These reference docs are public — read the whole API before you sign up. Running the calls needs sandbox credentials, issued after business (KYB) and identity (KYC) verification. No live money or live patient data is reachable from the sandbox tier; production access is a separate approval.
Docs OpenAPI reference Reference OpenAPI reference The 27 public operations in the OpenAPI 3.1 document, rendered from the same source that GET /openapi.json serves. If an operation is not here, it is not part of the public surface.
Fetch the machine-readable document at /openapi.json. Both SDKs are generated from it, and CI fails when either SDK falls behind it. Examples are sandbox-shaped and contain no patient data.
Clearinghouse (6 operations) Eligibility (3 operations) Credentialing (1 operation) FHIR (9 operations) Webhook Subscriptions (6 operations) ShtegID (1 operation) Referrals (1 operation) Tag Clearinghouse 837P/837I claim build and transmit stamped with the shteg.ai Type-2 NPI, NCCI/MUE/laterality scrubbing, live 276/277 status inquiry, replacement-claim appeals, and 835 ERA posting. Fails closed before anything leaves the gateway.
GET /api/claimsList tenant 837P claims with recent remittances
Operation claimsListAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description patientIdquery no Filter by patient id. statusquery no Filter by claim status.
Response example (sandbox-shaped)
{
"count": 1,
"claims": [
{
"id": "clm_sandbox_0001",
"status": "SUBMITTED",
"payerName": "Sandbox Health Plan",
"totalChargeCents": 42350,
"serviceDate": "2026-07-10",
"submissionReference": "ACK-SANDBOX-0001",
"remittances": []
}
]
} POST /api/claims/submitBuild and transmit an 837P stamped with the shteg.ai Type-2 NPI
Operation claimsSubmitAuth Session cookie Retries Never retried by the SDKs. Request example (sandbox-shaped)
{
"payerId": "payer_sandbox",
"patientId": "pat_sandbox_0001",
"encounterId": "enc_sandbox_0001",
"serviceDate": "2026-07-10",
"placeOfService": "11",
"totalCharge": 42350,
"diagnosisCodes": [
"H2513"
],
"procedureCodes": [
"66984"
],
"renderingNpi": "1861959999",
"idempotencyKey": "idem_sandbox_0001"
} Response example (sandbox-shaped)
{
"ok": true,
"claimId": "clm_sandbox_0001",
"status": "SUBMITTED",
"acknowledgmentId": "ACK-SANDBOX-0001",
"transport": "sandbox-transport",
"mode": "sandbox",
"message": "Accepted (sandbox-shaped example — no real 837P transmitted)",
"correlationId": "b1a2c3d4-…"
} POST /api/claims/{id}/appealResubmit as a replacement claim (NUBC frequency 7)
Operation claimAppealAuth Session cookie Retries Never retried by the SDKs. Parameter In Required Description idpath yes The claim identifier.
Request example (sandbox-shaped)
{
"originalClaimRef": "PAYERCTRL-000123"
} Response example (sandbox-shaped)
{
"ok": true,
"claimId": "clm_sandbox_0001",
"status": "SUBMITTED",
"appealStatus": "RESUBMITTED",
"frequencyCode": "7",
"originalClaimRef": "PAYERCTRL-000123",
"transport": "sandbox-transport",
"mode": "sandbox"
} GET /api/claims/{id}/scrubRead the last persisted scrub verdict
Operation claimScrubReadAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description idpath yes The claim identifier.
Response example (sandbox-shaped)
{
"claimId": "clm_sandbox_0001",
"scrubbed": false,
"status": "unscrubbed",
"readyToSubmit": false,
"findings": []
} POST /api/claims/{id}/scrubRun and persist the NCCI/MUE/laterality scrubber verdict
Operation claimScrubAuth Session cookie Retries Never retried by the SDKs. Parameter In Required Description idpath yes The claim identifier.
Response example (sandbox-shaped)
{
"claimId": "clm_sandbox_0001",
"scrubbed": true,
"status": "clean",
"readyToSubmit": true,
"findings": [],
"checksRun": [
"NCCI",
"MUE",
"laterality"
],
"checksSkipped": [],
"notReadyReasons": [],
"editSources": [
"CMS-NCCI-2026Q3"
],
"scrubbedAt": "2026-07-14T18:00:00.000Z"
} GET /api/claims/{id}/statusLocal status plus a live 276/277 payer inquiry
Operation claimStatusAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description idpath yes The claim identifier.
Response example (sandbox-shaped)
{
"claimId": "clm_sandbox_0001",
"localStatus": "SUBMITTED",
"payerName": "Sandbox Health Plan",
"submissionReference": "ACK-SANDBOX-0001",
"transport": {
"id": "stat_sandbox_0001",
"mode": "sandbox",
"status": "ACKNOWLEDGED",
"categoryCode": "A1",
"statusCode": "20",
"paidAmountCents": null,
"totalChargeCents": 42350,
"conflict": false,
"message": "Acknowledged by payer (sandbox-shaped)."
},
"correlationId": "b1a2c3d4-…"
} Tag Eligibility Real-time X12 270/271 coverage checks (single-patient and day-roster). Production never simulates coverage — a missing live path fails closed.
POST /api/eligibility/rosterBatch 270/271 across a day's appointment roster
Operation eligibilityRosterAuth Session cookie Retries Never retried by the SDKs. Request example (sandbox-shaped)
{
"appointments": [
{
"patientId": "pat_sandbox_0001",
"memberId": "MBR000123",
"payerId": "60054"
},
{
"patientId": "pat_sandbox_0002",
"memberId": "MBR000124",
"payerId": "60054"
}
],
"provider": "1861959999",
"concurrency": 4
} Response example (sandbox-shaped)
{
"summary": {
"total": 2,
"active": 1,
"inactive": 0,
"unknown": 1,
"skipped": 0
},
"results": [
{
"patientId": "pat_sandbox_0001",
"eligible": true
},
{
"patientId": "pat_sandbox_0002",
"eligible": "unknown"
}
]
} GET /api/eligibility/verifyRead the last cached 271 for a patient
Operation eligibilityReadAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description patientIdquery yes The clinic patient id.
Response example (sandbox-shaped)
{
"mode": "sandbox",
"eligible": true,
"memberId": "MBR000123",
"planName": "Sandbox PPO",
"cachedAt": "2026-07-14T06:00:00.000Z",
"isStale": false
} POST /api/eligibility/verifyReal-time single-patient X12 270/271 coverage check
Operation eligibilityVerifyAuth Session cookie Retries Never retried by the SDKs. Request example (sandbox-shaped)
{
"firstName": "Sandbox",
"lastName": "Patient",
"dob": "1975-04-12",
"memberId": "MBR000123",
"payerName": "Sandbox Health Plan",
"npi": "1861959999",
"patientId": "pat_sandbox_0001"
} Response example (sandbox-shaped)
{
"mode": "sandbox",
"eligible": true,
"memberId": "MBR000123",
"memberName": "Sandbox Patient",
"planName": "Sandbox PPO",
"groupNumber": "GRP0001",
"deductible": {
"individual": 1500,
"met": 400,
"remaining": 1100
},
"outOfPocket": {
"individual": 6000,
"met": 900,
"remaining": 5100
},
"copay": {
"specialist": 50,
"primaryCare": 25
},
"coinsurance": 20,
"network": "in-network",
"priorAuthRequired": false,
"verifiedAt": "2026-07-14T18:00:00.000Z",
"cacheHit": false
} Tag Credentialing There is no standalone credentialing endpoint: credentialing IS gate condition 6 (composite OIG-LEIE + NPPES + PSV screening) inside the money path. This tag exposes only the PHI-free provider directory the screener resolves NPIs against.
GET /api/providersPHI-free active-provider directory
Operation providersListAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Response example (sandbox-shaped)
[
{
"id": "prov_sandbox_0001",
"firstName": "Ada",
"lastName": "Ophthalmos",
"specialty": "Ophthalmology"
},
{
"id": "prov_sandbox_0002",
"firstName": "Boyd",
"lastName": "Retina",
"specialty": null
}
] Tag FHIR FHIR R4 CapabilityStatement, resource read/search, Bulk Data $export, CMS Patient Access, SMART App Launch context, CDS Hooks discovery, C-CDA export, and Blue Button 2.0 inbound import. The CapabilityStatement is the authoritative list of honored interactions; prose is not.
GET /api/fhirFHIR R4 resource read/search
Operation fhirReadSearchAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description typequery yes FHIR resource type (alias `resourceType`), e.g. `Patient`. idquery no A specific resource id to read. patientquery no Required for patient-compartment searches.
Response example (sandbox-shaped)
{
"resourceType": "Bundle",
"type": "searchset",
"total": 0,
"entry": []
} GET /api/fhir/Group/{groupId}/exportGroup-scope Bulk Data $export kickoff
Operation fhirGroupExportAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description groupIdpath yes The FHIR Group id. Preferheader no Send `respond-async`.
Response example (sandbox-shaped)
202 Accepted — Content-Location: <bulk-status polling URL> (no JSON body). GET /api/fhir/Patient/$exportPatient-scope Bulk Data $export kickoff
Operation fhirPatientExportAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description Preferheader no Send `respond-async`. _typequery no Comma list of US-Core resource types. _sincequery no Only resources changed since this instant. _outputFormatquery no Defaults to `application/fhir+ndjson`.
Response example (sandbox-shaped)
202 Accepted — Content-Location: <bulk-status polling URL with signed job token> (no JSON body). GET /api/fhir/bulk-status/{jobId}Poll an async $export job
Operation fhirBulkStatusAuth Bearer job token (signed $export token) Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description jobIdpath yes The $export job id.
Response example (sandbox-shaped)
{
"transactionTime": "2026-07-14T18:00:00.000Z",
"request": "https://api.shteg.ai/api/fhir/Patient/$export",
"requiresAccessToken": true,
"output": []
} GET /api/fhir/cds-servicesCDS Hooks discovery catalogue
Operation cdsServicesDiscoveryAuth Public (edge baseline only — no session required) Retries Idempotent; the SDKs retry 408/429/5xx. Response example (sandbox-shaped)
{
"services": [
{
"hook": "medication-prescribe",
"id": "medication-safety",
"title": "Medication safety",
"description": "Interaction and allergy checks at prescribe time."
}
]
} GET /api/fhir/metadataFHIR R4 CapabilityStatement
Operation fhirMetadataAuth Public (edge baseline only — no session required) Retries Idempotent; the SDKs retry 408/429/5xx. Response example (sandbox-shaped)
{
"resourceType": "CapabilityStatement",
"status": "active",
"fhirVersion": "4.0.1"
} GET /api/fhir/patient-accessCMS Patient Access API — a patient's own US Core bundle
Operation fhirPatientAccessAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description patientquery yes The patient id in scope.
Response example (sandbox-shaped)
{
"resourceType": "Bundle",
"type": "searchset",
"total": 0,
"entry": []
} GET /api/interop/ccda/{encounterId}Generate a Consolidated CDA (C-CDA) for an encounter
Operation interopCcdaAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description encounterIdpath yes The encounter identifier.
Response example (sandbox-shaped)
200 OK — application/xml C-CDA document (ClinicalDocument XML body). GET /api/smart/contextResolve SMART App Launch context
Operation smartContextAuth SMART access token (Bearer) Retries Idempotent; the SDKs retry 408/429/5xx. Response example (sandbox-shaped)
{
"active": true,
"patient": "pat_sandbox_0001",
"encounter": "enc_sandbox_0001",
"scope": "launch patient/*.read",
"fhirUser": "Practitioner/prov_sandbox_0001",
"client_id": "client_sandbox_0001",
"exp": 1784400000
} Tag Webhook Subscriptions Self-serve OUTBOUND webhooks. Create an endpoint (the signing secret is shown once), filter by event type (claim.*, remittance.*, eligibility_snapshot.*, invoice.*, settlement.* status-only, attestation.*), and replay deliveries. Each delivery is signed X-Shteg-Signature-256: sha256=HMAC-SHA256(secret, timestamp + '.' + body), carries a stable X-Shteg-Delivery id, is ordered per object, and retries 7 times (1m→24h). Bodies are thin: ids and status only — no PHI, no amounts.
GET /api/webhook-subscriptionsList webhook endpoints (cursor envelope)
Operation webhookSubscriptionsListAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description cursorquery no next_cursor from the previous page limitquery no 1–100, default 25
Response example (sandbox-shaped)
{
"object": "list",
"data": [
{
"object": "webhook_endpoint",
"id": "ep_sandbox_0001",
"url": "https://hooks.example.com/shteg",
"status": "ACTIVE",
"event_types": [
"claim.*"
]
}
],
"next_cursor": null
} POST /api/webhook-subscriptionsCreate a webhook endpoint (secret returned once)
Operation webhookSubscriptionsCreateAuth Session cookie Retries Never retried by the SDKs. Request example (sandbox-shaped)
{
"url": "https://hooks.example.com/shteg",
"event_types": [
"claim.*",
"remittance.posted"
]
} Response example (sandbox-shaped)
{
"object": "webhook_endpoint",
"id": "ep_sandbox_0001",
"url": "https://hooks.example.com/shteg",
"status": "ACTIVE",
"event_types": [
"claim.*",
"remittance.posted"
],
"secret": "whsec_sandbox_shown_once"
} GET /api/webhook-subscriptions/{id}Read a webhook endpoint (never includes the secret)
Operation webhookSubscriptionReadAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description idpath yes Webhook endpoint id (the `id` returned on create); another tenant's id is 404, never 403.
Response example (sandbox-shaped)
{
"object": "webhook_endpoint",
"id": "ep_sandbox_0001",
"url": "https://hooks.example.com/shteg",
"status": "ACTIVE",
"event_types": [
"claim.*"
]
} PATCH /api/webhook-subscriptions/{id}Update url, event_types, description or status
Operation webhookSubscriptionUpdateAuth Session cookie Retries Never retried by the SDKs. Parameter In Required Description idpath yes Webhook endpoint id (the `id` returned on create); another tenant's id is 404, never 403.
Request example (sandbox-shaped)
{
"status": "DISABLED"
} Response example (sandbox-shaped)
{
"object": "webhook_endpoint",
"id": "ep_sandbox_0001",
"url": "https://hooks.example.com/shteg",
"status": "DISABLED",
"event_types": [
"claim.*"
]
} DELETE /api/webhook-subscriptions/{id}Delete a webhook endpoint
Operation webhookSubscriptionDeleteAuth Session cookie Retries Never retried by the SDKs. Parameter In Required Description idpath yes Webhook endpoint id (the `id` returned on create); another tenant's id is 404, never 403.
Response example (sandbox-shaped)
204 No Content POST /api/webhook-subscriptions/{id}/replayReplay one delivery_id, or a since/until window (≤1000), with original ids; 202
Operation webhookSubscriptionReplayAuth Session cookie Retries Never retried by the SDKs. Parameter In Required Description idpath yes Webhook endpoint id (the `id` returned on create); another tenant's id is 404, never 403.
Request example (sandbox-shaped)
{
"since": "2026-10-20T00:00:00Z",
"types": [
"claim.paid"
]
} Response example (sandbox-shaped)
{
"object": "replay",
"replayed": 1,
"delivery_ids": [
"dlv_sandbox_0001"
]
} Tag ShtegID Public signature check for ShtegID executive contact cards. Business contact data only, no PHI. 503 until the card secret is configured.
GET /api/v1/shtegid/verifyVerify a ShtegID contact-card signature (public, rate-limited)
Operation shtegIdVerifyAuth Public (edge baseline only — no session required) Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description idquery yes Card id, e.g. SHTEG-EXEC-0001 sigquery yes Hex HMAC-SHA256 from the card's X-SHTEG-HMAC
Response example (sandbox-shaped)
{
"status": "valid"
} Tag Referrals Referral objects on the /api/v1 surface (ADR openapi-conventions). Read-only status_history projection: [{object, status, changed_at, changed_by, via?}] oldest first, cursor-paged, PHI-free (ids, statuses, timestamps). Public ids are ref_<cuid>; another clinic's referral is 404.
GET /api/v1/referrals/{id}/status_historyReferral status history (read-only projection, cursor envelope)
Operation referralStatusHistoryAuth Session cookie Retries Idempotent; the SDKs retry 408/429/5xx. Parameter In Required Description idpath yes Public referral id (ref_<cuid>); any other prefix is 404. cursorquery no next_cursor from the previous page limitquery no Integer 1–100, default 25; out of range is 400 invalid_limit
Response example (sandbox-shaped)
{
"object": "list",
"data": [
{
"object": "status_change",
"status": "SENT",
"changed_at": "2026-10-20T14:00:00.000Z",
"changed_by": "cksandboxuser0001",
"via": "fax"
},
{
"object": "status_change",
"status": "NO_RESPONSE",
"changed_at": "2026-11-19T14:00:00.000Z",
"changed_by": null
}
],
"next_cursor": null
}