Authentication
All API requests are authenticated using Bearer tokens. API keys are scoped to specific capabilities and can be rotated or revoked at any time from the Enterprise Admin panel.
API Key Authentication
Server-to-server integration using scoped Bearer tokens. Keys are SHA-256 hashed at rest and support fine-grained permission scopes.
referrals:readreferrals:writetriage:readanalytics:readwebhooks:manageOAuth 2.0 / SMART-on-FHIR
SMART-on-FHIR launch support is planned for Q3 2026, enabling EHR-embedded app launches with patient context. The current API key model is suitable for backend system integrations.
Coming Q3 2026
SMART App Launch, patient-level OAuth scopes, EHR context passing
Base URL & Versioning
# Production
https://api.atlashlth.com/api/v1
# Sandbox (coming Q3 2026 — request early access below)
https://sandbox.atlashlth.com/api/v1
# Interactive API Explorer (Swagger UI)
https://atlashlth.com/api/v1/docsRate Limits
| Tier | Requests / min | Requests / day | Webhooks |
|---|---|---|---|
| Sandbox | 60 | 1,000 | 3 endpoints |
| Starter | 300 | 50,000 | 10 endpoints |
| Enterprise | 2,000 | Unlimited | Unlimited |