Overview
Base URL: https://doctor.clinit.app
Format: JSON (application/json)
Auth: Bearer JWT in Authorization header
Versioning:URL-based (/api/v2/ coming Q3 2026)
All responses are JSON. Successful responses return the resource directly at the top level (no wrapper). Error responses always include an error string field.
// Success
{ "id": "apt_123", "status": "CONFIRMED", ... }
// Error
{ "error": "Patient not found" } // 404
{ "error": "Invalid token" } // 401
{ "error": "Rate limit exceeded" } // 429
Authentication
Obtain an access token via POST /api/auth/login. Access tokens expire after 15 minutes. Use the refresh token to obtain a new one — refresh tokens expire in 7 days (30 days if "remember device" was checked).
// 1. Login
POST /api/auth/login
{ "email": "doctor@clinic.com", "password": "...", "clinicSlug": "my-clinic" }
// Response
{ "accessToken": "eyJ...", "refreshToken": "eyJ...", "user": { "id": "...", "role": "DOCTOR" } }
// 2. Use access token
GET /api/patients
Authorization: Bearer eyJ...
// 3. Refresh when expired
POST /api/auth/refresh
{ "refreshToken": "eyJ..." }
Authentication5 endpoints
POST/api/auth/login
Login with email, password, clinic slug. Returns JWT access + refresh tokens.
POST/api/auth/refresh
Rotate access token using refresh token. Access tokens expire in 15 minutes.
POST/api/auth/clinics
Discover which clinic accounts an email is registered with.
POST/api/auth/logout
Invalidate refresh token server-side.
POST/api/auth/2fa/verify
Verify TOTP code during 2FA login flow.
Patients6 endpoints
GET/api/patients
List patients with search, pagination, and filter by last visit / outstanding balance.
POST/api/patients
Create a new patient record.
GET/api/patients/[id]
Full patient profile including medical history, invoices, prescriptions, and specialty records.
PATCH/api/patients/[id]
Update patient demographic or contact information.
DELETE/api/patients/[id]
Soft-delete a patient record (retains audit trail).
POST/api/patients/import
Bulk import patients from CSV.
Appointments5 endpoints
GET/api/appointments
List appointments with date range, doctor, status, and branch filters.
POST/api/appointments
Create an appointment. Validates against doctor availability and buffer rules.
PATCH/api/appointments/[id]
Update status, time, doctor, or type. Status transitions are validated.
GET/api/appointments/waiting-room
Real-time waiting room: ARRIVED, WAITING, IN_CHAIR buckets.
GET/api/calendar/ical
iCal feed for calendar subscription (Google Calendar, Outlook, Apple Calendar).
Clinical (Sessions, Rx, Labs)6 endpoints
GET/api/sessions
List clinical sessions for a patient or doctor.
POST/api/sessions
Create a session linked to an appointment. Auto-marks appointment COMPLETED on save.
GET/api/prescriptions
List prescriptions for a patient. Includes drug, dose, frequency, duration.
POST/api/prescriptions
Create a prescription. Triggers AI drug interaction check if configured.
GET/api/lab-orders
List lab orders with status: PENDING, IN_PROGRESS, COMPLETED.
POST/api/lab-orders
Create a lab order. Generates QR token for lab-side status updates.
Billing5 endpoints
GET/api/invoices
List invoices with status filter. Revenue summary available via ?summary=true.
POST/api/invoices
Create invoice from session services or manually.
POST/api/invoices/[id]/pay
Record a payment against an invoice. Supports multiple partial payments.
POST/api/invoices/[id]/installments
Create an instalment plan: number of instalments, interval, first payment date.
GET/api/reports/daily-summary
End-of-day reconciliation report: appointments, revenue, payment methods breakdown.
AI Endpoints8 endpoints
POST/api/ai/clinical-summary
Generate SOAP session summary from vitals, notes, medications.
POST/api/ai/drug-interactions
Check full medication list for interactions, contraindications, dose errors.
POST/api/ai/discharge-summary
Generate formal discharge summary from session data.
POST/api/ai/referral-letter
Draft professional referral letter to named specialist.
POST/api/ai/demand-forecast
Predict appointment volume for next 4 weeks.
POST/api/ai/noshow-narrative
No-show risk prediction + personalised outreach message per patient.
POST/api/ai/cardiology-risk-narrative
ESC 2021 plain-language narrative for SCORE2/GRACE/CHA₂DS₂-VASc.
POST/api/ai/derm-severity-interpreter
PASI/SCORAD/DLQI interpretation + EADV/BAD step-up recommendation.