Referral Rock
MARKETING · MARKETING
Referral programs, their members, stats, and share URLs in the account they connected.
Connecting Referral Rock in practice
Referral Rock’s update and delete endpoints take no id: each item carries a query object that has to pin down exactly one member or referral through primaryInfo, or through both secondaryInfo and tertiaryInfo, and a query matching more than one record changes nothing at all. Webhook history is kept for about seven days, and the v2 history endpoint silently omits EmailUnsubscribed events because they are stored as a bare address.
Scopes that draw scrutiny
API Private Key (HTTP Basic password half)Displayed exactly once, immediately after it is generated, and never viewable again. It pairs with the public key as Basic apiPublicKey:apiPrivateKey and reaches members, referrals, rewards and payouts.POST /api/payouts/transactionsPays out pending rewards, so the credential does not just read a referral program — it moves money to participants.POST /api/customerfeedApproving a referral triggers any configured reward automatically, so a feed write is a payment trigger rather than a data update.
Worth knowing
- Requests must go to https://api.referralrock.com; plain HTTP fails with a 404 rather than a redirect, which reads like a wrong path.
- GET /api/v2/hooks/history/{eventName} returns at most 5,000 items or about seven days of history, whichever comes first, and the v1 version applies no record limit at all — a busy event there produces an enormous response.
- Referral Rock documents that requests are rate limited but publishes no figure; raising a limit goes through their support team, so back-off has to be adaptive.
- Several endpoints are on the way out with named replacements: POST /api/referrals/status in favour of POST /api/referral/update, /api/invitefeed in favour of /api/customerfeed, and /api/memberaccess in favour of /api/memberaccessurls.
- ProgramUpdate webhooks fire only on an activation change, while ReferralUpdate fires on any change including status, so the two events need very different handlers.
Checked against Referral Rock API (2026-09-29), Web API reference (2026-09-29), Web hooks (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Referral Rock behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.