One endpoint. Everything else is a consequence.
Every product on the platform is fed by the same event spine. Connecting a facility means issuing one credential and pointing your system at one URL. There is no second project when you turn on the next product.
Authenticate
Per-facility credentials are resolved to a tenant before a single byte is parsed. An unauthenticated request never reaches the parser.
Archive
The exact bytes are written to an append-only store with the received time, the principal, the source address, the content type and a content hash. Oversized bodies spill to object storage and are referenced by key.
Deduplicate
A deterministic key is derived and checked against a unique index. A duplicate returns 200 and writes nothing further.
Queue
The request returns. Normalization happens in a worker, so your system is never waiting on our processing time.
Project
Workers build the views each product reads. Projections are re-runnable from the archive, which is what makes a bug in interpretation recoverable rather than permanent.
Stages 1 to 4 happen inside the request. Stage 5 is asynchronous and re-runnable.
What you post, and what comes back.
Events are accepted as JSON or XML over HTTPS. The content type is sniffed and both are normalized to the same internal shape, because a dispensing system that emits XML should not be a smaller customer than one that emits JSON.
POST https://api.attergo.com/ingest/pioneerrx
Authorization: Basic <per-facility credential>
Content-Type: application/json
{
"eventType": "RxComplete",
"eventId": "9f2c1e40-...",
"facility": "store-1",
"occurredAt": "2026-08-01T14:22:31Z",
...
}Responses
| Status | Means | You should |
|---|---|---|
200 | Accepted, or already seen. | Nothing. A duplicate is not an error. |
202 | Accepted and archived, but not parseable. | Nothing. It is in the dead-letter table and is replayable once we map it. |
401 | The credential is wrong, revoked or for another facility. | Stop and check the credential. Retrying will not help. |
5xx | Our problem. | Retry on your normal schedule. Retries are always safe. |
Note what is missing from that table: there is no status that means "your payload had a field we did not recognise, so we threw it away". Unknown fields are recorded for mapping review and the event still lands. An integration that rejects unfamiliar input is an integration that breaks the week your vendor ships a release.
Idempotency
The deduplication key is derived from the tenant, the event type and the vendor event identifier, falling back to a canonical hash of the payload when the vendor supplies no identifier. A unique index enforces it in the database rather than in application code, so two concurrent deliveries of the same event cannot both win a race.
The practical consequence is worth stating directly: you can replay your entire history at us and the result is identical to having sent it once. That is what makes onboarding a new facility safe.
Retention
Raw events are retained for a minimum of ten years. The archive is append-only at the database grant level, which means the application role holds no UPDATE or DELETE permission on it. Not "we do not delete from it". Cannot.
PioneerRx is the production adapter. It is not the boundary.
Every vendor assumption lives in one isolated adapter package, enforced by a build gate that fails if vendor-specific parsing leaks into the core. Supporting another dispensing system, practice management system or HL7 feed means writing an adapter against a documented internal event shape. It does not mean touching the spine, the products or the schema.
If you already have a system that can post JSON over HTTPS, you can send events to the same endpoint today and we will map them. Write to support@attergo.com.