Control plane API

Bearer authentication against the Hebrah API for synthetic sandbox, HL7 inject, and webhook delivery.

Machine API access uses API keys provisioned during onboarding. Operator sign-in is separate: sessions live in the dashboard, verification lives in the Hebrah API.

Endpoint groups

Sandbox catalog & domains

Discover structured clinical and admin/revenue domains, events, and scenarios.

GET /v1/sandbox/catalog
GET /v1/sandbox/domains
GET /v1/sandbox/domains/{domain_id}
GET /v1/sandbox/payer-rules/{payer_id}

Synthetic FHIR & scenarios

Read fixtures and run multi-step workflows (e.g. prior auth, claims).

GET /v1/patients
GET /v1/patients/{id}
GET /v1/sandbox/resources/{type}
GET /v1/sandbox/resources/{type}/{id}
POST /v1/sandbox/scenarios/{scenario_id}/run

HL7 inject

Push synthetic HL7 v2 through the control plane → mapped webhook delivery.

GET /v1/sandbox/hl7/templates
POST /v1/sandbox/hl7/inject

Webhooks & reliability

Trigger events, inspect delivery history, replay stored envelopes.

POST /v1/webhooks/trigger-mock-event
GET /v1/webhooks/deliveries
GET /v1/webhooks/deliveries/{id}
POST /v1/webhooks/deliveries/{id}/replay
POST /v1/webhooks/deliveries/{id}/cancel
GET/PATCH /v1/sandbox/webhook-reliability

SMART on FHIR (Phase 4)

OAuth sandbox launch, token exchange, and FHIR R4 REST reads with patient-scoped tokens.

GET /.well-known/smart-configuration
GET /oauth/authorize
POST /oauth/token
POST /v1/smart/launch
POST /v1/smart/clients
GET /fhir/R4/metadata
GET /fhir/R4/Patient/{id}
GET /fhir/R4/Observation?patient=

Interop domains (Phase 4)

MPI match, provider credentialing fixtures, and aggregator/HIE-style query bundles.

POST /v1/sandbox/mpi/match
GET /v1/sandbox/credentialing/practitioners/{id}
POST /v1/sandbox/aggregator/query

First requests

The first requests are the requests that are made to the Hebrah API. They are made to the /v1/patients endpoint.

Delivery history

After webhook deliveries run, list attempts and replay stored envelopes from the control plane or dashboard Test tab proxies.

What the Hebrah API does not own

Endpoints such as /v1/auth/status and key management UI return 501 from the Hebrah API; those are owned by the dashboard.

Sidecar and PHI

Real clinic traffic routes through isolated sidecars. The control plane never stores PHI. See the sidecar endpoints guide in the full docs.