OpenAPI Explorer

Everything below is generated from the server's own GET /metadata CapabilityStatement, so it describes what the running API actually declares rather than what someone remembered to write down. The only hand-maintained part is the authentication section, which lives in openapi.auth.yaml and is merged in during generation, because token endpoints are not FHIR resources and therefore never appear in a CapabilityStatement. If a resource type is missing from this explorer, that is not a documentation gap — it means the server does not declare it.

The exact same document is served by the API itself at https://rkyywwxpkzzkvopnobvt.supabase.co/functions/v1/api-docs/openapi.json, so you can point Postman, Insomnia, or a client generator at that URL and get precisely what you see here.

This page is a reference, not a console. Every operation shows its parameters, request and response bodies, a worked example, and per-status error examples — but it does not issue live calls. The endpoints act on production clinical data, and offering create/update/delete execution from a public page is a sharp edge with no upside for the people reading it.

To call the API for real: obtain a token with POST /authenticate followed by POST /select-staff-organization (both documented below), then send it as Authorization: Bearer <token>. Without one, every FHIR route answers 401 Missing FHIR authorization header — which is the server behaving correctly.