REST API
All paths start with /v1 and need Authorization: Bearer <token>. Anything that sends a request uses two calls: prepare returns a summary for your user, then you send the approvalId with the same request. See REST API from any language.
| Method and path | What it does |
|---|---|
POST /consent-requests/prepare |
Validate and authorise a consent request; returns approvalId and summary |
POST /consent-requests |
Send it: { "approvalId", "request" } with the same request |
GET /consent-requests |
Your consent requests |
GET /consent-requests/:requestId |
One consent request, and what the patient approved |
POST /health-info-requests/prepare |
Check a record fetch against what the patient approved |
POST /health-info-requests |
Send it: { "approvalId", "request" } |
GET /health-info-requests |
Your fetches |
GET /health-info-requests/:transactionId |
Records received for a fetch |
POST /fhir/validate |
Check a health record’s structure (FHIR) |
Errors
Section titled “Errors”Errors return { "error": { "code": "..." } }:
| Status | Meaning |
|---|---|
400 |
Something in the request is missing or invalid; detail says what |
401 |
No token, or the wrong token |
403 |
Not allowed: your user cannot act for that facility, or the patient did not agree to this |
404 |
Not found, or it belongs to another user |
409 |
The approval is missing, already used, expired, or was for a different request |