Status

What is live today

The honest status, so nobody builds against an endpoint that does not exist. Read surface first; writes gated on paperwork, not code.

Live#

Capability	Detail
Scoped bearer keys	Minted, rotated and revoked by an operator. Shown once, stored as a peppered hash.
`GET /v1/me`	The key, its scopes, and the clinics it holds.
`GET /v1/products`	Paginated catalogue with a keyset cursor. Names, forms and safety flags; no price.
Rate limits and request log	Three ceilings, per-request correlation ids, and a log an operator can read.
Clinic isolation	Every read is scoped to the key's clinics. No request parameter can widen it.

Next, in order#

IP allowlist, in alert-only mode first so egress ranges are learned before anything is rejected.
Quotes. Price, availability, requirements, expiry and an id, per patient and per state. The quote becomes the authoritative amount.
Patients. Synchronous create, idempotent on your external id, plus read and a narrow patch for contact and shipping.
Orders. Create against a quote, read and list for polling, and a cancellation request rather than a delete.
Payment tokens. Attach and refresh a Shared Payment Token; charge once on approval; an awaiting-payment state when the token has lapsed.
Webhooks. Signed order status changes, deduplicated on event id.

A hosted sandbox is live

Build against https://sandbox.trimfitt.com, not production. It has its own keys, its own database and a synthetic catalogue, and it is read-only until the write endpoints ship. Ask your integration contact for a test key, or read Sandbox.

Blocked, and on what#

Work	Blocked on
Patient and order endpoints	A signed BAA, and the per-product, per-state answer on lawful supply. These are external, not engineering.
Payment tokens	Orders existing first, plus the Stripe profile id and the agreed token-attach shape.
PHI scopes	The agreement dates are recorded, but they do not yet gate PHI scopes. That is being settled before any patient route ships.

What is deliberately not offered#

Deleting orders. Cancellation is a staff-mediated request.
Replacing a patient record. A full replace would let a partner overwrite clinical fields.
Anything clinical, and anything that moves money other than the token charge.

Questions about timing or access: talk to your TRIM FITT contact. API behaviour: start here.