Skip to content

Webhooks

Webhook manager

Register signed event subscriptions, list what you have, fire a signed test event, and revoke — all against the live API. Subscriptions are org-scoped and require a key with the webhooks.manage scope.

Webhook docsRegister an app

What the test event does

A test fire builds the exact signed delivery MedFlo would POST to your callback and returns the bytes + the X-MedFlo-Signature value. In production, the delivery worker performs the outbound POST with at-least-once retry; the test lets you validate your signature verifier first.
Connect
Locked

Webhook management is gated

Managing subscriptions requires a key with the webhooks.manage scope. Unlock to enter your issued key.

cURL recipes (manage from a server)
bash
# Every call needs a token with the webhooks.manage scope.
TOKEN="eyJ..."

# Register a subscription (signing_secret returned ONCE)
curl -s -X POST 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/ofctx/sandbox-org-0001/webhooks' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{ "callback_url": "https://example.com/hooks/medflo",
        "event_types": ["resident.admitted", "coverage.updated"] }'

# List your org's subscriptions
curl -s 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/ofctx/sandbox-org-0001/webhooks' -H "Authorization: Bearer $TOKEN"

# Fire a signed test event (returns the exact bytes + signature)
curl -s -X POST 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/ofctx/sandbox-org-0001/webhooks/{id}/test' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{ "event_type": "resident.admitted" }'

# Revoke a subscription
curl -s -X DELETE 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/ofctx/sandbox-org-0001/webhooks/{id}' -H "Authorization: Bearer $TOKEN"