Doctofam API reference

Every endpoint of the Doctofam REST API, generated from the API itself.

All endpoints are relative to https://api.doctofam.com. Create an API key in your Doctofam dashboard, then authenticate every request with it.

apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).

accessToken — Operator session token issued by the Doctofam dashboard: Authorization: Token <access token>.

Download the OpenAPI specification for use with your own tooling.

Appointments

GET/api/appointments

List appointments

Lists the appointments of your clinic. Requires the appointments:read scope.

appointments:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdquerystring
patientIdquerystring
startTimequerystring
endTimequerystring
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of appointments
401Missing or invalid credentials
403API key is missing the appointments:read scope
429API key rate limit exceeded
POST/api/appointments

Create an appointment

Creates an appointment in your clinic and emits appointment.created to your webhook subscriptions. Requires the appointments:write scope.

appointments:writeapiKeyaccessToken
Responses
StatusMeaning
200The created appointment
403API key is missing the appointments:write scope
GET/api/appointments/{appointmentId}

Get an appointment by id

Returns a single appointment owned by your clinic. Requires the appointments:read scope. Answers 404 for an appointment in another organization so ids cannot be probed.

appointments:readapiKeyaccessToken
Parameters
NameInTypeDescription
appointmentIdrequiredpathstring
Responses
StatusMeaning
200The appointment
403API key is missing the appointments:read scope
404No such appointment in your organization

Clinics

GET/api/clinics

List clinics

Lists the clinics of your organization. Requires the clinics:read scope.

clinics:readapiKeyaccessToken
Responses
StatusMeaning
200Array of clinics
401Missing or invalid credentials
403API key is missing the clinics:read scope
429API key rate limit exceeded
GET/api/clinics/{clinicId}

Get a clinic by id

Returns a single clinic. Credentials are optional: the clinic's public website already serves every field, so an anonymous caller gets the same record. An authenticated caller needs the clinics:read scope and gets 404 for a clinic in another organization so ids cannot be probed.

clinics:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdrequiredpathstring
Responses
StatusMeaning
200The clinic
403API key is missing the clinics:read scope
404No such clinic in your organization

Invoices

GET/api/invoices

List invoices

Lists the invoices of your clinic. Requires the invoices:read scope.

invoices:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdquerystring
patientIdquerystring
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of invoices
401Missing or invalid credentials
403API key is missing the invoices:read scope
429API key rate limit exceeded
POST/api/invoices

Create an invoice

Creates an invoice in your clinic and emits invoice.created to your webhook subscriptions. Requires the invoices:write scope.

invoices:writeapiKeyaccessToken
Responses
StatusMeaning
200The created invoice
403API key is missing the invoices:write scope
GET/api/invoices/{invoiceId}

Get an invoice by id

Returns a single invoice owned by your clinic. Requires the invoices:read scope. Answers 404 for an invoice in another organization so ids cannot be probed.

invoices:readapiKeyaccessToken
Parameters
NameInTypeDescription
invoiceIdrequiredpathstring
Responses
StatusMeaning
200The invoice
403API key is missing the invoices:read scope
404No such invoice in your organization

Patients

GET/api/patients

List patients

Lists the patients of your clinic. Requires the patients:read scope.

patients:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdquerystring
emailquerystring
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of patients
401Missing or invalid credentials
403API key is missing the patients:read scope
429API key rate limit exceeded
POST/api/patients

Create a patient

Creates a patient in your clinic and emits patient.created to your webhook subscriptions. Requires the patients:write scope.

patients:writeapiKeyaccessToken
Responses
StatusMeaning
200The created patient
403API key is missing the patients:write scope
GET/api/patients/{patientId}

Get a patient by id

Returns a single patient owned by your clinic. Requires the patients:read scope. Answers 404 for a patient in another organization so ids cannot be probed.

patients:readapiKeyaccessToken
Parameters
NameInTypeDescription
patientIdrequiredpathstring
Responses
StatusMeaning
200The patient
403API key is missing the patients:read scope
404No such patient in your organization

Payments

GET/api/payments

List payments

Lists the payments of your clinic. Requires the payments:read scope.

payments:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdquerystring
patientIdquerystring
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of payments
401Missing or invalid credentials
403API key is missing the payments:read scope
429API key rate limit exceeded
POST/api/payments

Create a payment

Records a payment in your clinic and emits payment.created to your webhook subscriptions. Requires the payments:write scope.

payments:writeapiKeyaccessToken
Responses
StatusMeaning
200The created payment
403API key is missing the payments:write scope
GET/api/payments/{paymentId}

Get a payment by id

Returns a single payment owned by your clinic. Requires the payments:read scope. Answers 404 for a payment in another organization so ids cannot be probed.

payments:readapiKeyaccessToken
Parameters
NameInTypeDescription
paymentIdrequiredpathstring
Responses
StatusMeaning
200The payment
403API key is missing the payments:read scope
404No such payment in your organization

Procedures

GET/api/procedures

List procedures

Lists your clinic's procedure/treatment catalog. Requires the procedures:read scope.

procedures:readapiKeyaccessToken
Parameters
NameInTypeDescription
clinicIdquerystring
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of procedures
401Missing or invalid credentials
403API key is missing the procedures:read scope
429API key rate limit exceeded
POST/api/procedures

Create a procedure

Adds a procedure to your clinic's catalog. Requires the procedures:write scope.

procedures:writeapiKeyaccessToken
Responses
StatusMeaning
200The created procedure
403API key is missing the procedures:write scope
GET/api/procedures/{procedureId}

Get a procedure by id

Returns a single procedure owned by your clinic. Requires the procedures:read scope. Answers 404 for a procedure in another organization so ids cannot be probed.

procedures:readapiKeyaccessToken
Parameters
NameInTypeDescription
procedureIdrequiredpathstring
Responses
StatusMeaning
200The procedure
403API key is missing the procedures:read scope
404No such procedure in your organization

Webhook subscriptions

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver patient.created, appointment.created, invoice.created and payment.created events (and their .updated / .deleted variants) to your server as signed POST requests (X-Doctofam-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

accessToken
Responses
StatusMeaning
200Array of webhook subscriptions (without secrets)
POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

accessToken
Request body
FieldTypeDescription
clinicIdrequiredstring
urlrequiredstring
eventsarray (patient.created | patient.updated | patient.deleted | appointment.created | appointment.updated | appointment.deleted | invoice.created | invoice.updated | payment.created)Empty array subscribes to all events
Responses
StatusMeaning
200The created subscription, including its secret
PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and clinic are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200The updated subscription (without secret)
DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200Deleted