One endpoint. Everything else is a consequence.
Every product on the platform is fed by the same event spine. Connecting a facility means issuing one credential and pointing your system at one URL. There is no second project when you turn on the next product.
Authenticate
Per-facility credentials are resolved to a tenant before a single byte is parsed. An unauthenticated request never reaches the parser.
Archive
The exact bytes are written to an append-only store with the received time, the principal, the source address, the content type and a content hash. Oversized bodies spill to object storage and are referenced by key.
Deduplicate
A deterministic key is derived and checked against a unique index. A duplicate returns 200 and writes nothing further.
Queue
The request returns. Normalization happens in a worker, so your system is never waiting on our processing time.
Project
Workers build the views each product reads. Projections are re-runnable from the archive, which is what makes a bug in interpretation recoverable rather than permanent.
Stages 1 to 4 happen inside the request. Stage 5 is asynchronous and re-runnable.
What you post, and what comes back.
Events are accepted as JSON or XML over HTTPS. The content type is sniffed and both are normalized to the same internal shape, because a dispensing system that emits XML should not be a smaller customer than one that emits JSON.
POST https://api.attergo.com/ingest/pioneerrx
Authorization: Basic <per-facility credential>
Content-Type: application/json
{
"eventType": "RxComplete",
"eventId": "9f2c1e40-...",
"facility": "store-1",
"occurredAt": "2026-08-01T14:22:31Z",
...
}Responses
| Status | Means | You should |
|---|---|---|
200 | Accepted, or already seen. | Nothing. A duplicate is not an error. |
202 | Accepted and archived, but not parseable. | Nothing. It is in the dead-letter table and is replayable once we map it. |
401 | The credential is wrong, revoked or for another facility. | Stop and check the credential. Retrying will not help. |
5xx | Our problem. | Retry on your normal schedule. Retries are always safe. |
Nothing is discarded for being unfamiliar. An unrecognised field is recorded for mapping review and the event still lands, so the week your vendor ships a release is not the week your integration stops.
Idempotency
The deduplication key is derived from the tenant, the event type and the vendor event identifier, falling back to a canonical hash of the payload when the vendor supplies no identifier. A unique index enforces it in the database rather than in application code, so two concurrent deliveries of the same event cannot both win a race.
You can replay your entire history at us and the result is identical to having sent it once, which is what makes onboarding a new facility safe.
Retention
Raw events are retained for a minimum of ten years. The archive is append-only at the database grant level: the application role holds no UPDATE and no DELETE permission on it, so the record cannot be edited by us or by anyone reaching us.
PioneerRx today, and anything that posts tomorrow.
Every vendor assumption lives in one isolated adapter package, enforced by a build gate that fails if vendor-specific parsing leaks into the core. Supporting another dispensing system, practice management system or HL7 feed means writing an adapter against a documented internal event shape, and leaving the spine, the products and the schema exactly where they are.
If you already have a system that can post JSON over HTTPS, you can send events to the same endpoint today and we will map them. Write to support@attergo.com.