Developers

Two ways to connect: clinical networks receive case packets and send decisions back; brands run their own front end on our intake engine. JSON over HTTPS, versioned under /api/v1.

Try it

These call this site’s live API.

Click a button to see the response.

Authentication

Brands send Authorization: Bearer <brand key> to start a case. Each case returns its own case_token; every later call for that case sends X-Case-Token.

Networks sign each webhook body with HMAC-SHA256 using the shared secret we issue, sent as X-Signature (hex).

Endpoints

Endpoint	Auth	What it does
GET/api/v1/health	None	Status, version, and whether storage and encryption are configured.
GET/api/v1/programs	None	Programs, prices, and every question and hard stop in English and Spanish.
GET/api/v1/states	None	Which states are open, and for which programs.
POST/api/v1/quote	None	Eligibility and price from program, state, age, sex, height and weight. Stores nothing.
POST/api/v1/cases	Brand key	Start a case after the quote. Returns the case reference and a case token.
GET/api/v1/cases/{ref}	Case token	Status, next step and the questions to show next.
POST/api/v1/cases/{ref}/answers	Case token	Save one answer. Returns the next question, or a hard stop.
POST/api/v1/cases/{ref}/steps/{step}	Case token	Save account, identity, labs, insurance, shipping (with consent) or payment.
POST/api/v1/cases/{ref}/submit	Case token	Send the case packet to the state’s clinical network.
POST/api/v1/webhooks/{network}	HMAC signature	Clinician decision from the network: approved, declined or shipped.
POST/api/v1/waitlist	None	Email and state for a state that isn’t open yet.

Case packet

What a network receives at submit. Questions travel with their English wording, so any clinician system can show them without our configuration. The patient’s language is in language.

{
  "case_ref": "ST-AYW5U2",
  "program": "glp1",
  "state": "FL",
  "visit_type": "async",
  "language": "es",
  "patient": {
    "first_name": "Ana",
    "last_name": "Rivera",
    "dob": "1980-04-12",
    "sex_at_birth": "female",
    "email": "ana@example.com",
    "phone": "5615550142",
    "address": {
      "address1": "100 Main St",
      "address2": "",
      "city": "Boca Raton",
      "state": "FL",
      "zip": "33431"
    }
  },
  "eligibility": {
    "height_in": 66,
    "weight_lb": 210,
    "bmi": 33.9
  },
  "answers": [
    {
      "id": "mtc",
      "question": "Have you, or has anyone in your family, had medullary thyroid cancer or multiple endocrine neoplasia type 2 (MEN2)?",
      "answer": "no",
      "answer_text": "No"
    },
    {
      "id": "diabetes",
      "question": "Do you have diabetes?",
      "answer": "type2",
      "answer_text": "Yes, type 2"
    }
  ],
  "flags": [],
  "labs": {
    "choice": "later",
    "route": "standard"
  },
  "identity": {
    "method": "vendor",
    "status": "passed"
  },
  "consent": {
    "telehealth_version": "a1b2c3d4e5f6",
    "language": "es",
    "location_attested": true
  },
  "webhook_url": "https://everstatehealth.com/api/v1/webhooks/partner"
}

Webhooks

Send decisions to POST /api/v1/webhooks/{network}. Repeats are safe: a decision that doesn’t fit the case’s status is ignored and logged.

POST /api/v1/webhooks/partner
Content-Type: application/json
X-Signature: hex( HMAC_SHA256( shared_secret, raw_body ) )

{"case_id": "P-48213", "event": "approved", "note": "Start 0.25 mg weekly"}

Events: approved (we capture the card hold), declined (we release it and show the note to the patient), shipped.

Case lifecycle

started → submitted → prescribed → shipped, with exits to not_eligible (hard stop, no charge) and declined (hold released).

Sandbox and data

This deployment is a sandbox. Its sandbox network accepts every case and waits for a decision from the operations console. Use test data only: production patient data runs on HIPAA-covered infrastructure under a signed BAA, and this endpoint set moves with it unchanged.