X-rays and clinical photos are attached to the patient file. Files are kept in S3-compatible object storage; never in the database.
Endpoints for this resource. Every endpoint is scoped to the clinic data the API key is bound to; write endpoints support the Idempotency-Key header.
/v1/patients/{id}/images
Lists the patient's images (X-ray/photo)
All authorized roles
/v1/patients/{id}/images
Uploads an image (S3, stream/presigned)
admin · physician · secretary
/v1/images/{id}/raw
Downloads the image file (presigned)
All authorized roles
List the patient's images
curl https://api.udentiva.com/v1/patients/{id}/images \
-H "Authorization: Bearer udk_live_xxx"
HTTP/1.1 200 OK
[
{
"id": "img-55",
"kind": "panoramic",
"url": "https://s3.../signed?expires=...",
"created_at": "2026-06-24T09:20:00Z"
}
]
Security isn't a feature, it's the architecture itself. The guarantees that apply to this resource:
Errors are returned in a consistent envelope; the code is for the machine, the message for the user. Internal error/stack is never leaked.
{
"error": {
"code": "validation_failed",
"message": "Invalid field: email"
}
}
We use cookies necessary for core functionality; analytics and marketing cookies are enabled only with your consent. कुकी नीति