Developers
API overview — early draft
Direction for partners, custom migrations, and future integrations. This is not a public production API yet — treat paths and payloads as provisional.
Server-to-server only
API credentials stay on your backend. Browser apps should never hold org-wide secrets.
Tenant-scoped
Every call is bound to a clinic organization. Cross-tenant access is not a feature.
AI stays behind the gateway
Documentation AI is not a raw model proxy. Entitlements and logging sit in front of providers.
Draft ≠ contract
Endpoints below describe direction for partners and migrations. Schemas will version before general availability.
Auth
Intended access model
- 01Request partner or migration API access via demo / sales (not self-serve yet).
- 02Receive organization-scoped credentials (API key or OAuth client — TBD at GA).
- 03Call HTTPS base URL with Authorization header; all traffic over TLS.
- 04Rotate credentials from owner/admin settings when that surface ships.
Example (illustrative)
Authorization: Bearer <ORG_SCOPED_TOKEN>
Content-Type: application/json
X-Mskster-Org: <org_id>Header names and token format are placeholders until the gateway ships.
Resources
Provisional endpoint map
Base URL TBD (e.g. https://api.mskster.ai). Paths may change before v1 GA.
/v1/patients
List patients in the organization (paginated).
/v1/patients/{id}
Retrieve a patient profile and linked episode summaries.
/v1/appointments
List appointments by date range and practitioner.
/v1/appointments
Create an appointment (partner / migration use).
/v1/notes
List signed notes; drafts are not exposed as finalized chart entries.
/v1/migrations/jobs
Open an assisted import job (CSV references + mapping id).
/v1/migrations/jobs/{id}
Poll validation status, error rows, and staging readiness.
/v1/webhooks/endpoints
Register a webhook URL for appointment and note events (planned).
Errors
Status codes (planned)
- 401Missing or invalid credentials
- 403Authenticated but not entitled for this org/action
- 404Resource not found in this tenant
- 409Conflict (duplicate external_id, overlapping booking, etc.)
- 422Validation failed — field errors returned in body
- 429Rate limited — back off and retry
Webhooks
Event direction
Planned events include appointment created/updated, note signed, and migration job completed. Payloads will be signed; retries with exponential backoff. Exact event names publish with the first partner cohort.
Need access for a pilot?
Tell us your use case (migration, payment partner, or internal tooling). We typically respond within one business day.