stored hashed and shown to you once.

Authentication

Authorization: Bearer pmdch_live_.... The key is shown once and stored hashed. A wrong, revoked or paused key always gets the same 401.

Limits

60 requests a minute and 30 new orders an hour for each key. Past that you get a 429 with a Retry-After header.

Idempotency

Creating an order needs an Idempotency-Key header, 8 to 120 characters. The same key with the same body returns the first order (200, replayed: true). The same key with a different body is a 422.

People

1 to 500 per order, Indian mobile numbers, no number twice. certificate_type is food_handler, driver_form1a or employee_fitness.

curl -X POST https://www.pingmedoc.com/api/partner/v1/bulk/orders \
  -H "Authorization: Bearer $PMD_KEY" \
  -H "Idempotency-Key: order-2026-11-02-sample-kitchen" \
  -H "Content-Type: application/json" \
  -d '{
    "certificate_type": "food_handler",
    "external_ref": "your-invoice-1042",
    "business": {
      "name": "Sample Kitchen", "city": "Chennai", "gstin": null,
      "contact_name": "Ravi", "contact_phone": "+919876543210",
      "contact_email": "ravi@example.com"
    },
    "people": [
      {"name": "Karthik R", "phone": "+919000000001", "external_ref": "emp-104"},
      {"name": "Meena S", "phone": "+919000000002", "email": "meena@example.com"}
    ]
  }'

HTTP/1.1 201 Created
{
  "order_id": "5f0c...e91",
  "order_number": "PMD-CO-00042",
  "status": "awaiting_payment",
  "amount_paise": 139800,
  "unit_price_paise": 69900,
  "people_count": 2,
  "pay_link_url": "https://rzp.io/...",
  "replayed": false
}

GET /bulk/orders/{order_id}
{
  "order_number": "PMD-CO-00042",
  "status": "paid",
  "certificate_type": "food_handler",
  "details_hidden": false,
  "people": [
    {
      "id": "...",
      "external_ref": "emp-104",
      "name": "Karthik R",
      "status": "issued",
      "link_status": "issued",
      "expires_at": "2027-11-04T06:12:00Z"
    },
    {
      "id": "...",
      "external_ref": "emp-105",
      "name": "Meena S",
      "status": "code_unused",
      "link_status": "sent",
      "expires_at": null
    }
  ]
}

The answer never includes a link to our order page or any person's code. The values shown are samples.

Signed callbacks

Give us one https address. We send a POST when an order is paid, cancelled or refunded, and when a person's certificate is issued or revoked. Reply with any 2xx.

X-PMD-Event: person.issued
X-PMD-Signature: t=1762060800,v1=9f2c...

{
  "id": "...",
  "event": "person.issued",
  "created_at": "2026-11-04T06:12:09Z",
  "data": {
    "order_id": "5f0c...e91",
    "person_id": "...",
    "external_ref": "emp-104",
    "status": "issued",
    "expires_at": "2027-11-04T06:12:00Z"
  }
}

import {
  createHmac,
  timingSafeEqual,
} from "node:crypto";

// header: the X-PMD-Signature value
// rawBody: the request body exactly as received
export function verified(secret, header, rawBody) {
  const [t, v1] = header
    .split(",")
    .map((p) => p.split("=")[1]);
  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const age = Date.now() / 1000 - Number(t);
  if (Math.abs(age) >= 300) return false;
  return (
    expected.length === v1.length &&
    timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(v1),
    )
  );
}

Signature

X-PMD-Signature: t=<unix time>,v1=<hex>, where v1 is the HMAC-SHA256 of t.rawBody with your signing secret. Reject anything more than 5 minutes old.

Retries

If you do not answer 2xx we try again up to 7 more times, waiting 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 24 hours, 24 hours. Then we stop.

Your address

https on port 443 with a public host name. We look the name up ourselves and connect only to a public address, so private and internal networks are refused.

Delivery

Redirects are not followed, and each attempt stops after 8 seconds.

1. Step 1

   Tell us about your product

   Send the form above. We set up a call to understand your customers and which certificates they ask for.

2. Step 2

   Agree terms in writing

   Your share, when it is paid, GST on the share, and what each side may do with the data.

3. Step 3

   Get your partner account

   A partner code for your link. For the API, a key and a callback signing secret, each shown once.

4. Step 4

   Build and try it

   Add the link, or make the calls and check a signed callback. A first order for one person shows every step.

5. Step 5

   Go live, get paid monthly

   Your customers order. Each month you get the statement and the payout.

Health checks for employers

For a company buying certificates, camps or medicals for its own staff.

Food handler medical certificate

What the FSSAI rule asks for, the video examination, and prices for kitchens.

Medicals for insurers

Pre-policy medicals and tele-MER for insurers, TPAs and brokers.

Form 1A for drivers

The driver medical certificate for a licence or renewal.