Developers
ScribeMDPro API
Bring ambient clinical documentation into your EMR, telehealth platform or hospital system. This portal documents the planned public API surface so integration teams can design against it today.
Status
The public API is in design. Endpoints, payload shapes and webhook events below are the committed contract; keys are issued to design partners on request. Nothing here is billable or live yet.
Authentication
Bearer API keys, scoped per organisation. Keys are issued and rotated from the hospital administration console and are never embedded in client-side code.
curl https://scribemd.site/api/v1/consultations \
-H "Authorization: Bearer $SCRIBEMD_API_KEY" \
-H "Content-Type: application/json"- Transport
- HTTPS only. Requests over plain HTTP are rejected, not redirected.
- Key scope
- Each key is bound to one organisation and one environment, with least-privilege scopes (read, write, admin).
- Rotation
- Keys support overlapping rotation windows so integrations can roll credentials with no downtime.
- Storage
- Store keys as server-side secrets. A key exposed in browser or mobile code must be revoked immediately.
Core endpoints
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/consultations | List consultations for the authenticated organisation (metadata only). |
| POST | /api/v1/consultations | Create a consultation record before uploading audio. |
| POST | /api/v1/consultations/:id/audio | Upload an audio file for transcription. |
| GET | /api/v1/consultations/:id/transcript | Retrieve the transcript with per-segment confidence and timestamps. |
| GET | /api/v1/consultations/:id/note | Retrieve the generated SOAP note and its clinician-review state. |
| GET | /api/v1/usage | Aggregate usage counters for billing reconciliation. |
A SOAP note is never returned with a finalized state until a clinician has reviewed and approved it in the application. The API surfaces AI output as a draft — it cannot be used to bypass clinician review.
Rate limits
60 requests / minute per key, burst of 120. Suitable for single-clinic integrations.
600 requests / minute per organisation, negotiated per deployment.
Concurrency-limited rather than rate-limited, sized to the plan's active clinician count.
429 responses include Retry-After. Clients must honour it with exponential backoff and jitter.
Webhooks
Subscribe to lifecycle events instead of polling. Every delivery is signed; verify the signature before trusting the payload.
{
"id": "evt_01H...",
"type": "note.finalized",
"created_at": "2026-08-01T09:14:22Z",
"data": {
"consultation_id": "c_01H...",
"clinician_reviewed": true,
"language": "yo",
"duration_seconds": 412
}
}const expected = crypto
.createHmac("sha256", process.env.SCRIBEMD_WEBHOOK_SECRET)
.update(rawBody)
.digest("hex");
// always compare in constant time
if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
return new Response("Invalid signature", { status: 401 });
}- consultation.created
- A consultation record was opened.
- transcript.completed
- Transcription finished; confidence metrics are available.
- note.drafted
- An AI draft note was generated and awaits clinician review.
- note.finalized
- A clinician reviewed and approved the note.
- subscription.updated
- A billing state change occurred for the organisation.
- Payload policy
- Webhook payloads carry identifiers and metadata only — never transcripts, note bodies or patient-identifying content.
SDKs
First-class SDK with typed responses and webhook helpers.
For research groups and data teams working with aggregate usage exports.
A machine-readable specification will be published so teams can generate clients in any language.
Integrating ScribeMDPro? Let's talk early.
Design partners get API keys, direct engineering contact and influence over the endpoint contract.