API Reference
Complete documentation for the TouchpointHQ REST API. All endpoints return JSON and require API key authentication.
Getting Started
Follow these steps to make your first API call
Get Your API Key
Request API access through our sales team. You'll receive a unique API key that identifies your organization and determines your rate limits and access level.
Keep your API key secure
Never expose your API key in client-side code or public repositories. Store it in environment variables or a secure secrets manager.
Set Up Your Environment
Configure your development environment with the API base URL and your authentication credentials.
# TouchpointHQ API Configuration TOUCHPOINT_API_URL=https://api.touchpointhq.com TOUCHPOINT_API_KEY=your_api_key_here TOUCHPOINT_API_VERSION=v1
Make Your First Request
Test your setup by making a simple request to the HEDIS compliance endpoint. This will verify your API key is working correctly.
curl -X GET "https://api.touchpointhq.com/v1/hedis/compliance" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json"
Verify the Response
A successful response will return your organization's HEDIS compliance data. Here's an example of what to expect:
Explore More Endpoints
Now that you're set up, explore the full API capabilities. Here are some popular next steps:
Track compliance over time with historical data
Analyze equity gaps across demographics
Get real-time notifications for events
Manage patient records programmatically
Authentication
All API requests require an API key passed in the Authorization header. Contact sales to obtain your organization's API key.
curl -X GET "https://api.touchpointhq.com/v1/hedis/compliance" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"Rate Limiting & Usage Quotas
API requests are rate-limited to ensure fair usage and system stability. Rate limits are applied per API key and vary by plan tier.
Rate Limits by Plan
Request limits per hour based on your subscription tier
| Plan | Requests/Hour | Requests/Day | Burst Limit |
|---|---|---|---|
Starter | 1,000 | 10,000 | 50/min |
Professional | 5,000 | 50,000 | 200/min |
Enterprise | 25,000 | 250,000 | 1,000/min |
Custom | Contact sales for custom rate limits | ||
Rate Limit Headers
Headers included in every API response to track your usage
| Header | Description |
|---|---|
| X-RateLimit-Limit | Maximum requests allowed per hour |
| X-RateLimit-Remaining | Requests remaining in current window |
| X-RateLimit-Reset | Unix timestamp when the rate limit resets |
| Retry-After | Seconds to wait before retrying (only on 429 responses) |
Example Response Headers:
HTTP/1.1 200 OK
X-RateLimit-Limit: 5000
X-RateLimit-Remaining: 4847
X-RateLimit-Reset: 1735401600
Content-Type: application/jsonMonthly Usage Quotas
Additional limits on specific API operations
| Operation | Starter | Professional | Enterprise |
|---|---|---|---|
| Patient Records | 500 | 5,000 | Unlimited |
| Assessment Submissions | 1,000 | 10,000 | Unlimited |
| HEDIS Reports | 50/month | 500/month | Unlimited |
| Bulk Data Exports | 5/month | 50/month | Unlimited |
| Webhook Endpoints | 3 | 10 | 50 |
| API Keys | 2 | 10 | Unlimited |
Handling Rate Limits
Best practices for dealing with rate limit responses
When you exceed your rate limit, the API returns a 429 Too Many Requests response. Implement exponential backoff to handle rate limits gracefully.
Pro Tip
Monitor the X-RateLimit-Remaining header and proactively slow down requests when approaching your limit to avoid 429 errors.
SDKs & Client Libraries
Official client libraries to integrate TouchpointHQ into your application quickly. All SDKs handle authentication, rate limiting, and error handling automatically.
JSJavaScript / TypeScript
Full-featured SDK for Node.js, browsers, and edge runtimes
Installation
npm install @touchpointhq/sdkyarn add @touchpointhq/sdkQuick Start
PYPython
Async-first SDK with type hints and Pydantic models
Other Languages
Community-maintained SDKs and direct API access
Direct API Access
For languages without an SDK, you can call the REST API directly. The API follows standard REST conventions and returns JSON responses.
Base URL: https://api.touchpointhq.com/v1SDK Features
All official SDKs include these built-in features
Automatic Retries
Exponential backoff for transient failures
Rate Limit Handling
Automatic throttling when limits are reached
Type Safety
Full TypeScript/Python type hints
Pagination Helpers
Iterate through large result sets easily
Request Logging
Built-in debug logging for troubleshooting
Webhook Verification
Helper methods to verify webhook signatures
API Explorer
Test API endpoints directly from the documentation. Responses are simulated for demonstration.
Get current HEDIS compliance rates for all measures
Your API key is only used for this demo and is not stored or transmitted.
/v1/hedis/complianceGet current HEDIS compliance rates for all measures
Code Examples
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| period_start | string | Optional | Start date (YYYY-MM-DD). Defaults to current year. |
| period_end | string | Optional | End date (YYYY-MM-DD). Defaults to today. |
| measure_ids | string[] | Optional | Filter to specific measure IDs |
Example Response
/v1/hedis/measuresList all supported HEDIS measures with scoring criteria
Code Examples
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| category | string | Optional | Filter by category: depression, anxiety, substance_use, etc. |
Example Response
/v1/hedis/trendsGet historical compliance trends over time
Code Examples
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| measure_id | string | Required | HEDIS measure ID |
| granularity | string | Optional | monthly, quarterly, or yearly. Default: monthly |
| periods | number | Optional | Number of periods to return. Default: 12 |
Example Response
Webhooks
Receive real-time notifications when events occur in your TouchpointHQ account. Configure webhook endpoints to be notified when assessments are completed, alerts are triggered, or patient data changes.
Setting Up Webhooks
Configure your endpoint to receive webhook notifications
- Navigate to Settings → API & Integrations → Webhooks in your dashboard
- Click Add Endpoint and enter your HTTPS URL
- Select which events you want to receive
- Copy the signing secret to verify webhook authenticity
Security Requirement
Your endpoint must use HTTPS and respond with a 2xx status code within 30 seconds.
Webhook Events
Available event types you can subscribe to
| Event Type | Description |
|---|---|
| assessment.completed | Fired when a patient completes an assessment |
| assessment.scheduled | Fired when a new assessment is scheduled |
| assessment.expired | Fired when an assessment link expires without completion |
| alert.triggered | Fired when a clinical alert is triggered (score change, high severity) |
| alert.acknowledged | Fired when a provider acknowledges an alert |
| patient.created | Fired when a new patient is added to the system |
| patient.updated | Fired when patient information is updated |
| hedis.threshold_crossed | Fired when a HEDIS measure crosses a benchmark threshold |
Payload Examples
Sample webhook payloads for common events
Verifying Webhook Signatures
Validate that webhooks are genuinely from TouchpointHQ
Each webhook request includes a X-TouchpointHQ-Signature header containing an HMAC-SHA256 signature. Verify this signature using your webhook signing secret.
Node.js Example
Python Example
Retry Policy
How we handle failed webhook deliveries
If your endpoint returns a non-2xx status code or times out, we'll retry the webhook with exponential backoff:
1
minute
1st retry
5
minutes
2nd retry
30
minutes
3rd retry
2
hours
Final retry
After 4 failed attempts, the webhook will be marked as failed. You can view failed webhooks and manually retry them from the dashboard.
API Changelog
Version history and breaking changes
- Added
/v1/stratification/breakdownendpoint for demographic stratification - New webhook event types:
compliance.threshold_crossedandequity.gap_detected - Support for filtering trends by provider ID
- Added
projected_year_endfield to HEDIS trends response
- Improved response times for compliance endpoints by 40%
- Enhanced rate limiting with better burst handling
- More detailed error messages for validation failures
- Equity gaps analysis endpoints
- Bulk patient import via API
- Assessment scheduling endpoints
Renamed patient_mrn field to external_id across all patient endpoints. Update your integrations before upgrading.
- Webhook support for real-time notifications
- HEDIS trends endpoint with historical data
- Pagination support for all list endpoints
/v1/reports/hedis- Use/v1/hedis/complianceinstead
- HEDIS compliance and measures endpoints
- Patient management API
- Assessment forms and responses
- API key authentication
Need help migrating?
Our team can help you upgrade to the latest API version with minimal disruption to your integration.
Contact SupportError Codes
| Status Code | Error Type | Description |
|---|---|---|
| 400 | Bad Request | Invalid request parameters |
| 401 | Unauthorized | Missing or invalid API key |
| 403 | Forbidden | API key doesn't have access to this resource |
| 404 | Not Found | Resource not found |
| 429 | Rate Limited | Too many requests. Retry after the specified time. |
| 500 | Server Error | Internal server error. Contact support. |
Troubleshooting
Common issues and how to resolve them
Authentication Errors
This error occurs when the API key is missing, malformed, or has been revoked.
Solutions:
- Verify your API key is correctly formatted:
Bearer YOUR_API_KEY - Check that you're using the Authorization header, not a query parameter
- Ensure your API key hasn't expired or been revoked
- Confirm you're using the correct key for the environment (test vs. production)
Your API key is valid but doesn't have access to the requested resource.
Solutions:
- Verify your API key has the required scopes for this endpoint
- Check if the resource belongs to your organization
- Contact support to upgrade your API access level
Rate Limiting Issues
You've exceeded your allowed requests per time window.
Solutions:
- Check the
Retry-Afterheader for when to retry - Implement exponential backoff in your retry logic
- Cache responses to reduce API calls
- Batch multiple operations into single requests where possible
- Contact sales to upgrade your rate limits
Example: Checking rate limit headers
// Response headers to monitor X-RateLimit-Limit: 1000 X-RateLimit-Remaining: 0 X-RateLimit-Reset: 1703779200 Retry-After: 3600
Request Format Issues
The request body or parameters don't match the expected format.
Common causes & solutions:
- Malformed JSON: Validate your JSON using a linter before sending
- Missing required fields: Check the API reference for required parameters
- Invalid date format: Use ISO 8601 format:
YYYY-MM-DD - Wrong data type: Ensure numbers aren't quoted as strings
- Invalid enum value: Check allowed values in the documentation
All requests with a body must include the Content-Type header.
// Always include this header for POST/PUT requests Content-Type: application/json
Data & Response Issues
API returns empty arrays or unexpected data.
Solutions:
- Verify the date range parameters are correct
- Check if filters are too restrictive
- Ensure patient/measure IDs exist in your organization
- Confirm data has been synced for the requested period
Data doesn't reflect recent changes or submissions.
Solutions:
- HEDIS calculations update every 15 minutes
- Use webhooks for real-time updates instead of polling
- Add a cache-busting parameter if using client-side caching
Webhook Issues
Troubleshooting steps:
- Verify your endpoint URL is publicly accessible (not localhost)
- Ensure your endpoint returns 2xx status within 30 seconds
- Check your firewall allows incoming HTTPS requests
- Verify the webhook is active in your dashboard
- Check the webhook delivery logs for failure reasons
Solutions:
- Use the raw request body for verification (not parsed JSON)
- Ensure you're using the correct webhook secret
- Check for encoding issues when computing the HMAC
- Verify you're using SHA-256 for the signature algorithm
Still having issues?
If you're still experiencing problems after trying these solutions, our developer support team is here to help. Include your request ID from the response headers when contacting us.
Ready to Integrate?
Contact our team to get your API key and discuss your integration requirements.
Request API Access