Auth
Bearer token via Authorization: Bearer <api-key>. Generate keys from the dashboard → Settings → API keys. Keys are tenant-scoped and revocable instantly.
Rate limit: 60 requests/minute per key default; burst 240. Contact Colin for higher limits (DSO-tier default is 200 req/min).
Base URL
All endpoints live under https://api.usdpr.netlify.app/v1. Breaking changes bump the version; within v1 we maintain backwards compatibility for at least 12 months of deprecation notice.
Endpoints (subset)
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/patients | Create or upsert a patient record (idempotent on external_id). |
| GET | /api/v1/patients/{id} | Fetch a patient + their lifetime reactivation status. |
| POST | /api/v1/campaigns | Start a reactivation campaign against a segment. |
| GET | /api/v1/campaigns/{id}/metrics | Campaign KPIs — sent, delivered, opened, replied, booked, shown. |
| POST | /api/v1/replies/{id}/approve | Approve an AI-drafted reply and send it. |
| GET | /api/v1/bookings | List bookings with date filters + attribution to campaign + touch. |
| GET | /api/v1/exports/{kind} | Trigger a CSV/JSON export of patients/messages/bookings. |
| POST | /api/v1/webhooks | Register an outbound webhook (reply.received, booking.created, send.failed, etc.). |
Outbound webhooks
Register one or more webhook URLs to receive real-time events: reply.received, booking.created, campaign.completed, send.failed, export.ready. Webhook payloads are HMAC-signed with SHA-256; verify with your registered secret.