Skip to content
TRIM FITTv1 · read
↑↓ to move↵ to openesc to close
Contents

Start here

Read this first

What the API does today, what it deliberately does not do, and the three rules that explain most of its behaviour.

What is live#

Authentication and the catalogue. A key is scoped, bound to clinics, rate limited, and revocable. The catalogue is paginated and carries no price.

A hosted sandbox is live at https://sandbox.trimfitt.com, with its own keys and a synthetic catalogue: Sandbox.

There is no write endpoint. The roadmap covers what comes next, in order, and what is blocking each step: What is live today.

Three rules that explain the API#

  1. Authorization is server-side and derived from the key. You never name a clinic. The server reads your grants and scopes the answer to them, so a request cannot widen its own reach.
  2. A refusal is specific. 401 means the key did not verify. 403 means it verified and is not allowed. 429 means slow down. 503 means we could not check, so retry with the same key.
  3. Nothing is cached for you. Every response is no-store because the answer is one tenant's data. Cache on your side, deliberately.

A key is shown once

It appears when it is minted or rotated, and never again. Store it in a secret manager, use it only from a server, and rotate it if it is ever exposed.

Where to go next#