TRUE CARE SYSTEM • API DOCUMENTATION
API Overview
Understand the API architecture, request lifecycle, authentication model, Provider scope, response conventions, and production integration responsibilities.
Understand the API architecture, request lifecycle, authentication model, Provider scope, response conventions, and production integration responsibilities.
This guide documents the approved integration model without publishing production secrets, private endpoint inventories, internal database identifiers, or customer-specific validation rules.
Architecture
True Care System uses a Provider-scoped API layer between authenticated clients and the application database. Web and Mobile clients submit requests over HTTPS. The API authenticates the request, resolves Provider scope, evaluates role permissions, validates input, performs the requested operation, and records applicable audit evidence.
Standard Request Lifecycle
- Receive the HTTPS request.
- Validate authentication and session state.
- Resolve the authorized Provider and user context.
- Evaluate role and action permission.
- Validate route parameters, query parameters, and request body.
- Execute Provider-scoped business logic.
- Record required audit or PHI-access evidence.
- Return a normalized response and safe error information.
Common Headers
| Header | Purpose |
|---|---|
Authorization | Supplies the approved bearer or session credential. |
Content-Type | Normally application/json for JSON request bodies. |
Accept | Identifies the expected response representation. |
X-Request-ID | Correlation identifier for support and audit investigation. |
Normalized Response Pattern
{
"success": true,
"message": "Request completed.",
"data": {},
"requestId": "example-request-id"
}General Error Pattern
{
"success": false,
"message": "The request could not be completed.",
"errorCode": "VALIDATION_ERROR",
"details": [],
"requestId": "example-request-id"
}Production Readiness
- Use HTTPS only.
- Do not trust browser-supplied Provider identifiers without server authorization.
- Validate all input.
- Use least-privilege database access.
- Record appropriate audit evidence.
- Do not return secrets, password hashes, private tokens, or unrestricted PHI.
- Run smoke, regression, integration, security, and HIPAA testing.