Practitioner push API

A practice's records system sends conditions, allergies, immunizations or lab results to the patient's MyHealth-Passport for review. Nothing changes the patient's profile until the patient accepts it in the app.

Endpoint

POST https://my-health-passport.com/api/public/practitioner/push
Authorization: Bearer mhp_…
Content-Type: application/json

Authentication & consent

Calls use a practitioner API token (mhp_…) minted inside the app for one practitioner and one patient. Pushing requires the records:push scope, an active practitioner–patient grant, and the patient's sharing consent. Tokens expire (default 90 days, up to 365) and the patient can revoke them at any time. The raw token is shown once at creation; only its hash is stored.

Payload

One call carries 1–50 updates. data_type is one of condition, allergy, immunization, lab. external_id is your system's identifier — resending the same one is reported as a duplicate instead of creating a second entry.

{
  "updates": [
    {
      "data_type": "lab",
      "title": "HbA1c result",
      "body": "Glycated hemoglobin result for routine monitoring.",
      "external_id": "your-system-id-123",
      "proposed": { "test": "HbA1c", "value": 6.4, "unit": "%", "effective_date": "2026-10-20" }
    }
  ]
}

Response

{
  "results": [
    { "external_id": "your-system-id-123", "id": "c11a61dc-…", "status": "pending_patient_review" }
  ]
}

Statuses: pending_patient_review (accepted, awaiting the patient), duplicate (same external_id already received), error. The patient is notified in the app when new updates arrive.

Try it safely

The partner sandbox accepts the same payload shape against a simulated endpoint — no token, no real data.