Build in Public - The WonKo Platform

The following documents the beginnings of our journey, developing tools to interface with government services, and to provide: (i) more accurate, and (ii) efficient / cheaper tools to clients.

We are “building in public”. This means we document our journey.

In here will contain an overview of how to build to the ATO API as well as ASIC’s API - if we get there.

DSP - Becoming a Digital Services Provider (DSP)

If you want to access the API, you will need to register as a DSP (Digital Services Provider).

  1. You need MyGov credentials. All citizens will tend to have this.
  2. Using these credentials, you can register to become a DSP: https://www.sbr.gov.au/digital-service-providers/software-development-steps
  3. This presumes you know what services you are after.

In order to find out what services are available, go to a link within sbr.gov.au which lists artefacts and find a link which says: “Service Registry”. This should be an excel spreadsheet - and you can review all the services in the “services action tab”.

Apply for DSP Provider Status

The outline is here: https://www.sbr.gov.au/digital-service-providers/software-development-steps

Here is a facsimilie:

Accessing Online services for DSPs You will need to use a Digital ID, such as myID to log in to Online services for DSPsExternal link. Follow these steps to do this:

  1. Set up a myIDExternal link.
  2. Get your Online services for DSPs authorisation set up in RAM. You will need your business’s RAM principal authority or authorisation administrator to set the authorisation.
  3. Note: When setting up an authorisation the principal authority or authorisation administrator must select Online services for digital software provider in the Agency access field, instead of Australian Taxation Office.
  4. Log in to RAM using your myID to accept your authorisation.
  5. Log in to and access Online services for DSPsExternal link using your myID.

If you are a new user, you will need to complete a registration form the first time you access Online services for DSPs. Once we process your registration you will have access to the full suite of requests. Note: The notifications in Online services for DSPs are sent to the email address associated with your myID (a personal email is recommended). You can change your email address when you register for Online services for DSPsExternal link and later via Update your registration details (Registrations and profiles) on the Online services for DSPs page. This does not change your myID email address.

Ideally you need to have an entity of some sort already set up with RAM. This is before you can even log in. Secondly, all your documentation needs to be in perfect order. If you are using a driver’s license, and you mistake an “O” for an “0” - which is very easy to do, then your authorisation will fail. It was surprisingly easy to trouble shoot - I simply called up someone in the SBR office and they sorted it out for me. Once you are authorised, you can apply to become a DSP.

You will have to provide reasons and your use cases. After you are approved you will receive further documentation.

The Development Steps:

(a) Review all the documentation re: development.

A key overiew is available at the SBR software development steps page.

This is where we are currently at. I am reviewing all the documentation to enable us to make requests to test against the ATO’s infrastructure. Once that is done we can proceed to run tests against ASIC’s API.

(b) Get the Credentials

You need an M2M code. Where do I get that? Review the documentation here:

(c) Ping a request to the ATO

  • (i) We want to make a ping request to the ATO’s “test” environment.
    • In order to do that, you will need to make a call to the ATO’s test environment. This means you need API keys. Follow the instructions contained here: (i) Create an API Team on the API Portal click on My Teams and request a new team. You should then have API credentials in which to make test API calls. For more details on that checkcout: (i) [Info about client credentials][https://apiportal.ato.gov.au/client-authentication#test-credentials]
  • (ii) At about this time, we will need to SEAM in an external API request to trigger the calls to the ATO’s test environment.
  • (iii) Once that has proven successful, can we finally produce an XLBR document and send that to the ATO. Necessarily we will have to make a valid document, and test it’s validity.
  • (iv) Then we will need to parameterise the external API calls to then create the XLBR document, so that we can present that to the ATO. Steps 3 and 4 will be highly iterative.
  • (v) We may choose to create a production server, to fulfill the documentation requirements to the ATO / ASIC. And when ready, we can SEAM in a production request to the ATO.

Further details on where the code samples are, and how we go about it will be provided.

Key Knowledge

  • You need to know what SOAP is, what an .xsd file, and .wsdl file is.

Tutorials

SOAP UI

  • Hierarchy: Project -> Test Suite -> Test Case -> Test Step

XBRL

Road Map

  • Learn basic SOAP UI software. (50%)
  • Reivew XBRL documenation (see above links). (5% - likely this will not be required to the extent I orginally thought).
  • Ping ATO servers. (Done)
  • Programmatically validate XML document (Done).
  • Send, to the ATO’s servers a valid but complete XML document (successfully) - that we have pre-prepared. (Current step)
  • Read the response - in it’s most simplest form.
  • Get ASIC credentials.
  • Manually create a simple but compeltely valid XML form and send that to the ATO’s servers.
  • Seam in a response and build the infrastructure for it.
  • Build production capable infrastructure.
  • Build payment gateways.
  • Soft launch and market it.
  • Review some basic WPF.

Bookmarks

  • ATO Web Services Implementation Guide - v2.2d - page. 20.
  • SOAP UI Tutorial 7 - still to complete.
  • https://www.soapui.org/getting-started/soap-test/
  • https://www.youtube.com/watch?v=Vkm3VvCRM8E&list=PLqMZRUzQ64B44jXcayBd2jIZp8o2ei6is

Privacy

I necessarily cannot share anything that is private, but can openly talk about what is publicly available.

Written on August 7, 2025