Every route that exists. No roadmap rows.
If an endpoint is on this page it is implemented, covered by tests and reachable today. A reference that documents intentions alongside reality is worse than no reference, because it teaches a reader to distrust the parts that were true.
https://api.attergo.com
Bearer session for user routes. Per-facility basic credential for ingestion. Two-factor is mandatory on every account.
Integer minor units everywhere. A build gate fails the repository if a monetary value is ever typed as a float.
Ingestion
Authenticated by per-facility credential, not by a user session. This is the only endpoint your systems call.
| Method | Path | Returns |
|---|---|---|
| POST | /ingest/pioneerrx | Accept one event. Idempotent, archived raw, JSON or XML. |
Identity
Two-factor is required on every account. There is no configuration that turns it off.
| Method | Path | Returns |
|---|---|---|
| POST | /auth/login | Exchange credentials for a session, or a two-factor challenge. |
| POST | /auth/totp/confirm | Complete the second factor and issue the session. |
| GET | /auth/me | The current principal, its tenant, its facilities and its permissions. |
Events
The spine every product reads from.
| Method | Path | Returns |
|---|---|---|
| GET | /events/feed | Recent events for the caller's tenant, newest first. |
| GET | /events/stats | Ingestion counts and the last received time, per facility. |
Margin
Money is an integer number of cents in every request and response on this platform.
| Method | Path | Returns |
|---|---|---|
| GET | /margin/queue | Fills that need a decision, oldest first. |
| POST | /margin/queue/:id/ack | Acknowledge a queue item and record who did it. |
| GET | /margin/fills | Priced fills with the provenance of every cost. |
| GET | /margin/summary | Protected, lost and unpriced totals for a window. |
| GET | /margin/costs | Current acquisition costs and where each came from. |
| POST | /margin/costs/import | Import wholesaler invoice costs and re-margin affected fills. |
Billing
Claim transport is owned by the worker. The API builds drafts; it never speaks to a clearinghouse in a request.
| Method | Path | Returns |
|---|---|---|
| GET | /billing/encounters | Billable encounters detected from the event stream. |
| POST | /billing/encounters/:id/ready | Mark an encounter documented and ready to claim. |
| POST | /billing/encounters/:id/dismiss | Dismiss an encounter with a recorded reason. |
| POST | /billing/encounters/:id/claim | Build the 837P draft and hand it to the worker. |
| GET | /billing/claims | Claims and their lifecycle state. |
| GET | /billing/claims/:id | One claim with its transport history and remittance. |
| GET | /billing/summary | Submitted, paid, denied and appealable totals. |
Audit
Response packages are assembled from the immutable archive, never from editable state.
| Method | Path | Returns |
|---|---|---|
| POST | /audit/cases | Open a case from a payer letter and its claim list. |
| GET | /audit/cases | Open and closed cases with deadlines. |
| GET | /audit/cases/:id | One case, its claims and what matched. |
| GET | /audit/cases/:id/package | The response package, documentation attached per claim. |
| POST | /audit/cases/:id/responded | Record that a response was sent, and when. |
| GET | /audit/summary | Exposure and readiness across open cases. |
Authorizations
Detected from the adjudication rejection itself, so nobody has to notice anything.
| Method | Path | Returns |
|---|---|---|
| GET | /authorizations | Every open request, its age and its owner. |
| POST | /authorizations/:id/submit | Submit a request with its clinical attachments. |
| GET | /authorizations/summary | Open, stalled and expiring counts. |
Inventory
Forecasts are computed from the tenant's own dispensing history. There is no benchmark dataset.
| Method | Path | Returns |
|---|---|---|
| GET | /inventory/velocity | Dispensing velocity per item, per facility. |
| GET | /inventory/dead-stock | What is not moving, in dollars and in days. |
| GET | /inventory/trace | DSCSA traceability lookup. |
| GET | /inventory/summary | Capital on shelf and exposure. |
Compliance
Obligations carry an owner and a date. An item without both is not an obligation, it is a note.
| Method | Path | Returns |
|---|---|---|
| GET | /compliance/items | The register, ranked by consequence. |
| POST | /compliance/items | Record an obligation with its owner and expiry. |
| POST | /compliance/items/:id/resolve | Resolve an item and keep the evidence. |
| GET | /compliance/summary | Readiness score and what is driving it. |
Intelligence
Reconciles against the other products by construction. If a figure here disagreed with the product it came from, one of them would be wrong.
| Method | Path | Returns |
|---|---|---|
| GET | /intelligence/overview | Cross-product figures for a tenant and window. |
The parts a security review actually asks about.
- Tenancy
- Every request runs inside a transaction with the tenant set as a scoped database parameter. Row-level security is enabled and forced on every tenant table, with per-command policies and a check on write, so a tenant cannot read another tenant's rows and cannot write a row stamped with another tenant's identifier. The application role cannot bypass it.
- Permissions
- Deny by default. A route with no explicit permission is unreachable rather than public, and a coverage gate fails the build if a controller ships without one. That inversion matters: the common failure is not a wrong permission, it is a missing one.
- Protected health information
- Never in a URL, a query string, an error message or a log line. A field registry defines what counts, a redacting serializer wraps the logger, and a test walks the source and fails the build if a registered field reaches a log call.
- Reads are recorded
- Access to protected data is written to an append-only log, not only writes. When someone asks who saw what and when, that has to be a query rather than an investigation.