CoAuth developer portal

Home · OpenAPI · Agent instructions · About · Contact · Terms

Two ways to integrate

1. WebMCP tools (primary). Open the site in an agentic browser (ChatGPT's browser, or Chrome 149+ with WebMCP enabled). The page registers 13 tools on document.modelContext and navigator.modelContext. Call get_workflow_guidance first to learn the sequence and safety rules. Full tool list: /llms-full.txt.

2. Read-only REST API. The seed data behind the cockpit is also exposed as a small REST API, described by /openapi.json. No authentication is required; the endpoints are read-only and return fictional demo data.

Quickstart (REST, versioned)

# Fetch a patient record
curl https://coauth.vercel.app/api/v1/patient/jane-doe

# Fetch a payer's required fields and policy
curl "https://coauth.vercel.app/api/v1/payer-rules?payer=uhc"

# Validate a submission
curl -X POST https://coauth.vercel.app/api/v1/validate \
  -H "content-type: application/json" \
  -d '{"payer":"uhc","formFields":{"member_id":"UHC-88213"}}'

The unversioned /api/* paths still work as deprecated aliases and send Deprecation, Sunset, and Link: rel="successor-version" headers.

MCP server

A Model Context Protocol server is available over Streamable HTTP at /.well-known/mcp (protocol 2025-06-18, with 2025-03-26 accepted). It exposes get_patient, get_payer_rules and validate_submission.

Why this is a smaller set than the in-page tools. The thirteen WebMCP tools act on a live workspace that exists only in the browser: filling a field, accepting a draft or signing changes what the clinician is looking at. A stateless HTTP server has no such workspace, so it offers the three operations that are meaningful without one. Submission always requires a clinician signature and is never available over MCP.

curl -X POST https://coauth.vercel.app/.well-known/mcp \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Verifying the gate yourself

The approval gate is the claim worth checking, so check it. Sign a submission, then try to submit a different one with the same approval:

# mint an approval for one exact submission
curl -X POST https://coauth.vercel.app/api/v1/sign   -H "content-type: application/json"   -d '{"payer":"uhc","formFields":{"member_id":"UHC-88213","dose":"40 mg"},
       "attestation":"I attest.","signer":"Your Name"}'

# submitting with no approval at all
curl -X POST https://coauth.vercel.app/api/v1/submit   -H "content-type: application/json"   -d '{"payer":"uhc","formFields":{"member_id":"UHC-88213","dose":"40 mg"}}'
# -> approval_required

The repository ships the full set as npm run verify, which also runs it against a browser.

Sandbox

Every endpoint above is a live, no-cost sandbox: it serves fictional demo data only, so you can call it freely without side effects. There is nothing to reset, and the read endpoints have no quota to exhaust. Copy any command into your terminal to try it now.

Authentication and limits

The read endpoints listed above are public: no API keys, no OAuth, no quota. Please be considerate with automated traffic.

The two endpoints that are not read-only work differently. /api/v1/sign mints a clinician approval and needs an authenticated clinician session and that clinician's credential supplied with the request; a session on its own is not enough, because any script running in the page carries one. /api/v1/submit accepts a submission only with an approval minted for that exact payer, chart, form and set of clinical overrides. Both /api/v1/login and /api/v1/sign are rate limited per caller and globally; exceeding it returns 429 with a Retry-After header.

Errors

Errors are returned as JSON with a stable shape: { "error": { "code", "message", "hint" } } and the appropriate HTTP status (400 or 404). Unknown /api/* paths return a JSON 404, never an HTML page.

Versioning

The API is versioned 1.0.0 in the OpenAPI info block. Breaking changes will ship under a new path prefix and be announced via a Deprecation / Sunset header on the old routes.