AnyBio

API reference

The route list verified against the backend routers, grouped by task, with the key scope each needs, plus the generated OpenAPI document.

Two references, and which to trust for what:

  • The route list on this page is read from the backend's routers and is the complete public surface, with the key scope each route requires. It is the authoritative list.
  • The generated OpenAPI document (/openapi/anybio-v1.json) carries request and response schemas for the documented handlers. It is a subset of the route list. The API also serves the document for the deployed version at GET /api-docs/openapi.json, GET /api-docs/openapi.yaml and a browsable UI at /swagger-ui/.

Where the generated document and the mounted routes differ, this page uses the mounted paths: /api/v1/developer/keys and /api/v1/ingest/sessions/start.

Conventions

  • Base URL https://api.anybio.io. Paths below are absolute.
  • Authentication Authorization: Bearer <key>. API keys are created in the dashboard (Write scope keys start with sk_sandbox_ or sk_prod_; older keys start with org_). A key is bound to one environment; the request's environment is the key's. Browser sessions (the dashboard) and short-lived SDK tokens (POST /api/v1/sdk/token) use the same header.
  • Scopes Read, Write, Admin, Sdk. Each group below states what its reads and writes need. A handful of routes additionally require a signed-in staff member and refuse API keys outright; they are marked.
  • Environment header A dashboard session may send X-Environment-Id on writes; a mismatch with the session's environment is a 409. API keys do not need it.
  • Caching Responses that carry patient identifiers are sent Cache-Control: no-store; every error response is no-store.
  • Rate limits Per-session limits on the authenticated API and per-IP limits on the public routes return 429. Sandbox organizations are capped, never invoiced; a write against an expired sandbox trial returns 402.
  • Path parameters are written {name}. Ids are UUIDs unless the name says otherwise (project_id, key_id, biosignal_id are integers).

Programs

Read scope for GET, Write for the rest.

MethodPathNotes
GET/api/v1/episode-profilesfilters project_id, status
GET/api/v1/episode-profiles/count
GET/api/v1/episode-profiles/{id}
GET/api/v1/episode-profiles/{id}/status
GET/api/v1/episode-profiles/{id}/protocol-stateauthoring draft state
GET/api/v1/episode-profiles/{id}/symptom-readinessprogram-scoped readiness ladder
GET/api/v1/episode-profiles/{id}/enrollments/count
GET/api/v1/episode-profiles/{id}/qr.pngenrollment QR
GET/api/v1/episode-profiles/{id}/versions
GET/api/v1/episode-profiles/sessionsauthoring sessions
GET/api/v1/biosignals/availablesignals a program may require
POST/api/v1/episode-profilescreate (201)
POST/api/v1/episode-profiles/validatevalidate a spec without saving
POST/api/v1/episode-profiles/sessionsstart an authoring session
PATCH/api/v1/episode-profiles/{id}
DELETE/api/v1/episode-profiles/{id}soft delete
POST/api/v1/episode-profiles/{id}/activate
POST/api/v1/episode-profiles/{id}/deprecate
POST/api/v1/episode-profiles/{id}/toggle-active
POST/api/v1/episode-profiles/{id}/clonebody target_project_id
POST/api/v1/episode-profiles/{slug}/enrollbody xuser_id, optional project_id, metadata

Program authoring with the assistant: GET /api/v1/profile-authoring/tools (Read), POST /api/v1/profile-authoring/start, POST /api/v1/profile-authoring/conversations/{conversation_id}/message, POST /api/v1/profile-authoring/conversations/{conversation_id}/stream (per-IP rate limited).

Episodes and attention

Read for GET, Write for the rest.

MethodPathNotes
GET/api/v1/episodesfilters xuser_id, project_id, episode_profile_id, status, attention_gte, limit, offset
GET/api/v1/episodes/resolve
GET/api/v1/episodes/{id}
GET/api/v1/episodes/{id}/attentionthe attention breakdown
GET/api/v1/episodes/{id}/fhirthe episode as a FHIR bundle
GET/api/v1/episodes/{id}/artifacts
GET/api/v1/episodes/{episode_id}/artifacts/{artifact_id}/download
GET/api/v1/episodes/{id}/summaries
GET/api/v1/episodes/{id}/progress
GET/api/v1/episodes/{id}/sdk-config
GET/api/v1/episodes/{episode_id}/timelinealso /timeline/stats
GET/api/v1/episodes/{episode_id}/observations
POST/api/v1/episodescreate by hand
PATCH/api/v1/episodes/{id}
DELETE/api/v1/episodes/{id}
POST/api/v1/episodes/{id}/close
POST/api/v1/episodes/{id}/reopen
POST/api/v1/episodes/{id}/attention/acknowledgelower the floor
POST/api/v1/episodes/{episode_id}/questionnaire-responsesubmit a PRO response

Also GET /api/v1/timeline (project-wide), GET /api/v1/xusers/{xuser_id}/timeline and /patient-timeline (Read).

Rules

Read for GET, Write for the rest.

MethodPath
GET/api/v1/policies
GET/api/v1/policies/{policy_id}
GET/api/v1/policies/{policy_id}/executions
POST/api/v1/policies
PUT/api/v1/policies/{policy_id}
DELETE/api/v1/policies/{policy_id}
POST/api/v1/policies/{policy_id}/test

Patients and contact points

Read for GET, Write for the rest.

MethodPathNotes
GET/api/v1/xusers
GET/api/v1/xusers/{xuser_id}
GET/api/v1/xusers/{xuser_id}/vitals-summary
GET/api/v1/xusers/{xuser_id}/health-metrics
GET/api/v1/xusers/stats/unassociated
POST/api/v1/xuserscreate or get by identifier
POST/api/v1/xusers/add_to_project
PATCH/api/v1/xusers/{xuser_id}
DELETE/api/v1/xusers/{xuser_id}soft delete
GET/api/v1/contact_pointsalso GET /fhir/ContactPoint
POST/api/v1/contact_points
PATCH/api/v1/contact_points/{id}
DELETE/api/v1/contact_points/{id}and POST .../{id}/restore
PUT/api/v1/xusers/{xuser_id}/phonebody value (E.164 or null)

Observations

Read for GET, Write for POST. Direct writes link to the episode_ids you pass and do not evaluate rules.

MethodPath
GET/api/v1/observations
GET/api/v1/observations/latest
GET/api/v1/observations/trend
GET/api/v1/observations/{id}
POST/api/v1/observations
POST/api/v1/observations/batch
POST/api/v1/xusers/{xuser_id}/observations/journal

Device ingest and inbound webhooks

MethodPathAuth
POST/webhooks/<provider>/{project_key}cellular device hub; shared secret in Authorization; public route
POST/webhooks/<sms-provider>/sms/{project_key}inbound SMS; provider signature; public route
POST/ingest/imageWrite
POST/ingest/capturesWrite; 8 MB
POST/ingest/raw-packetWrite; SDK streaming
GET/api/v1/images, /api/v1/images/{image_id}, /api/v1/images/{image_id}/fileRead
POST/api/v1/images/reprocessWrite

Wearable account webhooks are mounted per provider under /webhooks/ and verified per provider. Ingest sessions and signal streams (/api/v1/ingest/sessions/..., /api/v1/sessions/{session_id}/signal-streams, /api/v1/signal-streams/{stream_id}/...) are the SDK's streaming surface; see Stream on iOS.

Symptom interviews, agents and conversations

MethodPathScope
GET/api/v1/agents, /api/v1/agents/{id}, /api/v1/agents/{agent_id}/runs, /api/v1/agents/{agent_id}/runs/{run_id}, /api/v1/agents/{agent_id}/previewRead
GET/api/v1/episode-profiles/{profile_id}/agentsRead
GET/api/v1/agent-runs, /api/v1/agent-runs/{run_id}Read
GET/api/v1/agent-runs/pending-reviewsRead; the review queue of agent runs
POST/api/v1/agents/{agent_id}/invokeWrite
POST/api/v1/agent-runs/{run_id}/reviewWrite; staff session required
POST, PATCH, DELETE/api/v1/agents, /api/v1/agents/{id}, /api/v1/agents/{agent_id}/attach, /api/v1/agent-profile-links/{link_id}Admin
GET/api/v1/conversations, /api/v1/conversations/{id}Read
POST/api/v1/conversations, .../{conversation_id}/messages, .../{conversation_id}/tool-results, .../{id}/archiveWrite

The symptom interview has no route of its own: it is opened by a rule, driven by inbound SMS, and read through agent runs, observations and the timeline.

The gate: policies and decision records

MethodPathScope
GET/api/v1/compliance/policiesRead
GET/api/v1/compliance/policies/activeRead; project_id optional
PATCH/api/v1/compliance/policies/activeWrite; upsert a new active version
POST/api/v1/compliance/policies/draftWrite; assistant-drafted policy
POST/api/v1/compliance/policies/validateWrite; normalize and warn
POST/api/v1/compliance/policies/{policy_id}/activateWrite
GET/api/v1/compliance/checksAdmin; filters and a release-status histogram
POST/api/v1/compliance/checksAdmin; records a decision already made
GET/api/v1/compliance/checks/{check_id}Admin
POST/api/v1/compliance/checks/{check_id}/releaseAdmin; staff session required
POST/api/v1/compliance/checks/{check_id}/rejectAdmin; staff session required

Govern: the gate for AI that is not ours

Govern is authenticated differently from the rest of this list. The runtime routes take an application key (gk_..., created with the application), not an organization API key, and they are the only routes in the public surface that do. Management routes take an organization key or a dashboard session. The four hand-off actions take a dashboard session only and refuse keys outright: claiming or resolving a hand-off is a person's act and the record names them.

The @anybio/govern SDK wraps the runtime routes.

Runtime. Application key.

MethodPathNotes
POST/api/v1/govern/evaluateEvaluate one turn before it is sent. turn_id is the idempotency key
GET/api/v1/govern/decisions/{decision_id}The decision with its review state; the first hold-resolution path
POST/api/v1/govern/decisions/{decision_id}/outcomeWhat was delivered. One outcome per decision
POST/api/v1/govern/disclosuresRecord the AI-identity disclosure shown at the start of a conversation
POST/api/v1/govern/patients/stateThe patient's state. A POST so the reference travels in the body
POST/api/v1/govern/patients/consentConsent granted or revoked
POST/api/v1/govern/patients/opt-outA patient opting out, or back in
GET/api/v1/govern/webhook-deliveriesThe webhook delivery log, newest first
POST/api/v1/govern/transcriptsA batch of past turns, evaluated observe-only
GET/api/v1/govern/transcripts/{job_id}A transcript job's status and counts
GET/api/v1/govern/transcripts/{job_id}/turnsThe job's turns in batch order with their decisions

Applications, keys and reports. Every route here takes an organization admin's dashboard session or an Admin scope organization key; lower key scopes are refused. The same screens are in the dashboard under Govern, Applications.

MethodPathNotes
GET/api/v1/govern/applicationsThe organization's applications in this environment
POST/api/v1/govern/applicationsCreates the application and mints its first key
GET/api/v1/govern/applications/{application_id}One application, with its channel modes
PATCH/api/v1/govern/applications/{application_id}A mode change is audited with the actor
GET/api/v1/govern/applications/{application_id}/keysKey metadata, never a secret
POST/api/v1/govern/applications/{application_id}/keys/rotateMints a new key and ages out the previous
POST/api/v1/govern/applications/{application_id}/webhook-secret/rotateThe new secret is in the response only
GET/api/v1/govern/applications/{application_id}/observe-reportCounts by decision, policy and channel over a window
GET/api/v1/govern/applications/{application_id}/observe-report.csvThe buckets the counts were summed from
GET/api/v1/govern/applications/{application_id}/observe-report.pdfThe document an account holder sends to a reviewer
DELETE/api/v1/govern/applications/{application_id}/patientsPurges patient state and ledger for the application

Hand-offs. Reads take a key or a session; every action below requires a signed-in staff member and refuses an API key.

MethodPathNotes
GET/api/v1/govern/handoffsRead
GET/api/v1/govern/handoffs/{handoff_id}Read; its events and the decisions that opened or joined it
POST/api/v1/govern/handoffs/{handoff_id}/claimexpected_version must be the current version
POST/api/v1/govern/handoffs/{handoff_id}/contact-attemptOn a claimed hand-off
POST/api/v1/govern/handoffs/{handoff_id}/resolveOn a claimed hand-off
POST/api/v1/govern/handoffs/{handoff_id}/resumeReleases the hold on a resolved hand-off

Care hand-offs and the messaging policy

Every route here requires a signed-in staff member in addition to the key scope.

MethodPathScope
GET/api/v1/care-handoffsRead
GET/api/v1/care-handoffs/{id}Read
POST/api/v1/care-handoffs/{id}/claimWrite
POST/api/v1/care-handoffs/{id}/contact-attemptWrite
POST/api/v1/care-handoffs/{id}/resolveWrite
POST/api/v1/care-handoffs/{id}/resumeWrite
GET/api/v1/patient-messaging-policyRead
GET/api/v1/patient-messaging-policy/staffRead
PUT/api/v1/patient-messaging-policyAdmin; organization admin
MethodPathAuth
POST/api/v1/public/sms-optinpublic, captcha, per-IP limit
POST/api/v1/communication_consent/sms/resendWrite
GET/api/v1/anybio/programs/{handle}/disclosurepublic
GET, POST/api/v1/notification-provider-configsAdmin
GET, PATCH, DELETE/api/v1/notification-provider-configs/{config_id}Admin
GET, POST/api/v1/notifications, .../{notification_id}, .../{notification_id}/acknowledge, /dismiss, /channels/{channel_id}/click, /device-tokensRead for GET, Write for POST

Billing periods and adherence

Staff session required on the billing-period routes.

MethodPathScope
GET/api/v1/billing-periods/current-periodRead
GET/api/v1/billing-periods/patients/{xuser_id}Read
GET/api/v1/billing-periods/programs/{episode_profile_id}/patientsRead
PATCH/api/v1/billing-periods/enrollments/{enrollment_id}/order-referenceWrite

Export

Read for GET, Write for the rest.

MethodPath
GET, POST/api/v1/data-exports
GET, PATCH, DELETE/api/v1/data-exports/{id}
POST/api/v1/data-exports/{id}/test
GET/api/v1/episodes/{episode_id}/data-exports
POST/api/v1/episodes/{episode_id}/data-exports/{data_export_id}
GET/api/v1/episode-data-exports/{id}
POST/api/v1/episode-data-exports/{id}/retry
GET, POST/api/v1/fhir-medplum-configs
GET, PATCH, DELETE/api/v1/fhir-medplum-configs/{id}
GET, POST/api/v1/hl7-endpoints
GET, PATCH, DELETE/api/v1/hl7-endpoints/{id}
GET/api/v1/integrations/epic/sandbox-demo

Public FHIR terminology: GET /fhir/CodeSystem/biosignal. Public keys for SMART Backend Services: GET /.well-known/jwks.json.

Synthetics

Read for GET, Write for POST.

MethodPath
GET/api/v1/synthetics/scenarios
GET/api/v1/synthetics/runs, /api/v1/synthetics/runs/{id}, /api/v1/synthetics/runs/{id}/impact
POST/api/v1/synthetics/runs (scenario_slug, project_id, xuser_id, developer_key_id, episode_profile_id)
POST/api/v1/synthetics/runs/{id}/cancel

Scenarios drive ECG, PPG, EDA and temperature streams into a program; a cuff reading is posted through the device webhook instead.

Keys, projects, organization, environment

MethodPathScope
GET, POST/api/v1/developer/keysAdmin
GET, DELETE/api/v1/developer/keys/{key_id}Admin
POST/api/v1/developer/keys/{key_id}/revokeAdmin
POST/api/v1/sdk/tokenWrite; mints a short-lived patient token
POST/api/v1/sdk/sessionpublic; publishable key flow
GET, POST/api/v1/projectsRead / Write
GET, PATCH, DELETE/api/v1/projects/{project_id}Read / Write
GET, POST, DELETE/api/v1/projects/{project_id}/usersRead / Write
GET, PATCH/api/v1/organizations, /api/v1/organizations/{id}Read / Write
GET/api/v1/environments, /api/v1/session/environmentRead
POST/api/v1/session/environmentWrite; switch a session's environment
GET/api/v1/audit, /api/v1/audit/entities/{entity_type}/{entity_id}, /api/v1/audit/xusers/{xuser_id}, /api/v1/audit/episodes/{episode_id}, /api/v1/audit/correlation/{correlation_id}Admin
GET/api/v1/admin/usage/summary, /api/v1/admin/usage/xusers/{xuser_id}/summary, /api/v1/admin/usage/eventsAdmin

Other areas

Documented in their own sections of this portal: the biosignal catalog (/api/v1/biosignals, /api/v1/public/biosignals, /api/v1/projects/{project_id}/biosignals), device catalog and profiles (/api/v1/devices, /api/v1/device-profiles), wearable connections and sources (/api/v1/xusers/{xuser_id}/connections, /api/v1/sources, /api/v1/oauth/..., /api/v1/oauth_providers), feature series and charts (/api/v1/feature-series/{feature_id}, /api/v1/charts/query), the model registry and routing (/api/v1/models, /api/v1/infer/image, /api/v1/infer/biosignal, /api/v1/model-routing), DSP algorithms (/api/v1/dsp-algorithms), the content library, and the MCP endpoint (/mcp, OAuth bearer). Internal SuperAdmin routes under /api/v1/admin/ are in the generated document but are not part of the customer API.

Billing readiness

The fixed-period ledger of unique transmission days per enrollment, its tiers and pace states, the order reference, and the disclaimer that goes with all of it - evidence, never charges.

On this page

ConventionsProgramsEpisodes and attentionRulesPatients and contact pointsObservationsDevice ingest and inbound webhooksSymptom interviews, agents and conversationsThe gate: policies and decision recordsGovern: the gate for AI that is not oursCare hand-offs and the messaging policyConsent and SMSBilling periods and adherenceExportSyntheticsKeys, projects, organization, environmentOther areas