{ "openapi": "3.1.0", "info": { "title": "PEPTPlus Partner API", "version": "2026-10-29", "summary": "REST API for providers, pharmacies and labs on PEPTPlus.", "description": "The PEPTPlus Partner API lets provider practices read the prescribable catalog and track orders,\nlets pharmacies run fulfillment and manage their catalog (products, lots, certificates of analysis),\nand lets labs read their API listings and licensees. Every organization can register webhook endpoints.\n\nAuthentication: `Authorization: Bearer sk___<48 hex>` where org is prov, pharm or lab and env is\nlive or test. Keys are minted in the portal account pages. Live keys require an active organization with a\nBusiness Associate Agreement on file (pharmacies also need a plan; the base plan is free). The sandbox at\ndemo.pept.plus mints test keys only and holds synthetic data.\n\nEvery response carries `X-Request-Id` and `X-API-Version`; authenticated responses add the `X-RateLimit-*`\nheaders. Errors use one envelope: `{ \"error\": { \"type\", \"message\", \"request_id\", ... } }`. Unknown paths\nunder /api/v1 return that envelope with type `not_found` (HTTP 404), never an HTML page.\n\nDedicated hosts: https://api.pept.plus/v1 (production) and https://sandbox.api.pept.plus/v1 (sandbox) are\nplanned and will serve the same routes with /v1 in place of /api/v1 once the DNS bindings are live.\n\nPrescription writes are deferred until EPCS certification: a controlled prescription must be signed by the\nprescriber with their own two-factor credential inside the certified application, which an API key that\nidentifies a server cannot do.", "contact": { "name": "PEPTPlus developer support", "url": "https://pept.plus/developers" }, "termsOfService": "https://pept.plus/legal/terms" }, "servers": [ { "url": "https://pept.plus/api/v1", "description": "Production (live keys)." }, { "url": "https://demo.pept.plus/api/v1", "description": "Sandbox (test keys, synthetic data). sandbox.api.pept.plus will alias this host." } ], "security": [ { "bearerAuth": [] } ], "tags": [ { "name": "Catalog", "description": "Prescribable compounds visible to the calling organization." }, { "name": "Orders", "description": "Orders visible to the calling organization (provider or pharmacy)." }, { "name": "Pharmacy fulfillment", "description": "The pharmacy fulfillment queue: accept, set status, post shipment." }, { "name": "Pharmacy catalog", "description": "A pharmacy's own products, lots and certificates of analysis." }, { "name": "Labs", "description": "A lab's API listings and the pharmacies licensing them." }, { "name": "Webhooks", "description": "Webhook endpoint management. The delivery contract is under the top-level `webhooks` object." } ], "paths": { "/catalog": { "get": { "tags": [ "Catalog" ], "summary": "List prescribable compounds", "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy.", "operationId": "listCatalog", "x-scope": "catalog:read", "x-org-types": [ "provider_practice", "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of compounds.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Compound" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "object": "compound", "name": "BPC-157", "eligibility_basis": "503A", "strengths": [ "5 mg" ], "routes": [ "subq" ], "doses": [ { "value": "5", "unit": "mg" } ] } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/catalog/{id}": { "get": { "tags": [ "Catalog" ], "summary": "Retrieve a compound", "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy.", "operationId": "getCompound", "x-scope": "catalog:read", "x-org-types": [ "provider_practice", "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The compound.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Compound" }, "example": { "id": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "object": "compound", "name": "BPC-157", "eligibility_basis": "503A", "strengths": [ "5 mg" ], "routes": [ "subq" ], "doses": [ { "value": "5", "unit": "mg" } ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/orders": { "get": { "tags": [ "Orders" ], "summary": "List orders", "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy.", "operationId": "listOrders", "x-scope": "orders:read", "x-org-types": [ "provider_practice", "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "name": "status", "in": "query", "required": false, "description": "Filter by order status. Unknown values return 422.", "schema": { "type": "string", "enum": [ "created", "awaiting_payment", "paid", "sent_to_pharmacy", "in_fulfillment", "shipped", "delivered", "action_needed", "canceled" ] } }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of orders, newest first.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Order" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "shipped", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": { "carrier": "USPS", "tracking_no": "9400100000000000000000", "status": "in_transit" }, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } ], "has_more": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/orders/{id}": { "get": { "tags": [ "Orders" ], "summary": "Retrieve an order", "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy.", "operationId": "getOrder", "x-scope": "orders:read", "x-org-types": [ "provider_practice", "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The order.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Order" }, "example": { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "shipped", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": { "carrier": "USPS", "tracking_no": "9400100000000000000000", "status": "in_transit" }, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/listings": { "get": { "tags": [ "Labs" ], "summary": "List your API listings", "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab.", "operationId": "listListings", "x-scope": "listings:read", "x-org-types": [ "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of listings.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Listing" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "lst_3a91c0de-7f21-4b3a-9e55-0a1b2c3d4e5f", "object": "listing", "substance": "Sermorelin", "monthly_fee": "499", "currency": "usd", "certified": true, "eligibility_note": null, "status": "active", "licensee_count": 4 } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/listings/{id}/licensees": { "get": { "tags": [ "Labs" ], "summary": "List the licensees of a listing", "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab.", "operationId": "listListingLicensees", "x-scope": "licensees:read", "x-org-types": [ "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "All licenses on the listing.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/License" } } } }, "example": { "object": "list", "data": [ { "id": "lic_0b7d2e4f-6a8c-4e1b-b3d5-7f9a1c3e5b7d", "object": "license", "pharmacy": "org_9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b", "status": "active", "monthly_fee": "499", "currency": "usd", "started_at": "2026-09-01T00:00:00.000Z", "canceled_at": null } ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/orders": { "get": { "tags": [ "Pharmacy fulfillment" ], "summary": "List the fulfillment queue", "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy.", "operationId": "listPharmacyOrders", "x-scope": "pharmacy:fulfill", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "name": "status", "in": "query", "required": false, "description": "Filter by order status. Unknown values return 422.", "schema": { "type": "string", "enum": [ "created", "awaiting_payment", "paid", "sent_to_pharmacy", "in_fulfillment", "shipped", "delivered", "action_needed", "canceled" ] } }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of orders.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Order" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "paid", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": null, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/orders/{id}/accept": { "post": { "tags": [ "Pharmacy fulfillment" ], "summary": "Accept an order", "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "acceptOrder", "x-scope": "pharmacy:fulfill", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The updated order.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Order" }, "example": { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "in_fulfillment", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": null, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/orders/{id}/status": { "post": { "tags": [ "Pharmacy fulfillment" ], "summary": "Set an order status", "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "setOrderStatus", "x-scope": "pharmacy:fulfill", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" }, { "$ref": "#/components/parameters/id" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrderStatusBody" }, "example": { "status": "delivered" } } } }, "responses": { "200": { "description": "The updated order.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Order" }, "example": { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "delivered", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": { "carrier": "USPS", "tracking_no": "9400100000000000000000", "status": "in_transit" }, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/orders/{id}/shipment": { "post": { "tags": [ "Pharmacy fulfillment" ], "summary": "Record a shipment", "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "createShipment", "x-scope": "pharmacy:fulfill", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" }, { "$ref": "#/components/parameters/id" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShipmentBody" }, "example": { "carrier": "USPS", "tracking_no": "9400100000000000000000" } } } }, "responses": { "200": { "description": "The updated order with the shipment embedded.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Order" }, "example": { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "shipped", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": { "carrier": "USPS", "tracking_no": "9400100000000000000000", "status": "in_transit" }, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/products": { "get": { "tags": [ "Pharmacy catalog" ], "summary": "List your products", "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.", "operationId": "listProducts", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "name": "channel", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "patient_rx", "office_stock" ] } }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "live", "pending_review", "draft", "unlisted", "hidden" ] } }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of products.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Product" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "object": "product", "compound": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "name": "BPC-157", "channel": "patient_rx", "status": "live", "published": true, "delivery_method": "subq", "strength": { "value": "5", "unit": "mg" }, "dosage_form_code": "C42945", "quantity_uom_code": "C48542", "pricing": { "patient_price": "149.00", "price_basis": "per_rx", "currency": "usd" }, "latest_batch": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "lot_no": "L-2041", "quantity": 120, "expiry_date": "2027-03-01", "coa_status": "on_file" }, "created_at": "2026-10-01T15:00:00.000Z", "updated_at": "2026-10-20T09:12:00.000Z" } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } }, "post": { "tags": [ "Pharmacy catalog" ], "summary": "Create a product", "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "createProduct", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProductCreate" }, "example": { "compound": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "channel": "patient_rx", "delivery_method": "subq", "strength": { "value": 5, "unit": "mg" }, "dosage_form_code": "C42945", "quantity_uom_code": "C48542", "patient_price": 149, "price_basis": "per_rx", "batch": { "lot_no": "L-2041", "quantity": 120, "expiry_date": "2027-03-01" } } } } }, "responses": { "201": { "description": "The created product.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Product" }, "example": { "id": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "object": "product", "compound": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "name": "BPC-157", "channel": "patient_rx", "status": "pending_review", "published": true, "delivery_method": "subq", "strength": { "value": "5", "unit": "mg" }, "dosage_form_code": "C42945", "quantity_uom_code": "C48542", "pricing": { "patient_price": "149.00", "price_basis": "per_rx", "currency": "usd" }, "latest_batch": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "lot_no": "L-2041", "quantity": 120, "expiry_date": "2027-03-01", "coa_status": "on_file" }, "created_at": "2026-10-01T15:00:00.000Z", "updated_at": "2026-10-20T09:12:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/products/{id}": { "get": { "tags": [ "Pharmacy catalog" ], "summary": "Retrieve a product", "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.", "operationId": "getProduct", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The product.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Product" }, "example": { "id": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "object": "product", "compound": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "name": "BPC-157", "channel": "patient_rx", "status": "live", "published": true, "delivery_method": "subq", "strength": { "value": "5", "unit": "mg" }, "dosage_form_code": "C42945", "quantity_uom_code": "C48542", "pricing": { "patient_price": "149.00", "price_basis": "per_rx", "currency": "usd" }, "latest_batch": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "lot_no": "L-2041", "quantity": 120, "expiry_date": "2027-03-01", "coa_status": "on_file" }, "created_at": "2026-10-01T15:00:00.000Z", "updated_at": "2026-10-20T09:12:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } }, "patch": { "tags": [ "Pharmacy catalog" ], "summary": "Update a product", "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "updateProduct", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" }, { "$ref": "#/components/parameters/id" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProductPatch" }, "example": { "patient_price": "159.00", "published": true } } } }, "responses": { "200": { "description": "The updated product.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProductPatched" }, "example": { "id": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "object": "product", "compound": "cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b", "name": "BPC-157", "channel": "patient_rx", "status": "live", "published": true, "delivery_method": "subq", "strength": { "value": "5", "unit": "mg" }, "dosage_form_code": "C42945", "quantity_uom_code": "C48542", "pricing": { "patient_price": "159.00", "price_basis": "per_rx", "currency": "usd" }, "latest_batch": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "lot_no": "L-2041", "quantity": 120, "expiry_date": "2027-03-01", "coa_status": "on_file" }, "created_at": "2026-10-01T15:00:00.000Z", "updated_at": "2026-10-20T09:12:00.000Z", "sent_to_review": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/batches": { "get": { "tags": [ "Pharmacy catalog" ], "summary": "List lots", "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.", "operationId": "listBatches", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "name": "product", "in": "query", "required": false, "description": "Only lots of this prd_ id.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/limit" }, { "$ref": "#/components/parameters/starting_after" } ], "responses": { "200": { "description": "A page of lots.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Batch" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "object": "batch", "product": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "lot_no": "L-2041", "quantity": 120, "mfg_date": "2026-09-15", "expiry_date": "2027-03-01", "coa": { "id": "coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f", "object": "coa", "status": "on_file", "purity_pct": "99.2", "lab_name": "Janoshik", "tested_on": "2026-09-20", "uploaded_at": "2026-10-02T11:00:00.000Z" }, "created_at": "2026-10-01T15:00:00.000Z" } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } }, "post": { "tags": [ "Pharmacy catalog" ], "summary": "Create a lot", "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "createBatch", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BatchCreate" }, "example": { "product": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "lot_no": "L-2042", "quantity": 80, "mfg_date": "2026-10-10", "expiry_date": "2027-04-01" } } } }, "responses": { "201": { "description": "The created lot.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Batch" }, "example": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "object": "batch", "product": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "lot_no": "L-2042", "quantity": 120, "mfg_date": "2026-09-15", "expiry_date": "2027-03-01", "coa": null, "created_at": "2026-10-01T15:00:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/batches/{id}": { "get": { "tags": [ "Pharmacy catalog" ], "summary": "Retrieve a lot", "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.", "operationId": "getBatch", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The lot.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Batch" }, "example": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "object": "batch", "product": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "lot_no": "L-2041", "quantity": 120, "mfg_date": "2026-09-15", "expiry_date": "2027-03-01", "coa": { "id": "coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f", "object": "coa", "status": "on_file", "purity_pct": "99.2", "lab_name": "Janoshik", "tested_on": "2026-09-20", "uploaded_at": "2026-10-02T11:00:00.000Z" }, "created_at": "2026-10-01T15:00:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/pharmacy/batches/{id}/coa": { "post": { "tags": [ "Pharmacy catalog" ], "summary": "Upload a certificate of analysis", "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.", "operationId": "uploadCoa", "x-scope": "pharmacy:catalog", "x-org-types": [ "pharmacy" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "requestBody": { "required": true, "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/CoaMultipart" } }, "application/json": { "schema": { "$ref": "#/components/schemas/CoaJson" }, "example": { "pdf_base64": "JVBERi0xLjQKJ...", "purity_pct": 99.2, "lab_name": "Janoshik", "tested_on": "2026-09-20" } } } }, "responses": { "201": { "description": "The lot with the new certificate.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Batch" }, "example": { "id": "bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "object": "batch", "product": "prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "lot_no": "L-2041", "quantity": 120, "mfg_date": "2026-09-15", "expiry_date": "2027-03-01", "coa": { "id": "coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f", "object": "coa", "status": "on_file", "purity_pct": "99.2", "lab_name": "Janoshik", "tested_on": "2026-09-20", "uploaded_at": "2026-10-02T11:00:00.000Z" }, "created_at": "2026-10-01T15:00:00.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" }, "503": { "description": "File storage is not configured on this host.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "const": "storage_unavailable" }, "message": { "type": "string" } } } } } } } } }, "/webhooks": { "get": { "tags": [ "Webhooks" ], "summary": "List webhook endpoints", "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab.", "operationId": "listWebhookEndpoints", "x-scope": "webhooks:manage", "x-org-types": [ "provider_practice", "pharmacy", "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" } ], "responses": { "200": { "description": "All endpoints.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "type": "object", "required": [ "object", "data", "has_more" ], "properties": { "object": { "type": "string", "const": "list" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEndpoint" } }, "has_more": { "type": "boolean", "description": "True when another page exists. Pass the last item's id as starting_after to fetch it." } } }, "example": { "object": "list", "data": [ { "id": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "object": "webhook_endpoint", "url": "https://example.com/peptplus/webhooks", "description": "Pharmacy system, production", "events": [ "order.created", "order.status_changed", "shipment.created" ], "active": true, "disabled_reason": null, "secret_hint": "9c4e", "stats": { "delivered": 128, "failed": 2, "consecutive_failures": 0, "last_delivered_at": "2026-10-29T14:31:02.000Z" }, "created_at": "2026-10-29T10:00:00.000Z", "updated_at": "2026-10-29T14:31:02.000Z" } ], "has_more": false } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } }, "post": { "tags": [ "Webhooks" ], "summary": "Create a webhook endpoint", "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "createWebhookEndpoint", "x-scope": "webhooks:manage", "x-org-types": [ "provider_practice", "pharmacy", "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointCreate" }, "example": { "url": "https://example.com/peptplus/webhooks", "description": "Pharmacy system, production", "events": [ "order.created", "order.status_changed", "shipment.created" ] } } } }, "responses": { "201": { "description": "The endpoint, with its signing secret.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpoint" }, "example": { "id": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "object": "webhook_endpoint", "url": "https://example.com/peptplus/webhooks", "description": "Pharmacy system, production", "events": [ "order.created", "order.status_changed", "shipment.created" ], "active": true, "disabled_reason": null, "secret_hint": "9c4e", "stats": { "delivered": 0, "failed": 0, "consecutive_failures": 0, "last_delivered_at": null }, "created_at": "2026-10-29T10:00:00.000Z", "updated_at": "2026-10-29T14:31:02.000Z", "secret": "whsec_0123456789abcdef0123456789abcdef0123456789ab9c4e" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "422": { "$ref": "#/components/responses/Unprocessable" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/webhooks/{id}": { "get": { "tags": [ "Webhooks" ], "summary": "Retrieve a webhook endpoint", "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab.", "operationId": "getWebhookEndpoint", "x-scope": "webhooks:manage", "x-org-types": [ "provider_practice", "pharmacy", "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "The endpoint and recent deliveries.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointWithDeliveries" }, "example": { "id": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "object": "webhook_endpoint", "url": "https://example.com/peptplus/webhooks", "description": "Pharmacy system, production", "events": [ "order.created", "order.status_changed", "shipment.created" ], "active": true, "disabled_reason": null, "secret_hint": "9c4e", "stats": { "delivered": 128, "failed": 2, "consecutive_failures": 0, "last_delivered_at": "2026-10-29T14:31:02.000Z" }, "created_at": "2026-10-29T10:00:00.000Z", "updated_at": "2026-10-29T14:31:02.000Z", "recent_deliveries": [ { "id": "whd_0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d", "object": "webhook_delivery", "endpoint": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "event": "evt_2a2f3b4c-5d6e-4f70-8a9b-0c1d2e3f4a5b", "type": "order.created", "status": "delivered", "attempt_count": 1, "next_attempt_at": null, "last_attempt_at": "2026-10-29T14:31:02.000Z", "last_status_code": 200, "last_error": null, "delivered_at": "2026-10-29T14:31:02.000Z", "replay_of": null, "created_at": "2026-10-29T14:30:10.000Z" } ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } }, "delete": { "tags": [ "Webhooks" ], "summary": "Delete a webhook endpoint", "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).", "operationId": "deleteWebhookEndpoint", "x-scope": "webhooks:manage", "x-org-types": [ "provider_practice", "pharmacy", "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/Idempotency-Key" }, { "$ref": "#/components/parameters/id" } ], "responses": { "200": { "description": "Confirmation.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Deleted" }, "example": { "id": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "object": "webhook_endpoint", "deleted": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } }, "/webhooks/{id}/test": { "post": { "tags": [ "Webhooks" ], "summary": "Send a test event", "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab.", "operationId": "testWebhookEndpoint", "x-scope": "webhooks:manage", "x-org-types": [ "provider_practice", "pharmacy", "lab" ], "parameters": [ { "$ref": "#/components/parameters/X-Request-Id" }, { "$ref": "#/components/parameters/id" } ], "responses": { "202": { "description": "The queued delivery.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/X-RateLimit-Limit" }, "X-RateLimit-Remaining": { "$ref": "#/components/headers/X-RateLimit-Remaining" }, "X-RateLimit-Reset": { "$ref": "#/components/headers/X-RateLimit-Reset" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookDelivery" }, "example": { "id": "whd_0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d", "object": "webhook_delivery", "endpoint": "whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8", "event": "evt_2a2f3b4c-5d6e-4f70-8a9b-0c1d2e3f4a5b", "type": "ping", "status": "pending", "attempt_count": 0, "next_attempt_at": "2026-10-29T14:45:00.000Z", "last_attempt_at": null, "last_status_code": null, "last_error": null, "delivered_at": null, "replay_of": null, "created_at": "2026-10-29T14:30:10.000Z" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/RateLimited" }, "500": { "$ref": "#/components/responses/Internal" } } } } }, "webhooks": { "event": { "post": { "summary": "Event delivery", "description": "PEPTPlus POSTs each event to every subscribed endpoint with Content-Type application/json and the headers PEPTPlus-Signature (t=,v1=.\" using the endpoint secret), PEPTPlus-Event (the type), PEPTPlus-Event-Id (evt_ id, stable across endpoints and replays), PEPTPlus-Delivery (whd_ id per attempt) and User-Agent PEPTPlus-Webhooks/1.0. Respond with any 2xx within 10 seconds; redirects are not followed. A failed attempt is retried 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours after the previous one, then marked dead. After 50 consecutive failures the endpoint is disabled until re-enabled in the portal. Verify the signature over the raw bytes, compare in constant time and reject timestamps older than your tolerance (5 minutes suggested).", "parameters": [ { "name": "PEPTPlus-Signature", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^t=\\d+,v1=[0-9a-f]{64}$" } }, { "name": "PEPTPlus-Event", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "PEPTPlus-Event-Id", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "PEPTPlus-Delivery", "in": "header", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEvent" }, "example": { "id": "evt_2a2f3b4c-5d6e-4f70-8a9b-0c1d2e3f4a5b", "object": "event", "type": "order.status_changed", "created": 1761750000, "api_version": "2026-10-29", "data": { "order": { "id": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e", "object": "order", "status": "in_fulfillment", "channel": "web", "patient": "pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8", "compound": "BPC-157", "strength": { "value": "5", "unit": "mg" }, "route": "subq", "amount": { "patient_paid_cents": 14900, "platform_fee_cents": 0, "currency": "usd" }, "shipment": null, "created_at": "2026-10-28T17:02:11.000Z", "updated_at": "2026-10-29T14:30:00.000Z" }, "previous_status": "paid", "source": "pharmacy" } } } } }, "responses": { "2XX": { "description": "Delivered. Any 2xx status counts." }, "default": { "description": "Any other status, a timeout or a connection error schedules a retry." } } } } }, "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "sk___<48 hex>", "description": "API key minted in the portal. Example: sk_pharm_live_0123456789abcdef... (48 hex characters after the env marker)." } }, "headers": { "X-Request-Id": { "description": "Request id. Echoes the inbound X-Request-Id when it matches ^[A-Za-z0-9._:-]{1,128}$, otherwise a fresh UUID.", "schema": { "type": "string" } }, "X-API-Version": { "description": "Date of the API contract this response follows.", "schema": { "type": "string", "const": "2026-10-29" } }, "X-RateLimit-Limit": { "description": "Requests allowed per 60 second window for this key (default 600).", "schema": { "type": "integer" } }, "X-RateLimit-Remaining": { "description": "Requests left in the current window.", "schema": { "type": "integer" } }, "X-RateLimit-Reset": { "description": "Unix seconds when the current window ends.", "schema": { "type": "integer" } }, "Retry-After": { "description": "Seconds to wait before retrying (429 only).", "schema": { "type": "integer" } }, "Idempotent-Replayed": { "description": "Present with the value true when the body is the stored response for the Idempotency-Key.", "schema": { "type": "string", "const": "true" } }, "Deprecation": { "description": "RFC 9745 marker (@) on a route that has been deprecated. No route is deprecated today.", "schema": { "type": "string" } }, "Sunset": { "description": "RFC 8594 HTTP-date after which a deprecated route stops working.", "schema": { "type": "string" } } }, "parameters": { "X-Request-Id": { "name": "X-Request-Id", "in": "header", "required": false, "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.", "schema": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" } }, "Idempotency-Key": { "name": "Idempotency-Key", "in": "header", "required": false, "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.", "schema": { "type": "string", "minLength": 1, "maxLength": 255 } }, "limit": { "name": "limit", "in": "query", "required": false, "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 25 } }, "starting_after": { "name": "starting_after", "in": "query", "required": false, "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.", "schema": { "type": "string" } }, "id": { "name": "id", "in": "path", "required": true, "description": "Object id, prefixed (for example ord_...) or the bare UUID.", "schema": { "type": "string" } } }, "responses": { "Unauthorized": { "description": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended).", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "authentication_error", "message": "Unknown or revoked API key.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b" } } } } }, "Forbidden": { "description": "The key lacks the required scope (the envelope carries `required`), or the key's org type cannot call this endpoint.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "permission_error", "message": "This key lacks the required scope: orders:read.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b", "required": "orders:read" } } } } }, "NotFound": { "description": "No such object visible to this organization, or no such API route.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "not_found", "message": "Order not found.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b" } } } } }, "Unprocessable": { "description": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "validation_error", "message": "Invalid request body.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b", "details": { "formErrors": [], "fieldErrors": { "carrier": [ "Required" ] } } } } } } }, "RateLimited": { "description": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" }, "Retry-After": { "$ref": "#/components/headers/Retry-After" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "rate_limit_error", "message": "Too many requests. Slow down and retry after the window resets.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b", "retry_after": 17 } } } } }, "Internal": { "description": "Unexpected failure. Retry with the same Idempotency-Key where one was sent: 5xx responses are never stored for replay.", "headers": { "X-Request-Id": { "$ref": "#/components/headers/X-Request-Id" }, "X-API-Version": { "$ref": "#/components/headers/X-API-Version" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "error": { "type": "internal_error", "message": "Internal error.", "request_id": "2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b" } } } } } }, "schemas": { "Error": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "object", "required": [ "type", "message", "request_id" ], "properties": { "type": { "type": "string", "enum": [ "authentication_error", "permission_error", "not_found", "validation_error", "rate_limit_error", "idempotency_error", "internal_error" ], "description": "authentication_error 401, permission_error 403, not_found 404, validation_error 422, idempotency_error 422, rate_limit_error 429, internal_error 500." }, "message": { "type": "string", "description": "Human readable explanation." }, "request_id": { "type": [ "string", "null" ], "description": "Same value as the X-Request-Id header." }, "required": { "type": "string", "description": "permission_error only: the scope the key lacks." }, "details": { "description": "validation_error only: the field errors (zod flatten shape: formErrors and fieldErrors)." }, "retry_after": { "type": "integer", "description": "rate_limit_error only: seconds until the window resets." } } } } }, "Batch": { "type": "object", "required": [ "id", "object", "product", "compound", "strength", "lot_no", "quantity", "mfg_date", "expiry_date", "coa", "created_at" ], "properties": { "id": { "type": "string", "pattern": "^bat_[0-9a-f-]{36}$", "description": "Object id with the bat_ prefix.", "example": "bat_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "batch" }, "product": { "type": "string", "pattern": "^prd_[0-9a-f-]{36}$", "description": "Object id with the prd_ prefix.", "example": "prd_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "compound": { "type": [ "string", "null" ] }, "strength": { "oneOf": [ { "$ref": "#/components/schemas/Strength" }, { "type": "null" } ] }, "lot_no": { "type": [ "string", "null" ] }, "quantity": { "type": [ "integer", "null" ] }, "mfg_date": { "type": [ "string", "null" ], "description": "YYYY-MM-DD." }, "expiry_date": { "type": [ "string", "null" ], "description": "YYYY-MM-DD." }, "coa": { "oneOf": [ { "$ref": "#/components/schemas/Coa" }, { "type": "null" } ], "description": "Latest certificate of analysis, or null." }, "created_at": { "type": "string", "format": "date-time" } } }, "BatchCreate": { "type": "object", "required": [ "product", "lot_no" ], "properties": { "product": { "type": "string", "description": "prd_ id (or bare UUID)." }, "lot_no": { "type": "string", "minLength": 1, "maxLength": 64 }, "quantity": { "type": "integer", "minimum": 0 }, "mfg_date": { "type": "string", "pattern": "^(\\d{1,2}/\\d{4}|\\d{4}-\\d{2}(-\\d{2})?)$", "description": "MM/YYYY, YYYY-MM or YYYY-MM-DD." }, "expiry_date": { "type": "string", "pattern": "^(\\d{1,2}/\\d{4}|\\d{4}-\\d{2}(-\\d{2})?)$", "description": "MM/YYYY, YYYY-MM or YYYY-MM-DD." } } }, "BatchVerifiedData": { "type": "object", "required": [ "product", "batch" ], "description": "batch.verified (pharmacy only): PEPTPlus verified the listing.", "properties": { "product": { "type": "object", "required": [ "id", "object", "compound", "status" ], "properties": { "id": { "type": "string", "pattern": "^prd_[0-9a-f-]{36}$", "description": "Object id with the prd_ prefix.", "example": "prd_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "product" }, "compound": { "type": "string", "pattern": "^cmp_[0-9a-f-]{36}$", "description": "Object id with the cmp_ prefix.", "example": "cmp_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "status": { "type": "string", "const": "live" } } }, "batch": { "oneOf": [ { "type": "object", "required": [ "id", "object", "lot_no", "expiry_date", "coa_on_file" ], "properties": { "id": { "type": "string", "pattern": "^bat_[0-9a-f-]{36}$", "description": "Object id with the bat_ prefix.", "example": "bat_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "batch" }, "lot_no": { "type": [ "string", "null" ] }, "expiry_date": { "type": [ "string", "null" ] }, "coa_on_file": { "type": "boolean" } } }, { "type": "null" } ] } } }, "Coa": { "type": "object", "required": [ "id", "object", "status", "purity_pct", "lab_name", "tested_on", "uploaded_at" ], "properties": { "id": { "type": "string", "pattern": "^coa_[0-9a-f-]{36}$", "description": "Object id with the coa_ prefix.", "example": "coa_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "coa" }, "status": { "type": [ "string", "null" ], "description": "on_file once uploaded." }, "purity_pct": { "type": [ "string", "null" ] }, "lab_name": { "type": [ "string", "null" ] }, "tested_on": { "type": [ "string", "null" ], "description": "YYYY-MM-DD." }, "uploaded_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "CoaJson": { "type": "object", "required": [ "pdf_base64" ], "properties": { "pdf_base64": { "type": "string", "description": "The PDF as base64 (a data:application/pdf;base64, prefix is accepted). Decoded size 1 byte to 15 MB.", "minLength": 16 }, "purity_pct": { "oneOf": [ { "type": "number", "minimum": 0, "maximum": 100 }, { "type": "string", "pattern": "^\\d+(\\.\\d+)?$" } ] }, "lab_name": { "type": "string", "maxLength": 200 }, "tested_on": { "type": "string", "pattern": "^(\\d{1,2}/\\d{4}|\\d{4}-\\d{2}(-\\d{2})?)$", "description": "MM/YYYY, YYYY-MM or YYYY-MM-DD." } } }, "CoaMultipart": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "binary", "description": "The PDF, at most 15 MB." }, "purity_pct": { "type": "string" }, "lab_name": { "type": "string" }, "tested_on": { "type": "string", "pattern": "^(\\d{1,2}/\\d{4}|\\d{4}-\\d{2}(-\\d{2})?)$", "description": "MM/YYYY, YYYY-MM or YYYY-MM-DD." } } }, "Compound": { "type": "object", "required": [ "id", "object", "name", "eligibility_basis", "strengths", "routes", "doses" ], "properties": { "id": { "type": "string", "pattern": "^cmp_[0-9a-f-]{36}$", "description": "Object id with the cmp_ prefix.", "example": "cmp_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "compound" }, "name": { "type": "string", "description": "Display name, for example BPC-157." }, "eligibility_basis": { "type": [ "string", "null" ], "description": "Why the compound is prescribable (for example 503A)." }, "strengths": { "type": "array", "items": { "type": "string" }, "description": "Human readable strengths available, for example \"5 mg\"." }, "routes": { "type": "array", "items": { "type": "string" }, "description": "Delivery routes available, for example subq." }, "doses": { "type": "array", "items": { "type": "object", "required": [ "value", "unit" ], "properties": { "value": { "type": "string" }, "unit": { "type": "string" } } } } } }, "Deleted": { "type": "object", "required": [ "id", "object", "deleted" ], "properties": { "id": { "type": "string", "pattern": "^whe_[0-9a-f-]{36}$", "description": "Object id with the whe_ prefix.", "example": "whe_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "webhook_endpoint" }, "deleted": { "type": "boolean", "const": true } } }, "License": { "type": "object", "required": [ "id", "object", "pharmacy", "status", "monthly_fee", "currency", "started_at", "canceled_at" ], "properties": { "id": { "type": "string", "pattern": "^lic_[0-9a-f-]{36}$", "description": "Object id with the lic_ prefix.", "example": "lic_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "license" }, "pharmacy": { "type": "string", "pattern": "^org_[0-9a-f-]{36}$", "description": "The licensing pharmacy. Only the id is visible to the lab.", "example": "org_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "status": { "type": "string", "enum": [ "active", "canceled" ] }, "monthly_fee": { "type": [ "string", "null" ] }, "currency": { "type": "string", "const": "usd" }, "started_at": { "type": "string", "format": "date-time" }, "canceled_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "Listing": { "type": "object", "required": [ "id", "object", "substance", "monthly_fee", "currency", "certified", "eligibility_note", "status", "licensee_count" ], "properties": { "id": { "type": "string", "pattern": "^lst_[0-9a-f-]{36}$", "description": "Object id with the lst_ prefix.", "example": "lst_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "listing" }, "substance": { "type": "string" }, "monthly_fee": { "type": [ "string", "null" ], "description": "Decimal string in dollars." }, "currency": { "type": "string", "const": "usd" }, "certified": { "type": "boolean" }, "eligibility_note": { "type": [ "string", "null" ] }, "status": { "type": "string", "enum": [ "active", "coming" ] }, "licensee_count": { "type": "integer", "description": "Active licenses against this listing." } } }, "ListingLicensedData": { "type": "object", "required": [ "license" ], "description": "listing.licensed (lab only).", "properties": { "license": { "type": "object", "required": [ "id", "object", "listing", "pharmacy", "monthly_fee", "status", "started_at" ], "properties": { "id": { "type": "string", "pattern": "^lic_[0-9a-f-]{36}$", "description": "Object id with the lic_ prefix.", "example": "lic_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "license" }, "listing": { "type": "string", "pattern": "^lst_[0-9a-f-]{36}$", "description": "Object id with the lst_ prefix.", "example": "lst_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "pharmacy": { "type": "string", "pattern": "^org_[0-9a-f-]{36}$", "description": "Object id with the org_ prefix.", "example": "org_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "monthly_fee": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "started_at": { "type": "string", "format": "date-time" } } } } }, "Order": { "type": "object", "required": [ "id", "object", "status", "channel", "patient", "compound", "strength", "route", "amount", "shipment", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "pattern": "^ord_[0-9a-f-]{36}$", "description": "Object id with the ord_ prefix.", "example": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "order" }, "status": { "type": "string", "enum": [ "created", "awaiting_payment", "paid", "sent_to_pharmacy", "in_fulfillment", "shipped", "delivered", "action_needed", "canceled" ] }, "channel": { "type": "string", "description": "How the order was created, for example web or api." }, "patient": { "type": [ "string", "null" ], "pattern": "^pt_[0-9a-f-]{36}$", "description": "Patient token. The only patient identifier the API ever returns.", "example": "pt_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "compound": { "type": [ "string", "null" ], "description": "Compound display name." }, "strength": { "oneOf": [ { "$ref": "#/components/schemas/Strength" }, { "type": "null" } ] }, "route": { "type": [ "string", "null" ] }, "amount": { "type": "object", "required": [ "patient_paid_cents", "platform_fee_cents", "currency" ], "properties": { "patient_paid_cents": { "type": [ "integer", "null" ] }, "platform_fee_cents": { "type": [ "integer", "null" ] }, "currency": { "type": "string", "const": "usd" } } }, "shipment": { "oneOf": [ { "type": "object", "required": [ "carrier", "tracking_no", "status" ], "properties": { "carrier": { "type": [ "string", "null" ] }, "tracking_no": { "type": [ "string", "null" ] }, "status": { "type": "string" } } }, { "type": "null" } ], "description": "Latest shipment, or null before one is recorded." }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "OrderEventData": { "type": "object", "required": [ "order" ], "description": "order.created, order.accepted, order.status_changed, shipment.created, shipment.delivered.", "properties": { "order": { "$ref": "#/components/schemas/Order" }, "previous_status": { "type": [ "string", "null" ], "enum": [ "created", "awaiting_payment", "paid", "sent_to_pharmacy", "in_fulfillment", "shipped", "delivered", "action_needed", "canceled", null ], "description": "order.status_changed only." }, "source": { "type": "string", "enum": [ "pharmacy", "system" ], "description": "Who triggered the change: a pharmacy user or key, or the system (payment, pharmacy-system sync)." } } }, "OrderStatusBody": { "type": "object", "required": [ "status" ], "properties": { "status": { "type": "string", "enum": [ "in_fulfillment", "shipped", "delivered", "action_needed" ] } } }, "PingData": { "type": "object", "required": [ "message", "endpoint" ], "description": "ping: test event.", "properties": { "message": { "type": "string" }, "endpoint": { "type": "string", "pattern": "^whe_[0-9a-f-]{36}$", "description": "Object id with the whe_ prefix.", "example": "whe_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" } } }, "PrescriptionRoutedData": { "type": "object", "required": [ "prescription" ], "description": "prescription.routed (pharmacy only): a signed prescription was routed to the pharmacy, before payment.", "properties": { "prescription": { "type": "object", "required": [ "id", "object", "patient", "compound", "strength", "route", "quantity", "refills", "days_supply", "dea_schedule", "provider", "pharmacy", "signed_at" ], "properties": { "id": { "type": "string", "pattern": "^rx_[0-9a-f-]{36}$", "description": "Object id with the rx_ prefix.", "example": "rx_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "prescription" }, "patient": { "type": "string", "pattern": "^pt_[0-9a-f-]{36}$", "description": "Object id with the pt_ prefix.", "example": "pt_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "compound": { "type": "string", "pattern": "^cmp_[0-9a-f-]{36}$", "description": "Object id with the cmp_ prefix.", "example": "cmp_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "strength": { "type": "object", "properties": { "value": { "type": [ "string", "null" ] }, "unit": { "type": [ "string", "null" ] } } }, "route": { "type": [ "string", "null" ] }, "quantity": { "type": [ "integer", "null" ] }, "refills": { "type": [ "integer", "null" ] }, "days_supply": { "type": [ "integer", "null" ] }, "dea_schedule": { "type": [ "integer", "null" ], "description": "null means non-controlled." }, "provider": { "type": "string", "pattern": "^org_[0-9a-f-]{36}$", "description": "Object id with the org_ prefix.", "example": "org_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "pharmacy": { "type": "string", "pattern": "^org_[0-9a-f-]{36}$", "description": "Object id with the org_ prefix.", "example": "org_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "signed_at": { "type": "string", "format": "date-time" } } } } }, "Product": { "type": "object", "required": [ "id", "object", "compound", "name", "channel", "status", "published", "delivery_method", "strength", "dosage_form_code", "quantity_uom_code", "pricing", "latest_batch", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "pattern": "^prd_[0-9a-f-]{36}$", "description": "Object id with the prd_ prefix.", "example": "prd_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "product" }, "compound": { "type": "string", "pattern": "^cmp_[0-9a-f-]{36}$", "description": "Object id with the cmp_ prefix.", "example": "cmp_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "name": { "type": [ "string", "null" ], "description": "Compound display name." }, "channel": { "type": "string", "enum": [ "patient_rx", "office_stock" ], "description": "patient_rx is the 503A channel, office_stock the 503B channel." }, "status": { "type": "string", "enum": [ "live", "pending_review", "draft", "unlisted", "hidden" ], "description": "draft: saved, not submitted. pending_review: awaiting PEPTPlus verification. live: approved and visible. unlisted: approved, hidden by the pharmacy. hidden: hidden by PEPTPlus." }, "published": { "type": "boolean", "description": "Whether the pharmacy wants the product visible once approved." }, "delivery_method": { "type": "string", "enum": [ "subq", "im", "iv", "topical", "edible" ] }, "strength": { "oneOf": [ { "$ref": "#/components/schemas/Strength" }, { "type": "null" } ] }, "dosage_form_code": { "type": [ "string", "null" ], "description": "NCPDP dosage form code." }, "quantity_uom_code": { "type": [ "string", "null" ], "description": "NCPDP dispensing unit code." }, "pricing": { "oneOf": [ { "title": "PatientRxPricing", "type": "object", "required": [ "patient_price", "price_basis", "currency" ], "properties": { "patient_price": { "type": [ "string", "null" ], "description": "Dollars." }, "price_basis": { "type": "string", "enum": [ "per_rx", "per_unit" ] }, "currency": { "type": "string", "const": "usd" } } }, { "title": "OfficeStockPricing", "type": "object", "required": [ "wholesale_price", "pack_size", "lead_time_days", "currency" ], "properties": { "wholesale_price": { "type": [ "string", "null" ], "description": "Dollars." }, "pack_size": { "type": [ "integer", "null" ] }, "lead_time_days": { "type": [ "integer", "null" ] }, "currency": { "type": "string", "const": "usd" } } } ], "description": "Shape depends on channel." }, "latest_batch": { "oneOf": [ { "type": "object", "required": [ "id", "lot_no", "quantity", "expiry_date", "coa_status" ], "properties": { "id": { "type": "string", "pattern": "^bat_[0-9a-f-]{36}$", "description": "Object id with the bat_ prefix.", "example": "bat_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "lot_no": { "type": [ "string", "null" ] }, "quantity": { "type": [ "integer", "null" ] }, "expiry_date": { "type": [ "string", "null" ], "description": "YYYY-MM-DD." }, "coa_status": { "type": [ "string", "null" ] } } }, { "type": "null" } ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "ProductCreate": { "type": "object", "required": [ "compound", "delivery_method", "strength", "dosage_form_code", "quantity_uom_code" ], "properties": { "compound": { "type": "string", "description": "cmp_ id from GET /catalog (or the bare UUID)." }, "channel": { "type": "string", "enum": [ "patient_rx", "office_stock" ], "default": "patient_rx" }, "delivery_method": { "type": "string", "enum": [ "subq", "im", "iv", "topical", "edible" ] }, "strength": { "type": "object", "required": [ "value", "unit" ], "properties": { "value": { "oneOf": [ { "type": "number", "exclusiveMinimum": 0 }, { "type": "string", "pattern": "^\\d+(\\.\\d+)?$" } ] }, "unit": { "type": "string", "enum": [ "mg", "mcg", "g", "IU", "mL", "mg/mL", "mcg/mL", "IU/mL", "mEq", "%" ] } } }, "dosage_form_code": { "type": "string", "description": "NCPDP dosage form code, 1 to 16 characters.", "minLength": 1, "maxLength": 16 }, "quantity_uom_code": { "type": "string", "description": "NCPDP dispensing unit code, 1 to 16 characters.", "minLength": 1, "maxLength": 16 }, "patient_price": { "oneOf": [ { "type": "number", "minimum": 0 }, { "type": "string", "pattern": "^\\d+(\\.\\d{1,2})?$" } ], "description": "Required for patient_rx unless published is false (draft)." }, "price_basis": { "type": "string", "enum": [ "per_rx", "per_unit" ] }, "pack_size": { "type": "integer", "description": "Required for office_stock.", "minimum": 1 }, "wholesale_price": { "oneOf": [ { "type": "number", "minimum": 0 }, { "type": "string", "pattern": "^\\d+(\\.\\d{1,2})?$" } ], "description": "Required for office_stock." }, "lead_time_days": { "type": "integer", "description": "Required for office_stock.", "minimum": 0 }, "published": { "type": "boolean", "description": "false saves a draft that is not submitted for review. Default: submit for review." }, "batch": { "type": "object", "required": [ "lot_no" ], "description": "Optional first lot created with the product.", "properties": { "lot_no": { "type": "string", "minLength": 1, "maxLength": 64 }, "quantity": { "type": "integer", "minimum": 0 }, "expiry_date": { "type": "string", "pattern": "^(\\d{1,2}/\\d{4}|\\d{4}-\\d{2}(-\\d{2})?)$", "description": "MM/YYYY, YYYY-MM or YYYY-MM-DD." } } } } }, "ProductPatch": { "type": "object", "minProperties": 1, "description": "At least one field. Setting published true shows an approved product in the marketplace; false unlists it. Changing delivery_method on an approved product sends it back for review.", "properties": { "published": { "type": "boolean" }, "patient_price": { "oneOf": [ { "type": "number", "minimum": 0 }, { "type": "string", "pattern": "^\\d+(\\.\\d{1,2})?$" } ], "description": "Dollars as a number or a decimal string with up to two decimals. Stored and returned as a decimal string." }, "price_basis": { "type": "string", "enum": [ "per_rx", "per_unit" ] }, "wholesale_price": { "oneOf": [ { "type": "number", "minimum": 0 }, { "type": "string", "pattern": "^\\d+(\\.\\d{1,2})?$" } ], "description": "Dollars as a number or a decimal string with up to two decimals. Stored and returned as a decimal string." }, "pack_size": { "type": "integer", "minimum": 1 }, "lead_time_days": { "type": "integer", "minimum": 0 }, "delivery_method": { "type": "string", "enum": [ "subq", "im", "iv", "topical", "edible" ] }, "dosage_form_code": { "type": "string", "minLength": 1, "maxLength": 16 }, "quantity_uom_code": { "type": "string", "minLength": 1, "maxLength": 16 } } }, "ProductPatched": { "allOf": [ { "$ref": "#/components/schemas/Product" }, { "type": "object", "required": [ "sent_to_review" ], "properties": { "sent_to_review": { "type": "boolean", "description": "True when the change put the product back into review." } } } ] }, "ShipmentBody": { "type": "object", "required": [ "carrier", "tracking_no" ], "properties": { "carrier": { "type": "string", "description": "Carrier name, 1 to 64 characters.", "minLength": 1, "maxLength": 64 }, "tracking_no": { "type": "string", "description": "Tracking number, 1 to 128 characters.", "minLength": 1, "maxLength": 128 } } }, "Strength": { "type": "object", "required": [ "value", "unit" ], "properties": { "value": { "type": "string", "description": "Decimal string, for example \"5\"." }, "unit": { "type": [ "string", "null" ], "enum": [ "mg", "mcg", "g", "IU", "mL", "mg/mL", "mcg/mL", "IU/mL", "mEq", "%", null ] } } }, "WebhookDelivery": { "type": "object", "required": [ "id", "object", "endpoint", "event", "type", "status", "attempt_count", "next_attempt_at", "last_attempt_at", "last_status_code", "last_error", "delivered_at", "replay_of", "created_at" ], "properties": { "id": { "type": "string", "pattern": "^whd_[0-9a-f-]{36}$", "description": "Object id with the whd_ prefix.", "example": "whd_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "webhook_delivery" }, "endpoint": { "type": "string", "pattern": "^whe_[0-9a-f-]{36}$", "description": "Object id with the whe_ prefix.", "example": "whe_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "event": { "type": "string", "pattern": "^evt_[0-9a-f-]{36}$", "description": "Object id with the evt_ prefix.", "example": "evt_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "type": { "type": "string", "enum": [ "order.created", "order.accepted", "order.status_changed", "shipment.created", "shipment.delivered", "prescription.routed", "batch.verified", "listing.licensed", "ping" ] }, "status": { "type": "string", "enum": [ "pending", "delivered", "dead" ] }, "attempt_count": { "type": "integer" }, "next_attempt_at": { "type": [ "string", "null" ], "format": "date-time", "description": "Only while pending." }, "last_attempt_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_status_code": { "type": [ "integer", "null" ] }, "last_error": { "type": [ "string", "null" ] }, "delivered_at": { "type": [ "string", "null" ], "format": "date-time" }, "replay_of": { "type": [ "string", "null" ], "pattern": "^whd_[0-9a-f-]{36}$", "description": "Object id with the whd_ prefix.", "example": "whd_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "created_at": { "type": "string", "format": "date-time" } } }, "WebhookEndpoint": { "type": "object", "required": [ "id", "object", "url", "description", "events", "active", "disabled_reason", "secret_hint", "stats", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "pattern": "^whe_[0-9a-f-]{36}$", "description": "Object id with the whe_ prefix.", "example": "whe_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "webhook_endpoint" }, "url": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "events": { "type": "array", "items": { "type": "string" }, "description": "Subscribed event types, or [\"*\"] for every event." }, "active": { "type": "boolean" }, "disabled_reason": { "type": [ "string", "null" ], "description": "Set when 50 consecutive failures disabled the endpoint." }, "secret_hint": { "type": "string", "description": "Last characters of the signing secret, for identification." }, "secret": { "type": "string", "description": "The signing secret (whsec_ plus 48 hex). Returned once, in the create response only." }, "stats": { "type": "object", "required": [ "delivered", "failed", "consecutive_failures", "last_delivered_at" ], "properties": { "delivered": { "type": "integer" }, "failed": { "type": "integer" }, "consecutive_failures": { "type": "integer" }, "last_delivered_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "WebhookEndpointCreate": { "type": "object", "required": [ "url", "events" ], "properties": { "url": { "type": "string", "description": "https URL on a public host, 12 to 2048 characters. No credentials, loopback or private addresses.", "minLength": 12, "maxLength": 2048 }, "description": { "type": [ "string", "null" ], "maxLength": 200 }, "events": { "type": "array", "minItems": 1, "maxItems": 32, "items": { "type": "string", "enum": [ "order.created", "order.accepted", "order.status_changed", "shipment.created", "shipment.delivered", "prescription.routed", "batch.verified", "listing.licensed", "*" ] }, "description": "Event types to receive. \"*\" subscribes to everything. Every endpoint receives ping." } } }, "WebhookEndpointWithDeliveries": { "allOf": [ { "$ref": "#/components/schemas/WebhookEndpoint" }, { "type": "object", "required": [ "recent_deliveries" ], "properties": { "recent_deliveries": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookDelivery" }, "description": "The 20 most recent deliveries, newest first." } } } ] }, "WebhookEvent": { "type": "object", "required": [ "id", "object", "type", "created", "api_version", "data" ], "description": "Body of every webhook delivery. `id` is the same for every endpoint and replay of one emission: deduplicate on it.", "properties": { "id": { "type": "string", "pattern": "^evt_[0-9a-f-]{36}$", "description": "Object id with the evt_ prefix.", "example": "evt_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e" }, "object": { "type": "string", "const": "event" }, "type": { "type": "string", "enum": [ "order.created", "order.accepted", "order.status_changed", "shipment.created", "shipment.delivered", "prescription.routed", "batch.verified", "listing.licensed", "ping" ] }, "created": { "type": "integer", "description": "Unix seconds when the event was emitted." }, "api_version": { "type": "string", "const": "2026-10-29" }, "data": { "oneOf": [ { "$ref": "#/components/schemas/OrderEventData" }, { "$ref": "#/components/schemas/PrescriptionRoutedData" }, { "$ref": "#/components/schemas/BatchVerifiedData" }, { "$ref": "#/components/schemas/ListingLicensedData" }, { "$ref": "#/components/schemas/PingData" } ] } } } } } }