Skip to main content

API access

Your practice's data is stored as standard FHIR R4 records and can be read over a standard FHIR API by your own software or a vendor you trust. Every API key is scoped to your practice only: it can never see another practice on the platform, and every request is logged.

The full reference, with authentication steps and examples, is at developer.practiceharbor.com.

Creating a key​

Only the practice owner can manage API keys, because a key can read everything the practice has.

  1. Go to Settings → Developer and switch on Enable developer API. This works like the insurance switch: it is off for every practice until you turn it on, and turning it off later hides the key tools and blocks new keys (keys you already created keep working until you revoke them).
  2. Click Create API key, give it a label that says who will use it (for example Reporting spreadsheet or Acme referrals), and choose a scope:
    • Read-only — clients, appointments, billing, insurance, notes, and documents, read only.
    • Read + write — read-only plus the ability to create and update clients, appointments, insurance coverage, and accounts.
  3. Copy the client ID and client secret. The secret is shown once. If it is lost, revoke the key and create a new one.

Using a key​

Keys are standard OAuth 2.0 client credentials. Exchange them for a token at https://api.practiceharbor.com/oauth2/token, then call the FHIR API at https://api.practiceharbor.com/fhir/R4. Tokens last one hour. The reference site has copy-and-paste examples.

Some links the server returns, such as the next page of a search, use the host api.progressnotes.app. It is the same API and the same credentials; follow them as they are.

Revoking a key​

Settings → Developer → Revoke next to the key. Anything using it stops working immediately.

Partners and vendors​

If you are a company building an integration used by several practices, email support@practiceharbor.com. Partner access is granted per practice with a Business Associate Agreement, never self-serve.

Keeping it safe​

  • Never put a secret in a web page, mobile app, or shared document.
  • Give each integration its own key so you can revoke one without affecting the others.
  • Everything the API returns is protected health information; store only what your agreements cover.