REST clients use JWT bearer authentication. API consumer keys are handled through portal/admin flows and displayed only in redacted form after creation or rotation.
API product page
REST access for governed medical content
The app docs describe URL-segmented REST endpoints, JWT bearer authentication, redacted API key handling, rate-limit headers, and an authenticated API playground.
Consumer portalOwn record, tier, usage, billing summary, and redacted active keys.
Versioned APIRoutes follow
/api/v{version}/resource; v1 is stable, v2 currently covers health.Operational signals429 responses and named policies expose rate-limit headers where configured.
What buyers should expect
The authenticated playground catalogs implemented controller metadata, sample request fields, deterministic response previews, and file-upload curl previews.
API versioning docs describe supported versions, dormant sunset headers, and deprecation mechanics that activate when a controller/action is annotated.
| Buyer question | Current public answer |
|---|---|
| Can consumers inspect usage? | Draft: app docs describe 30-day request/error counts, quota, used, remaining, and burst fields in the consumer portal. |
| Are quotas and billing production-ready? | Review needed: request-log usage and billing summaries are modeled; payment processors are not modeled in source docs. |
| Where is the OpenAPI document? | Deployment-owned: app source maps /swagger/v1/swagger.json; static deploy should wire the live URL. |
Draft/review-needed. Pricing, SLA, legal terms, and production domain URLs are intentionally absent until launch operations approves them.