API RESOURCE

Pazienti

Patient file: demographic information, anamnesis/allergies, medical history and documents. Every record is isolated to your clinic; deletion is a reversible archiving (no hard-delete).

Early Access All API

Endpoints

9 endpoint

Endpoints for this resource. Every endpoint is scoped to the clinic data the API key is bound to; write endpoints support the Idempotency-Key header.

GET /v1/patients Retrieves the patient list with pagination All authorized roles

POST /v1/patients Creates a new patient record admin · secretary · physician

GET /v1/patients/{id} Retrieves the details of a single patient All authorized roles

PUT /v1/patients/{id} Updates patient information admin · secretary · physician

DELETE /v1/patients/{id} Archives the patient (soft-delete) admin

GET /v1/patients/{id}/medical Lists anamnesis, allergies and medical history All authorized roles

POST /v1/patients/{id}/medical Adds a medical/anamnesis record admin · physician

GET /v1/patients/{id}/documents Lists patient documents All authorized roles

POST /v1/patients/{id}/documents Adds a document to the patient admin · secretary

Example Usage

Create a new patient

Request

curl -X POST https://api.udentiva.com/v1/patients \
  -H "Authorization: Bearer udk_live_xxx" \
  -H "Idempotency-Key: 9f1c2e7a-..." \
  -H "Content-Type: application/json" \
  -d '{"first_name":"Ayse","last_name":"Yilmaz","phone":"+90555..."}'

Response

HTTP/1.1 201 Created
{
  "id": "c0ffee00-1234-...",
  "first_name": "Ayse",
  "last_name": "Yilmaz",
  "phone": "+90555...",
  "created_at": "2026-06-24T09:00:00Z"
}

Security in this resource

Security isn't a feature, it's the architecture itself. The guarantees that apply to this resource:

Data isolation: all patient queries are constrained at the row level (RLS) to the clinic the key is bound to; another clinic's patient is never returned.

Role-based authorization: creation/update by admin, secretary or physician; deletion only by admin. Authorization is enforced at the API layer.

Sensitive data (TCKN, health data) is masked and is never written raw to the audit log.

Deletion = soft-delete (deleted_at); the record is anonymized, not physically deleted (KVKK compliant).

Full security model →

Error Format

Errors are returned in a consistent envelope; the code is for the machine, the message for the user. Internal error/stack is never leaked.

{
  "error": {
    "code": "validation_failed",
    "message": "Invalid field: email"
  }
}

Other Resources

Appuntamenti & Calendario Odontogram & Treatment Collections & Finance Magazzino Imaging Laboratorio Lead & CRM Turismo Sanitario Reporting & BI Webhooks Data Transfer (Export API)

Want early access?

Be the first to know when the API opens.

Contattaci