Are you looking to become compliant with your state's medical or recreational cannabis tracking system? Maybe you're a 3rd party looking to consult or create applications that interact with the state tracking API. Either way, you'll find yourself applying for METRC certification in your corresponding state.

We're here to help you demystify the process so you can gain access to METRC.

What is METRC?

METRC is a 3rd party company that has been contracted by many states to handle their seed to sale tracking. METRC offers an online interface and API for growers, distributors, and retailers to update with their cannabis plant's progress (from planting seeds to sales receipt). Under the METRC system, each plant and 'package' is assigned a unique RFID tag distributed solely by METRC. This unique RFID tracks the plant through the system.

Certification Process

To gain access to METRC, you must first get certified to use the METRC system. This involves studying their terminology and workflow, and then taking 40 question multiple choice test.

Once you're certified, you can apply for access to certain API endpoints that your company requires access to. If you're developing a seed to sale application for example, you'll apply for access to the Plants, Plant Batches, Strains, Rooms, and Harvests endpoints. To apply for the access, you have to complete a competency examination for each endpoint (a GET, POST, UPDATE, and DELETE request usually).

The Steps

It's a fairly straightforward process to get certification. If you visit the METRC website for your state, you'll find their checklist there. This is technically the bare minimum required to achieve certification and access to the API:

• Contact Metrc
• Attend webinar
• Get sandbox API keys
• Take the sandbox test(s)
• Get production API access

The Initial Steps

The first few steps are easy, albeit time consuming. Contacting METRC is a snap and they respond back within a day with more details. Make sure to reserve your spot for the webinar when you make your initial contact, to cut back on the back and forth.

They only host the webinars every couple of weeks, and they do 2 sessions (a morning and afternoon). So if you don't catch it, you've got to wait a couple weeks until you can progress.

The webinar sucks the life out of you. My experience with the webinar was absolutely terrible.

They used GoToMeeting, requiring me to download that program. The webinar was full when I first clicked the invitation link and I didn't get in until 15 minutes later after about 20 attempts. After finally getting into the webinar, the audio was working fine, but the screen presenter's slides didn't work for the first half of the presentation. Luckily after complaining in the chat, they sent out a link to a PDF copy. The speaker was terrible, mumbling most of the time and incoherently stumbling through the subject matter.

By the end of the presentation, I was handed a 200+ page METRC manual and essentially sent off to go do some homework.

The Certification Test

The test was one of the more difficult parts, primarily due to the spotty reference material I was sourcing. You're required to know how the METRC online interface works as well. The 200+ page manual has plenty of screenshots of the website to work off of, but it can get confusing.

Here's an example of one of the questions:

Some are fairly simple. Other can be pretty innocuous. While some questions aren't even in any documentation provided. One question asked: "Which of the following attributes are required for the input of sales?". The manual cites: "Please see your State Supplemental for entering sales into METRC". I had to track this supplemental down on Google. And questions repeat. It's a 40 question test, with about 3-4 questions that were exactly the same.

Sandbox Tests

Once you take the first test and get certified, you can request API access. METRC sends over the sandbox API information, as well as a Word document that contains your API examination.

The sandbox tests to acquire API access were by far one of the worst punishments I've received lately. Between the essentially incomplete API documentation and the useless manual, you're left to poke and prod about to properly use most of the API.

Here are some of the key issues I had with the sandbox test:

Guesswork

METRC simple doesn't provide you with enough data to complete the test, between their incomplete documentation to the cryptic paperwork you're occasionally forwarded. I had to poke around their API and experiment with what works.

The first question on the test asks you to perform a POST request to an endpoint, but doesn't give you the necessary parameters (license number) to complete it. So I had to go to their Facilities endpoint (GET /facilities/v1/), go through each one, and find a license number that works with the POST request. If it involved lab tests, I had to find a license associated with a testing lab.

After seeing the Facilities endpoint, I realized that Metrc had emailed me JSON files with the license numbers inside the filenames. It was never mentioned in the email or any docs, I apparently had to intuitively attain the information. And even after checking the JSON files, they still would require you to GET request multiple endpoints to figure out which facility was which.

Half Ass Docs

The plant batches API endpoint to POST plant growth changes requires 2 extra parameters that the documentation fails to outline -- but an error message will inform you of. Strain Name and Actual Date are necessary as well as the other 6 fields mentioned in the docs.

Finding your POST results

Once you figure out how to make a POST request with a valid license number, you'll get a 200 response code signifying success -- and nothing else. POST requests to Metrc don't provide any response, not even the IDs of the posts you just made.

To find your posts, use the same license number and request the GET endpoint for active posts. And depending on the endpoint, you have to specify the time range. If you POST a couple strains, you'll find them at GET /strains/v1/active.

Often you'll need the ID of an item you just created, so you'll have to do a GET on the appropriate section's endpoint to find it. A bit cumbersome, particularly when you do a batch of requests.

Don't Timeout

Responses can and will take a long time. Make sure you don't set a timeout on the HTTP request. I set a 2 second timeout and couldn't POST to some endpoints because of how intensive error generation was ( 9993ms! ). I only hope the production API is half as fast, since an average dispensary services about 1000 customers per hour (16 per minute, 0.2 per second), plus any other API requests (inventory changes, patient verification, etc).

Downtime

Speaking of slow servers, the API sandbox crashed during my testing period, and I couldn't test my application for 3 days before they were able to get it back online. If you're allotting yourself time for this in your schedule, keep this in mind.

Track and Trace Flow

Know the flow for METRC, because the docs won't give you any hints. If you're lucky you'll get an error message pointing you in the right direction.

Every plant has to have a tag associated to it, plants belong to batches that associate a strain and plant type. Here's the order of operations for creating new items, from first to last:

Strains > Room > Individual Plants > Harvest > Package

Strains are required to make plant. But things like plant batches can be created without first creating plants (think of it like a category that contains a certain type of plant). It's a bit confusing at first (and there are holes), but it's a little more manageable once you've gone through the flow a couple times.

Plants Missing Tags?

I had a major issue where I had to find plants to change their growth phase, however the facility I was using didn't have any plants with plant tags. The field was null, making it impossible to access through certain endpoints that require plant tags as a reference point. This was clearly a fault on METRC's side, either inputting incomplete sample data into the sandbox, or allowing for users to send incomplete POST requests that break the system's flow.

I contacted the METRC staff about the problem and never received any support. The only solution was to change the facility, find another plant with actual tags, and use that instead.

You also can't create new plants using the API. Either the sandbox doesn't allow it, or METRC is expected to input every new plant when you purchase RFID tags from them. I wouldn't know, because after contacting METRC about it, I received no response.

New Plant Tags

If a POST request requires a new plant tag, you have to look inside the JSON file that's labeled with your facilities license number. If you can't find your license number in the files, you have to change to one of the provided options.

Sometimes plant tags may already be taken by other users in the sandbox environment. Just grab another from the sample data.

That's it!

Once you complete the examination, it's sent off to a 3rd party to check it, and you're give production level API keys.

It's a bit of a cumbersome process due to the METRC's incomplete and disorganized direction. What should be a straightforward process easily becomes a multi-week endeavor to navigate through their rat's nest of a system.

I wrote this article because I couldn't find anyone documenting any form of the process, despite METRC being used in 9 different states. If you have any information you'd like to share or clarify, please send us a copy and we'll update this post with your insights.

Stay regular!~

Oscar

Keep Reading:

• Official METRC website
• METRC API Documentation for California
• California Cannabis Track and Trace System