API Overview

Base URLs

Service	URL
FHIR API	`https://rkyywwxpkzzkvopnobvt.supabase.co/functions/v1/fhir-api`
SMART Auth	`https://rkyywwxpkzzkvopnobvt.supabase.co/functions/v1/smart-auth`
HR API	`https://rkyywwxpkzzkvopnobvt.supabase.co/functions/v1/hr-api`
Inventory API	`https://rkyywwxpkzzkvopnobvt.supabase.co/functions/v1/inventory-api`

Authentication

All API requests (except smart-auth and public endpoints) require a SMART on FHIR JWT:

Authorization: Bearer <jwt-token>

Obtain a token via the Staff Login or Patient Login endpoints.

Common Request Patterns

Search (GET)

All FHIR resource searches support these common parameters:

Parameter	Type	Description
`_count`	number	Page size (default: 20)
`_offset`	number	Pagination offset (default: 0)
`_sort`	string	Sort field (prefix `-` for descending)
`_summary`	string	`count` returns only total count

Example:

GET /Patient?name=John&_count=10&_offset=0

Search Response (FHIR Bundle)

{
  "resourceType": "Bundle",
  "type": "searchset",
  "total": 42,
  "entry": [
    {
      "resource": {
        "resourceType": "Patient",
        "id": "patient-001",
        "name": [{ "given": ["John"], "family": "Doe" }]
      }
    }
  ]
}

Create (POST)

POST /Patient
Content-Type: application/json

{
  "resourceType": "Patient",
  "name": [{ "given": ["John"], "family": "Doe" }]
}

Read (GET)

GET /Patient/patient-001

Update (PUT)

PUT /Patient/patient-001
Content-Type: application/json

{ "resourceType": "Patient", "id": "patient-001", ... }

Delete (DELETE)

DELETE /Patient/patient-001

Error Responses

{
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "severity": "error",
      "code": "not-found",
      "diagnostics": "Patient/unknown-id not found"
    }
  ]
}

HTTP Status	Meaning
200	Success
201	Created
400	Bad request / validation error
401	Unauthorized (missing/invalid token)
403	Forbidden (insufficient permissions)
404	Resource not found
500	Internal server error

CORS

All Edge Functions return appropriate CORS headers. Preflight OPTIONS requests are handled automatically.

Public Endpoints

These endpoints do NOT require authentication:

Endpoint	Description
`GET /metadata`	FHIR CapabilityStatement
`GET /Organization/search-public`	Search public organizations
`GET /Organization/{id}/public-profile`	Public org profile
`GET /specializations`	List practice specialties
`GET /.well-known/smart-configuration`	SMART metadata