Every endpoint of the Doctofam REST API, generated from the API itself.
All endpoints are relative to https://api.doctofam.com. Create an API key in your Doctofam dashboard, then authenticate every request with it.
apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).
accessToken — Operator session token issued by the Doctofam dashboard: Authorization: Token <access token>.
Download the OpenAPI specification for use with your own tooling.
List appointments
Lists the appointments of your clinic. Requires the appointments:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| clinicId | query | string | |
| patientId | query | string | |
| startTime | query | string | |
| endTime | query | string | |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of appointments |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the appointments:read scope |
| 429 | API key rate limit exceeded |
Create an appointment
Creates an appointment in your clinic and emits appointment.created to your webhook subscriptions. Requires the appointments:write scope.
| Status | Meaning |
|---|---|
| 200 | The created appointment |
| 403 | API key is missing the appointments:write scope |
Get an appointment by id
Returns a single appointment owned by your clinic. Requires the appointments:read scope. Answers 404 for an appointment in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| appointmentIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The appointment |
| 403 | API key is missing the appointments:read scope |
| 404 | No such appointment in your organization |
List clinics
Lists the clinics of your organization. Requires the clinics:read scope.
| Status | Meaning |
|---|---|
| 200 | Array of clinics |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the clinics:read scope |
| 429 | API key rate limit exceeded |
Get a clinic by id
Returns a single clinic. Credentials are optional: the clinic's public website already serves every field, so an anonymous caller gets the same record. An authenticated caller needs the clinics:read scope and gets 404 for a clinic in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| clinicIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The clinic |
| 403 | API key is missing the clinics:read scope |
| 404 | No such clinic in your organization |
List invoices
Lists the invoices of your clinic. Requires the invoices:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| clinicId | query | string | |
| patientId | query | string | |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of invoices |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the invoices:read scope |
| 429 | API key rate limit exceeded |
Create an invoice
Creates an invoice in your clinic and emits invoice.created to your webhook subscriptions. Requires the invoices:write scope.
| Status | Meaning |
|---|---|
| 200 | The created invoice |
| 403 | API key is missing the invoices:write scope |
Get an invoice by id
Returns a single invoice owned by your clinic. Requires the invoices:read scope. Answers 404 for an invoice in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| invoiceIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The invoice |
| 403 | API key is missing the invoices:read scope |
| 404 | No such invoice in your organization |
List patients
Lists the patients of your clinic. Requires the patients:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| clinicId | query | string | |
| query | string | ||
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of patients |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the patients:read scope |
| 429 | API key rate limit exceeded |
Create a patient
Creates a patient in your clinic and emits patient.created to your webhook subscriptions. Requires the patients:write scope.
| Status | Meaning |
|---|---|
| 200 | The created patient |
| 403 | API key is missing the patients:write scope |
Get a patient by id
Returns a single patient owned by your clinic. Requires the patients:read scope. Answers 404 for a patient in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| patientIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The patient |
| 403 | API key is missing the patients:read scope |
| 404 | No such patient in your organization |
List payments
Lists the payments of your clinic. Requires the payments:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| clinicId | query | string | |
| patientId | query | string | |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of payments |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the payments:read scope |
| 429 | API key rate limit exceeded |
Create a payment
Records a payment in your clinic and emits payment.created to your webhook subscriptions. Requires the payments:write scope.
| Status | Meaning |
|---|---|
| 200 | The created payment |
| 403 | API key is missing the payments:write scope |
Get a payment by id
Returns a single payment owned by your clinic. Requires the payments:read scope. Answers 404 for a payment in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| paymentIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The payment |
| 403 | API key is missing the payments:read scope |
| 404 | No such payment in your organization |
List procedures
Lists your clinic's procedure/treatment catalog. Requires the procedures:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| clinicId | query | string | |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of procedures |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the procedures:read scope |
| 429 | API key rate limit exceeded |
Create a procedure
Adds a procedure to your clinic's catalog. Requires the procedures:write scope.
| Status | Meaning |
|---|---|
| 200 | The created procedure |
| 403 | API key is missing the procedures:write scope |
Get a procedure by id
Returns a single procedure owned by your clinic. Requires the procedures:read scope. Answers 404 for a procedure in another organization so ids cannot be probed.
| Name | In | Type | Description |
|---|---|---|---|
| procedureIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The procedure |
| 403 | API key is missing the procedures:read scope |
| 404 | No such procedure in your organization |
List webhook subscriptions
Webhook subscriptions deliver patient.created, appointment.created, invoice.created and payment.created events (and their .updated / .deleted variants) to your server as signed POST requests (X-Doctofam-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.
| Status | Meaning |
|---|---|
| 200 | Array of webhook subscriptions (without secrets) |
Create a webhook subscription
The response includes the signing secret exactly once — store it; it cannot be retrieved again.
| Field | Type | Description |
|---|---|---|
| clinicIdrequired | string | |
| urlrequired | string | |
| events | array (patient.created | patient.updated | patient.deleted | appointment.created | appointment.updated | appointment.deleted | invoice.created | invoice.updated | payment.created) | Empty array subscribes to all events |
| Status | Meaning |
|---|---|
| 200 | The created subscription, including its secret |
Update a webhook subscription
url, events and active are editable; the secret and clinic are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.
| Name | In | Type | Description |
|---|---|---|---|
| webhookSubscriptionIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The updated subscription (without secret) |
Delete a webhook subscription
| Name | In | Type | Description |
|---|---|---|---|
| webhookSubscriptionIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | Deleted |