Skip to content

MedFlo Developer Platform

The MedFlo integration API for skilled-nursing & LTPAC data.

Read residents, coverage, and clinical data as FHIR resources, subscribe to signed webhooks, and authenticate with OAuth2 client-credentials. Request access and you'll get your own private credentials after a short review.

Register an app Read the docs

No shared credentials — access is granted after admin review, then you use your own scoped client_id.

Get a token

# Exchange YOUR issued client credentials for a short-lived bearer token.
# Set these from the credentials issued to you after your access request is approved.
CLIENT_ID="your-client-id"
CLIENT_SECRET="your-client-secret"

curl -s -X POST 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  --data-urlencode 'scope=residents.read coverage.read clinical.read'

# → { "access_token": "eyJ...", "token_type": "Bearer",
#     "expires_in": 3600, "scope": "residents.read coverage.read clinical.read" }

Why build on MedFlo

A modern, standards-first healthcare API.

OAuth2 client-credentials

Exchange a client_id + secret for a short-lived, scoped bearer token. Standard RFC 6749 — works with any OAuth client.

Learn more

FHIR-aligned resources

Read Patient, Coverage, Condition, MedicationRequest, AllergyIntolerance, and Observation as FHIR — with a live OpenAPI explorer and a Postman collection.

Learn more

Signed webhooks

Subscribe to admit/discharge/coverage/clinical events. Every delivery is HMAC-signed in the X-MedFlo-Signature header.

Learn more

Per-tenant, deny-by-default

Scopes map to capabilities; tenancy is derived from your credentials, never client input. No PHI in logs, errors, or tokens.

Learn more

Rate limits + envelope

Per-client quotas with X-RateLimit-* headers, and a consistent {data, meta, error} envelope on every response.

Learn more

Versioned & stable

Path-prefixed /api/v1. Breaking changes go to /api/v2; webhook payloads are versioned too.

Learn more

A real developer program

Everything you need to ship an integration.

Self-serve app registration

Register an app with the exact scopes you need and track approval — then get your own client_id and a one-time secret.

Register an app

A real sandbox

An issued key against a seeded, non-PHI tenant, with a live Try-It console and an on-demand data reset.

Open the sandbox

Webhook management

Register, list, test-fire, and revoke signed subscriptions from the portal — plus the signature-verification recipe.

Manage webhooks

OpenAPI & Postman

A live OpenAPI 3.1 explorer, the raw spec, hosted Swagger UI, and a ready-to-import Postman collection.

Explore the API

Versioned changelog

Every API-affecting change, dated, so you always know what shipped and what's coming.

See the changelog

Status & rate tiers

A component status board with a live reachability check, and documented rate-limit tiers.

Check status

API reference

Six FHIR-aligned resources, ready to read.

Patient (Residents)FHIR Patient

An outward, read-only view of a resident's demographics and identifiers, mapped to FHIR Patient. Identifier values are returned masked exactly as the system of record returns them — the API never unmasks them.

CoverageFHIR Coverage

A resident's payer coverage / policies, mapped to FHIR Coverage — for eligibility, clearinghouse, and HIE partners. Read-only; real-time eligibility (X12 270/271) is surfaced here as coverage status.

ConditionFHIR Condition

A resident's diagnoses / problem list, mapped to FHIR Condition. Codes are ICD-10-CM. Part of the read-only clinical resource set — clinical writes are never exposed on the integration API.

MedicationRequestFHIR MedicationRequest

A resident's medication orders, mapped to FHIR MedicationRequest. The drug identity is a First DataBank (FDB) drug id surfaced in the coding system uri — never a PCC/internal drug id.

AllergyIntoleranceFHIR AllergyIntolerance

A resident's allergies, mapped to FHIR AllergyIntolerance. Read-only, part of the clinical resource set.

ObservationFHIR Observation

A resident's vitals, weights, and results, mapped to FHIR Observation. Blood pressure carries systolic/diastolic; single-value vitals carry the value and unit. Read-only.

Ready to make your first call?

Register an app, get approved, and use your own credentials to fetch a token and call a live endpoint right in the sandbox.

Register an app Open the sandbox