API reference
The EDFlow Integration API reference: base URLs per environment, the pinned API version, conventions for ids, lists and incremental sync, errors, rate limits, the sandbox playground, and the OpenAPI and Postman downloads.
Every operation and webhook has its own page, generated from the OpenAPI 3.1 document the API itself validates requests against. The pages are listed in the navigation by tag.
Base URLs
| Environment | API | mTLS host |
|---|---|---|
| Sandbox | https://api.sandbox.edflow.space | https://mtls.api.sandbox.edflow.space |
| Customer test | https://api.test.edflow.space | https://mtls.api.test.edflow.space |
| Live | https://api.edflow.space | https://mtls.api.edflow.space |
A credential works only in its own environment. These hosts don't change when the product is renamed; a host change is announced 12 months ahead.
Versions
- The major version is in the URL (
/v1). - Dated minor versions (
2026-10-01, …) are pinned per app when it's created. Override per request with theApi-Versionheader; responses echo it. - See Versioning and deprecation.
Conventions
| Topic | Rule |
|---|---|
| Encoding | JSON, UTF-8, camelCase fields, snake_case enum values |
| Timestamps | Responses: UTC with Z and milliseconds. Requests: any offset; no offset is refused |
| Ids | Opaque and type-prefixed: enc_, req_, tsk_, code_, led_, app_, cred_, we_, msg_, dlv_, rid_. Sites use their code |
| Objects | Every object has object; mutable objects have an increasing version |
| Lists | { "object": "list", "data": [...], "hasMore", "nextCursor" }, limit 1–100 (default 25), cursors valid 24 hours |
| Incremental sync | Feeds accept updatedSince and return items by (updatedAt, id); items newer than 10 seconds are held back so nothing is skipped |
| Patient identifiers | Never in URLs. Visit numbers are accepted only in the body of POST /v1/encounters/lookup |
| Nulls | Optional values are returned as null, never omitted |
| Response headers | Request-Id, Api-Version, RateLimit-Policy, RateLimit, and Deprecation/Sunset on deprecated operations |
What reads return
Reads return EDFlow ids, workflow state and catalogue keys. Never names, age, sex, date of birth, CTAS, chief complaint, location or bed, test names, free text or device details. Every read of visit-linked data is recorded for the patient's access report.
Try it
Operation pages in this reference include a playground that sends requests to the sandbox only, through the docs site's proxy. Keys stay in your browser's memory.
Downloads
See also
Last updated on