Testing Your Integration

Building against Oho means handling every outcome a register can give back — a valid card, an expired one, one nobody can find, one a person has to review. Real cards won't give you those on demand, so a test tenant recognises a set of mock reference numbers. Create a credential with one and Oho returns the outcome it names, every time, without contacting a register.

Where mock references work

Mock references only work on an Oho test tenant — the demo and sandbox tenants Oho sets up for integration work. Ask your Oho contact or [email protected] for one before you start.

They never work on your production tenant, and they don't work on a UAT tenant either, because UAT tenants hold real staff data. There a MOCK- reference is treated as an ordinary card number: Oho sends it to the real register, which doesn't recognise it, so the credential won't verify.

The references

Put one of these in identification.referenceNumber when you create a credential. Case doesn't matter.

Reference	eligibility	statusDetail	Expiry date returned	Notes
MOCK-VALID	MAY_ENGAGE	VALID	One year from today
MOCK-EXPIRING	MAY_ENGAGE	EXPIRING_SOON	30 days from today
MOCK-EXPIRED	MAY_NOT_ENGAGE	EXPIRED	30 days ago
MOCK-NOT-CURRENT	MAY_NOT_ENGAGE	NOT_CURRENT	None
MOCK-REVOKED	MAY_NOT_ENGAGE	REVOKED	None	Registry flags include suspension: true
MOCK-NOT-FOUND	MAY_NOT_ENGAGE	NOT_FOUND	None
MOCK-REVIEW	REVIEW_REQUIRED	CONDITIONS_TO_REVIEW	One year from today	A card with conditions; registry flags include is_conditional
MOCK-PENDING	REVIEW_REQUIRED	PENDING_DECISION	None
MOCK-NEW-CARD	MAY_ENGAGE	CONDITIONS_TO_REVIEW	One year from today	Registry flags include is_new_card
MOCK-IN-PROGRESS	IN_PROGRESS	IN_PROGRESS	None	Nothing is recorded and no webhook is sent — see below
MOCK-ERROR	ERROR	ERROR	None	Shows as an error; no webhook, and retried on the next run

Dates are worked out on the day the check runs, so MOCK-EXPIRING is always 30 days from expiry whenever you run it.

Only the exact reference counts

The reference has to be one of the values above exactly. Any other reference beginning MOCK- comes back as MOCK-VALID — so MOCK-EXPIRED-0417 is a valid card, not an expired one. You can't add a suffix to make each test credential unique and still choose its outcome.

If your tests need several credentials with the same outcome, give each one to a different worker, or use different credential types.

Which credential types it applies to

Mock references apply to credentials Oho verifies against a register:

• Working With Children checks for every state, and Tasmania's Working With Vulnerable People registration
• Queensland Blue Cards
• NDIS Worker Screening
• AHPRA registrations
• Teacher registrations
• VEVO (visa entitlement) checks on passports and ImmiCards

Everything else — police checks, driver licences, First Aid, CPR and other certificates — isn't checked against a register, so a MOCK- reference on it means nothing. Those credentials take their status from their expiry date: give one an expiry in the past to test an expired credential.

Timing: wait for the webhook, don't poll

Oho doesn't verify a new credential the moment you create it. It waits until credentials have stopped arriving and then checks them together, about a minute after the last one. Load twenty test credentials in a burst and the results arrive together roughly a minute after the twentieth.

So don't create a credential and read it straight back expecting a result. Subscribe to credential.verified and act when it arrives — the same thing your production integration should do. If a test needs the answer immediately, call POST /credentials/{id}/verify instead, which verifies there and then.

credential.verified is sent for MAY_ENGAGE, MAY_NOT_ENGAGE and REVIEW_REQUIRED. It is not sent for MOCK-IN-PROGRESS or MOCK-ERROR, so use those two to test that your integration copes with a credential that never reports back.

Example

Create an expired Working With Children Check for a test worker (Workers & Credentials covers creating the worker):

curl -sS -X POST "$OHO_BASE/credentials" \
  -H "Authorization: Bearer $OHO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "identification": { "displayName": "WWCC — NSW", "credentialType": "WWCC_NSW", "category": "SCREENING", "referenceNumber": "MOCK-EXPIRED" },
    "issuing": { "jurisdiction": "NSW" },
    "verification": { "status": "PENDING", "isVerifiable": true },
    "owners": { "worker": "'"$WKR"'" }
  }'

About a minute later your endpoint receives a credential.verified delivery. The parts that matter for this test:

{
  "eventType": "credential.verified",
  "data": {
    "success": false,
    "eligibility": "MAY_NOT_ENGAGE",
    "statusDetail": "EXPIRED",
    "credential": {
      "credentialType": "WWCC_NSW",
      "jurisdiction": "NSW",
      "identifier": "MOCK-EXPIRED"
    },
    "request": { "source": "auto_verify" }
  }
}

The Webhook Payload Reference has the full payload and every field.

Testing other parts of your setup

• Police checks through PharmacyID — connect the source to PharmacyID's TEST environment. Nothing is submitted to ACIC and nothing is billed. See Connect PharmacyID.
• HiBob — a HiBob sandbox account can be connected in place of your live one. See HiBob.
• Emails and notifications — the Developer settings redirect every outbound email to one address and can silence automated alerts while you test.