API route status
Source snapshot: 2026-10-23. 245 API-server method/path pairs: 164 Done, 73 Not Implemented, 8 Partial.
Implemented success response shapes and before/after changes are listed in API success response audit. Development-only operations are listed separately below.
Done = handler/use case implemented. Not Implemented = valid requests return 501. Partial = implemented with the gaps noted below.
Prefix: /api/v1, except the metadata table. Methods sharing a path/status are grouped; explicit trailing-slash aliases are included.
The full organization summary route is GET /api/v1/admin/organizations/{organizationId}/summary.
| Methods | Route | Status |
|---|---|---|
| GET | /admin/accounts | Not Implemented |
| GET, PATCH | /admin/accounts/{userId} | Not Implemented |
| GET | /admin/audit-events | Done |
| GET | /admin/audit-events/{eventId} | Done |
| POST | /admin/auth/login | Done |
| GET | /admin/auth/verify | Done |
| GET | /admin/authorization/me | Done |
| GET | /admin/authorization/members/{userId} | Done |
| PUT, DELETE | /admin/authorization/members/{userId}/permissions/{permission}/{access} | Done |
| PUT, DELETE | /admin/authorization/members/{userId}/roles/{roleId} | Done |
| GET | /admin/authorization/permissions | Done |
| GET, POST | /admin/authorization/roles | Done |
| GET, PUT, DELETE | /admin/authorization/roles/{roleId} | Done |
| PUT | /admin/authorization/roles/{roleId}/permissions | Done |
| GET | /admin/invoices | Not Implemented |
| GET, PATCH | /admin/invoices/{invoiceId} | Not Implemented |
| POST | /admin/invoices/{invoiceId}/issue | Not Implemented |
| GET, POST | /admin/invoices/{invoiceId}/payments | Not Implemented |
| POST | /admin/invoices/{invoiceId}/void | Not Implemented |
| GET, POST | /admin/medicines/brands | Done |
| GET, PATCH, DELETE | /admin/medicines/brands/{id} | Done |
| POST | /admin/medicines/brands/{id}/restore | Done |
| GET, POST | /admin/medicines/drugs | Done |
| GET, PATCH, DELETE | /admin/medicines/drugs/{id} | Done |
| POST | /admin/medicines/drugs/{id}/restore | Done |
| GET, POST | /admin/medicines/generics | Done |
| GET, PATCH, DELETE | /admin/medicines/generics/{id} | Done |
| POST | /admin/medicines/generics/{id}/restore | Done |
| GET, POST | /admin/medicines/manufacturers | Done |
| GET, PATCH, DELETE | /admin/medicines/manufacturers/{id} | Done |
| POST | /admin/medicines/manufacturers/{id}/restore | Done |
| GET | /admin/organizations | Done |
| GET | /admin/organizations/{organizationId}/summary | Done |
| POST | /admin/organizations | Partial |
| GET, PUT, DELETE | /admin/organizations/{organizationId} | Done |
| POST | /admin/organizations/{organizationId}/activate | Done |
| POST | /admin/organizations/{organizationId}/members | Done |
| POST | /admin/organizations/{organizationId}/restore | Done |
| POST | /admin/organizations/{organizationId}/suspend | Done |
| GET | /admin/payments | Not Implemented |
| GET | /admin/payments/{paymentId} | Not Implemented |
| POST | /admin/payments/{paymentId}/void | Not Implemented |
| GET | /admin/profile | Done |
| GET, POST | /admin/subscription-plans | Not Implemented |
| GET, PATCH, DELETE | /admin/subscription-plans/{planId} | Not Implemented |
| GET, POST | /admin/subscriptions | Not Implemented |
| GET, PATCH, DELETE | /admin/subscriptions/{subscriptionId} | Not Implemented |
| POST | /admin/subscriptions/{subscriptionId}/extend | Not Implemented |
| GET, POST | /admin/subscriptions/{subscriptionId}/invoices | Not Implemented |
| GET, POST | /admin/users | Done |
| GET | /admin/users/{adminUserId} | Done |
| DELETE | /admin/users/{adminUserId} | Not Implemented |
| GET, POST | /admin/doctor-qualifications | Done |
| GET, PUT, DELETE | /admin/doctor-qualifications/{id} | Done |
| GET, POST | /admin/doctor-specialties | Done |
| GET, PUT, DELETE | /admin/doctor-specialties/{id} | Done |
| GET, POST | /admin/doctor-specializations | Done |
| GET, PUT, DELETE | /admin/doctor-specializations/{id} | Done |
| GET | /admin/doctors | Done |
| GET | /admin/doctors/{doctorId} | Done |
| GET | /admin/doctors/{doctorId}/organizations | Done |
| POST | /admin/doctors/{doctorId}/suspend | Done |
| POST | /admin/doctors/{doctorId}/activate | Done |
| POST | /admin/organizations/{organizationId}/doctors | Done |
| POST | /admin/verifications | Done |
| GET | /admin/verifications/pending | Done |
| GET | /admin/verifications/{verificationId} | Done |
| POST | /admin/verifications/{verificationId}/approve | Done |
| POST | /admin/verifications/{verificationId}/reject | Done |
| POST | /auth/email-verification | Done |
| POST | /auth/email-verification/confirm | Done |
| POST | /auth/login | Done |
| POST | /auth/logout | Done |
| POST | /auth/logout-all | Done |
| GET, PUT | /auth/me | Done |
| PUT | /auth/password | Done |
| POST | /auth/password/forgot | Done |
| POST | /auth/password/reset | Done |
| POST | /auth/refresh | Done |
| POST | /auth/register | Done |
| GET | /auth/sessions | Done |
| DELETE | /auth/sessions/{sessionId} | Done |
| POST | /doctors/auth/login | Done |
| GET | /doctors/auth/verify | Done |
| GET | /doctors/invitations/{token} | Not Implemented |
| PATCH | /doctors/profile | Implemented; profile updates |
| GET, POST | /doctors/me/join-requests | Not Implemented |
| POST | /doctors/me/join-requests/{requestId}/cancel | Not Implemented |
| GET | /doctors/me/organizations | Not Implemented |
| GET | /doctors/me/verifications | Not Implemented |
| GET | /doctors/organizations | Done |
| GET | /doctors/organizations/{organizationId} | Not Implemented |
| GET, POST | /doctors/patients | Done |
| GET, PATCH | /doctors/patients/{patientId} | Done |
| GET | /doctors/profile | Done |
| PUT | /doctors/profile/professional-details | Done |
| GET | /doctors/qualifications | Done |
| GET | /doctors/specialties | Done |
| GET | /doctors/specializations | Done |
| POST | /doctors/register | Done |
| GET | /medicines/brands | Done |
| GET | /medicines/brands/{id} | Done |
| GET | /medicines/drugs | Done |
| GET | /medicines/drugs/{id} | Done |
| GET | /medicines/generics | Done |
| GET | /medicines/generics/{id} | Done |
| GET | /medicines/manufacturers | Done |
| GET | /medicines/manufacturers/{id} | Done |
| GET | /notifications/ | Partial |
| POST | /notifications/send | Partial |
| GET, POST | /notifications/templates | Partial |
| GET, PUT | /notifications/templates/{id} | Partial |
| GET | /notifications/{id} | Partial |
| GET | /organizations | Not Implemented |
| GET | /organizations/active-context | Not Implemented |
| POST | /organizations/auth/login | Done |
| GET | /organizations/auth/verify | Done |
| GET | /organizations/{organizationId} | Not Implemented |
| POST | /organizations/{organizationId}/activate | Done |
| GET | /organizations/{organizationId}/audit-events | Done |
| GET | /organizations/{organizationId}/audit-events/{eventId} | Done |
| GET | /organizations/{organizationId}/authorization/me | Done |
| GET | /organizations/{organizationId}/authorization/members/{userId} | Done |
| PUT, DELETE | /organizations/{organizationId}/authorization/members/{userId}/permissions/{permission}/{access} | Done |
| PUT, DELETE | /organizations/{organizationId}/authorization/members/{userId}/roles/{roleId} | Done |
| GET | /organizations/{organizationId}/authorization/permissions | Done |
| GET, POST | /organizations/{organizationId}/authorization/roles | Done |
| GET, PUT, DELETE | /organizations/{organizationId}/authorization/roles/{roleId} | Done |
| PUT | /organizations/{organizationId}/authorization/roles/{roleId}/permissions | Done |
| GET | /organizations/{organizationId}/billing-history | Not Implemented |
| GET, POST | /organizations/{organizationId}/doctor-invitations | Not Implemented |
| POST | /organizations/{organizationId}/doctor-invitations/{invitationId}/revoke | Not Implemented |
| GET | /organizations/{organizationId}/doctor-join-requests | Not Implemented |
| POST | /organizations/{organizationId}/doctor-join-requests/{requestId}/accept | Not Implemented |
| POST | /organizations/{organizationId}/doctor-join-requests/{requestId}/reject | Not Implemented |
| GET | /organizations/{organizationId}/doctors | Done |
| GET, PATCH | /organizations/{organizationId}/doctors/{doctorId} | Not Implemented |
| GET, POST | /organizations/{organizationId}/members | Not Implemented |
| GET, PUT | /organizations/{organizationId}/members/{memberId} | Not Implemented |
| DELETE | /organizations/{organizationId}/members/{memberId} | Done |
| PUT | /organizations/{organizationId}/members/{memberId}/role | Not Implemented |
| PUT | /organizations/{organizationId}/members/{memberId}/team | Not Implemented |
| GET | /organizations/profile | Done |
| GET | /organizations/{organizationId}/subscription | Not Implemented |
| GET, POST | /organizations/{organizationId}/teams | Done |
| GET, PATCH, DELETE | /organizations/{organizationId}/teams/{teamId} | Not Implemented |
| GET, POST | /prescriptions | Not Implemented |
| GET | /prescriptions/patient-history/{patientId} | Not Implemented |
| GET, POST | /prescriptions/suggestions/advice | Done |
| GET, PATCH, DELETE | /prescriptions/suggestions/advice/{suggestionAdviceId} | Done |
| GET, POST | /prescriptions/suggestions/diagnosis | Done |
| GET, PATCH, DELETE | /prescriptions/suggestions/diagnosis/{suggestionDiagnosisId} | Done |
| GET, POST | /prescriptions/suggestions/investigation | Done |
| GET, PATCH, DELETE | /prescriptions/suggestions/investigation/{suggestionInvestigationId} | Done |
| GET, PATCH | /prescriptions/{prescriptionId} | Not Implemented |
| POST | /prescriptions/{prescriptionId}/cancel | Not Implemented |
| POST | /prescriptions/{prescriptionId}/issue | Not Implemented |
| GET | /subscriptions/plans | Not Implemented |
| GET | /subscriptions/plans/{planId} | Not Implemented |
Health and API metadata (no prefix)
| Methods | Route | Status |
|---|---|---|
| GET | /healthz | Done |
| GET | /openapi-3.0.json | Done |
| GET | /openapi-3.0.yaml | Done |
| GET | /openapi.json | Done |
| GET | /openapi.yaml | Done |
| GET | /schemas/{schema} | Done |
Partial implementation notes:
POST /admin/organizations: persistence works; the shared permission checker always allows access after identity verification./notifications/*: in-memory storage, console email/stub SMS, no authentication; the mount does not strip its prefix, preventing intended nested-handler dispatch.
Standalone docs server (services/openapi): Done — ANY / (Scalar fallback), GET, HEAD /openapi.yaml; separate from the API-server routes above.
Sources: api/openapi.yaml, services/api/cmd/server/{main,organization_legacy}.go, service HTTP registrations/use cases, and pkg/api/api.go (Huma metadata defaults).
Organization summary and affiliation contracts, mock billing boundaries, and retired routes are documented in Organization management API.
Development operations (no prefix)
These five implemented operations are available only in development environments and are included in the 245-route count above. They use the common JSON success envelope.
| Method | Route | Status |
|---|---|---|
| POST | /development/reset-database | Done |
| POST | /development/seed | Done |
| POST | /development/clean | Done |
| GET | /development/migrations/status | Done |
| POST | /development/migrations/apply-all | Done |
Clinical input suggestions
Doctor requires an active doctor session; Admin requires clinical suggestion read/manage grants.
| Method | Path | Success |
|---|---|---|
| GET | /api/v1/doctors/suggestions/chief-complaints | 200, non-null choice array |
| GET | /api/v1/admin/suggestions/chief-complaints | 200, management page |
| GET | /api/v1/admin/suggestions/chief-complaints/{id} | 200, record |
| POST | /api/v1/admin/suggestions/chief-complaints | 201, record |
| PATCH | /api/v1/admin/suggestions/chief-complaints/{id} | 200, record |
| DELETE | /api/v1/admin/suggestions/chief-complaints/{id} | 200, empty object |
| GET | /api/v1/doctors/suggestions/history | 200, non-null choice array |
| GET | /api/v1/admin/suggestions/history | 200, management page |
| GET | /api/v1/admin/suggestions/history/{id} | 200, record |
| POST | /api/v1/admin/suggestions/history | 201, record |
| PATCH | /api/v1/admin/suggestions/history/{id} | 200, record |
| DELETE | /api/v1/admin/suggestions/history/{id} | 200, empty object |