1. Clinics

Enroll the clinics you order for, keep their practice details current, and manage the regulated records (identity and banking) that decide who is billed.

Read first: Clinics and agreements.

Base URL https://api.axiomscript.com. Every request is signed; see Authentication and signing.

POST/clinicsEnroll a clinic with partner-attested termsPATCH/clinicsUpdate an already-enrolled clinic's profile fieldsPATCH/clinics/identityChange a clinic's identity (NPI / legal entity / EIN)PUT/clinics/bankingReplace a clinic's bank accountPOST/clinics/banking/authorizeAuthorize a clinic's newest saved bank account for ACH

Enroll a clinic with partner-attested terms

POST/api/inbound/{partnerSlug}/clinics

Register a clinic and record its attested terms. Attestation belongs here, not on order payloads. This is NOT a prerequisite for ordering: an order carrying a clinic.external_id we have not seen auto-creates the clinic (order-first onboarding). Enroll explicitly when you want the clinic on file with its contacts and attestation before any order arrives, or when your partner account requires a signed agreement before orders are accepted (otherwise create returns 422 agreement_unsigned). With a sandbox key nothing real is written: the request is checked exactly as in production, only the clinic's external_id is recorded (so later sandbox orders for it pass a partner-attested agreement check), and the answer is 201 with sandbox: true and clinicId: null. A sandbox order never auto-creates a clinic.

Parameters

partnerSlugstringpathrequired

The partner's Axiom-issued slug (e.g. acme-health).

Idempotency-Keystringheaderrequired

REQUIRED on every endpoint that creates or changes something (see the Idempotency section of the API description for the list). Omitting it is a 400 idempotency_key_required. Replaying the same key with the SAME body returns the original response. Reusing a key with a DIFFERENT body is a 409 idempotency_key_reused. Max 128 characters.

Request body

clinicobjectrequired

 

clinic.external_idstringrequired

Your own id for this clinic. 1 to 128 characters.

clinic.npistringrequired

Clinic group/organization NPI Pattern ^\d{10}$.

clinic.namestringrequired

Practice / display name. 1 to 200 characters.

clinic.legal_entity_namestringrequired

Legal entity for tax and billing. Often differs from the practice name. 1 to 255 characters.

clinic.dbastringoptional

Doing-business-as. Optional. 1 to 255 characters.

clinic.einstringrequired

Employer Identification Number. 9 digits, XX-XXXXXXX accepted. Stored encrypted.

clinic.legal_addressobjectrequired

 

clinic.legal_address.line1stringrequired

1 to 200 characters.

clinic.legal_address.line2stringoptional

Suite/unit. Optional. 1 to 200 characters.

clinic.legal_address.citystringrequired

1 to 100 characters.

clinic.legal_address.statestringrequired

2 to 2 characters. Pattern ^[A-Za-z]{2}$.

clinic.legal_address.zipstringrequired

1 to 10 characters.

clinic.primary_contact_first_namestringrequired

1 to 100 characters.

clinic.primary_contact_last_namestringrequired

1 to 100 characters.

clinic.primary_contact_emailstring (email)required

Up to 255 characters.

clinic.primary_contact_phonestringoptional

Optional. 1 to 32 characters.

clinic.support_emailstring (email)optional

Ops/support email Up to 255 characters.

clinic.billing_emailstring (email)required

Up to 255 characters.

clinic.billing_phonestringrequired

1 to 32 characters.

clinic.authorized_signer_namestringrequired

1 to 255 characters.

clinic.authorized_signer_titlestringrequired

1 to 120 characters.

clinic.bankingobjectoptional

ACH bank account for weekly billing. REQUIRED, except as described below. Used ONLY for a partner-attested account: the attestation is the clinic's ACH authorization. Stored ENCRYPTED at rest; the full routing and account numbers are NEVER returned in any response. Sending a DIFFERENT account for a clinic that already has one on file returns 409 banking_conflict, not a silent overwrite. If Axiom bills YOUR ACCOUNT directly (not your clinics) and your account is not partner-attested, your clinics are never debited, so this field is OPTIONAL. If you send it anyway it is still shape-checked, then ignored: nothing of it is stored and the enroll answers normally with banking_ignored_partner_billed in warnings. Any other account that is not partner-attested and sends it gets 422 banking_requires_attestation, and nothing is stored. (An account whose clinics sign Axiom's agreement by e-signature cannot use this endpoint at all: it is refused with 422 axiom_boldsign_required, or with 422 banking_requires_attestation if Axiom bills its clinics and it sent clinic.banking, or with a 400 if a required field is missing.)

clinic.banking.account_holder_namestringrequired

Name exactly as it appears on the bank statement (usually the legal entity name). 1 to 255 characters.

clinic.banking.account_typestringrequired

One of: checking, savings.

clinic.banking.bank_namestringrequired

1 to 120 characters.

clinic.banking.routing_numberstringrequired

9-digit ACH routing number. Checksum-validated, and the first two digits must be an ACH range (01-12, 21-32, 61-72). Use your bank's ACH routing number, not its wire routing number. They are often different.

clinic.banking.account_numberstringrequired

4 to 17 digits. Leading zeros preserved.

attestationobjectrequired

 

attestation.versionstringrequired

1 to 32 characters.

attestation.accepted_bystringrequired

1 to 255 characters.

attestation.accepted_atstring (date-time)required

 

attestation.evidenceobjectoptional

Attestation metadata only (terms flags, signature/document refs, ip, user agent). Never patient or order data. Capped at 2000 characters of serialized JSON.

Responses

Status	Meaning
201	Clinic enrolled, or idempotent replay of a prior enrollment
400	The request was malformed. validation_failed means the body or query failed schema validation (see issues). On a mutating endpoint you can also get idempotency_key_required (no Idempotency-Key header), idempotency_key_invalid (empty, or longer than 128 characters), or idempotency_key_mismatch (the header and the body's idempotency_key are different strings).
401	Missing, expired, or invalid HMAC signature / timestamp
403	production_not_enabled. You signed with a production key, but Axiom has not yet flipped the production gate on your partner account. Holding a production key is deliberately not enough to place live orders. Contact Axiom to enable it.
409	banking_conflict: this clinic already has a DIFFERENT bank account on file; nothing in the request was saved. Change the account with PUT /api/inbound/{partnerSlug}/clinics/banking, then re-send the enroll with the new account; contact and practice details alone can be updated with PATCH /api/inbound/{partnerSlug}/clinics. Or idempotency_key_reused: this Idempotency-Key was already used with a different request body. (A different attestation for an existing clinic is no longer a 409: see attestation on the success response.)
422	Partner is not configured for partner attestation, or the clinic cannot be enrolled. banking_requires_attestation means clinic.banking was sent by an account that is neither partner-attested nor billed directly; nothing was stored.
423	partner_inactive or tenant_suspended. Your partner account is deactivated or suspended, so no request will be served until it is reinstated.
429	Per-partner rate limit exceeded

Response fields (201)

oktruerequired

 

clinicIdintegerrequired

 

agreementStatusstring | nullrequired

The clinic's agreement state. On a partner-attested account it is signed once the attestation is recorded. Otherwise it is the clinic's own e-signature state (sent or signed), or null when no agreement has been sent, so do not assume a string.

alreadyEnrolledbooleanrequired

 

attestationstringoptional

Present only when this clinic already had a DIFFERENT attestation (signer or time) for the same terms version. The first one is kept unchanged, the rest of the request is applied, and the mismatch is recorded on our side. One of: kept_existing.

warningsarray of objectrequired

NON-BLOCKING notices. The clinic WAS enrolled. Always present, [] when there is nothing to say, so you can check warnings.length. Today the only code is banking_ignored_partner_billed (field clinic.banking): your account is billed directly, so the bank details you sent are not needed and were not stored.

warnings[].codestringrequired

Stable machine code. Today only banking_ignored_partner_billed.

warnings[].fieldstringrequired

Dotted path of the field, e.g. clinic.banking.

warnings[].messagestringrequired

Human-readable explanation. Never contains a value you sent.

Request

POST /api/inbound/acme-health/clinics
Host: api.axiomscript.com
Content-Type: application/json
X-Axiom-Timestamp: 1767225600
X-Axiom-Signature: sha256=<hex>
Idempotency-Key: <your key>

{
  "clinic": {
    "external_id": "acme-clinic-001",
    "npi": "1234567893",
    "name": "Example Wellness Clinic",
    "legal_entity_name": "Example Wellness LLC",
    "ein": "12-3456789",
    "legal_address": {
      "line1": "500 Clinic Way",
      "city": "Springfield",
      "state": "TX",
      "zip": "62701"
    },
    "primary_contact_first_name": "Jordan",
    "primary_contact_last_name": "Sample",
    "primary_contact_email": "owner@clinic.example",
    "billing_email": "billing@clinic.example",
    "billing_phone": "406-555-0101",
    "authorized_signer_name": "Jordan Sample",
    "authorized_signer_title": "Owner",
    "banking": {
      "account_holder_name": "Example Wellness LLC",
      "account_type": "checking",
      "bank_name": "Example Bank",
      "routing_number": "110000000",
      "account_number": "000123456789"
    }
  },
  "attestation": {
    "version": "2026-06",
    "accepted_by": "Jordan Sample",
    "accepted_at": "2026-10-20T16:00:00.000Z",
    "evidence": {
      "partner_user_id": "user_123",
      "terms_screen": "axiom_terms_v2026_06"
    }
  }
}

Response 201

{
  "ok": true,
  "clinicId": 43962,
  "agreementStatus": "signed",
  "alreadyEnrolled": false,
  "warnings": []
}

Update an already-enrolled clinic's profile fields

PATCH/api/inbound/{partnerSlug}/clinics

Partial update of an existing clinic's practice information. Send only the fields you want to change; omitted fields are left unchanged. Identify the clinic by its external_id in the body (the same id you enrolled it with). This covers contact, billing/support email, phones, clinic name, authorized signer, DBA, and legal address only. A clinic's identity (npi, ein, legal_entity_name) and its bank account are NOT editable here; those are regulated changes with their own authorized flows. Nullable fields (support_email, primary_contact_phone, dba, billing_contact_name) may be sent as null to clear them. On an account whose clinics sign Axiom's agreement by e-signature, the signer fields (primary_contact_email, authorized_signer_name, authorized_signer_title) cannot be changed here: 422 signer_identity_locked_boldsign, with the refused fields. The response lists exactly the fields that changed (empty when the submitted values already matched). With a sandbox key nothing is saved: the request is checked, then answered 200 with sandbox: true and saved: false for a clinic enrolled with a sandbox key, or 404 clinic_not_found for any other. A sandbox key never changes a real clinic.

Parameters

partnerSlugstringpathrequired

The partner's Axiom-issued slug (e.g. acme-health).

Idempotency-Keystringheaderrequired

REQUIRED on every endpoint that creates or changes something (see the Idempotency section of the API description for the list). Omitting it is a 400 idempotency_key_required. Replaying the same key with the SAME body returns the original response. Reusing a key with a DIFFERENT body is a 409 idempotency_key_reused. Max 128 characters.

Request body

clinicobjectrequired

external_id identifies the clinic to update (required); every other field is optional and only the ones you send change. At least one updatable field must be present. Fields marked nullable may be sent as null to clear them.

clinic.external_idstringrequired

1 to 128 characters.

clinic.namestringoptional

1 to 200 characters.

clinic.primary_contact_first_namestringoptional

1 to 100 characters.

clinic.primary_contact_last_namestringoptional

1 to 100 characters.

clinic.primary_contact_emailstring (email)optional

Up to 255 characters.

clinic.primary_contact_phonestring | nulloptional

1 to 32 characters.

clinic.support_emailstring (email) | nulloptional

Up to 255 characters.

clinic.billing_emailstring (email)optional

Up to 255 characters.

clinic.billing_phonestringoptional

1 to 32 characters.

clinic.dbastring | nulloptional

1 to 255 characters.

clinic.billing_contact_namestring | nulloptional

1 to 200 characters.

clinic.authorized_signer_namestringoptional

1 to 255 characters.

clinic.authorized_signer_titlestringoptional

1 to 120 characters.

clinic.legal_addressobjectoptional

 

clinic.legal_address.line1stringrequired

1 to 200 characters.

clinic.legal_address.line2string | nulloptional

1 to 200 characters.

clinic.legal_address.citystringrequired

1 to 100 characters.

clinic.legal_address.statestringrequired

Two-letter US state or territory code (validated against the real USPS set). 2 to 2 characters. Pattern ^[A-Za-z]{2}$.

clinic.legal_address.zipstringrequired

1 to 10 characters.

Responses

Status	Meaning
200	Clinic updated (or a no-op when nothing changed)
400	The request was malformed. validation_failed means the body or query failed schema validation (see issues). On a mutating endpoint you can also get idempotency_key_required (no Idempotency-Key header), idempotency_key_invalid (empty, or longer than 128 characters), or idempotency_key_mismatch (the header and the body's idempotency_key are different strings).
401	Missing, expired, or invalid HMAC signature / timestamp
403	production_not_enabled. You signed with a production key, but Axiom has not yet flipped the production gate on your partner account. Holding a production key is deliberately not enough to place live orders. Contact Axiom to enable it.
404	clinic_not_found: no clinic with that external_id exists for this partner.
422	signer_identity_locked_boldsign: see the description. Carries fields and message.
423	partner_inactive or tenant_suspended. Your partner account is deactivated or suspended, so no request will be served until it is reinstated.
429	Per-partner rate limit exceeded

Response fields (200)

oktruerequired

 

clinicIdintegerrequired

 

updatedarray of stringrequired

The field names that actually changed. Empty when the values you sent already matched what was on file (a no-op).

Request

PATCH /api/inbound/acme-health/clinics
Host: api.axiomscript.com
Content-Type: application/json
X-Axiom-Timestamp: 1767225600
X-Axiom-Signature: sha256=<hex>
Idempotency-Key: <your key>

{
  "clinic": {
    "external_id": "acme-clinic-001",
    "support_email": "support@clinic.example",
    "billing_phone": "406-555-0102"
  }
}

Response 200

{
  "ok": true,
  "clinicId": 43962,
  "updated": [
    "support_email",
    "billing_phone"
  ]
}

Change a clinic's identity (NPI / legal entity / EIN)

PATCH/api/inbound/{partnerSlug}/clinics/identity

Change an existing clinic's regulated identity fields, identified by external_id: group/organization NPI, legal entity name, and EIN (tax id). Kept separate from the profile PATCH because these decide who is billed and issued a 1099, so this endpoint carries the same authorization gate as banking: it is accepted only for a partner-attested partner AND a clinic that has its own partner-attested agreement on record. Send only the fields you want to change; each is independently correctable. None can be cleared to null. The EIN is validated, stored encrypted, and NEVER returned or logged (only its last-4 is retained on the clinic); the response lists which fields changed, no values. With a sandbox key nothing is saved: the request is checked, then answered 200 with sandbox: true and saved: false for a clinic enrolled with a sandbox key, or 404 clinic_not_found for any other. A sandbox key never changes a real clinic.

Parameters

partnerSlugstringpathrequired

The partner's Axiom-issued slug (e.g. acme-health).

Idempotency-Keystringheaderrequired

REQUIRED on every endpoint that creates or changes something (see the Idempotency section of the API description for the list). Omitting it is a 400 idempotency_key_required. Replaying the same key with the SAME body returns the original response. Reusing a key with a DIFFERENT body is a 409 idempotency_key_reused. Max 128 characters.

Request body

clinicobjectrequired

external_id identifies the clinic (required). Send only the identity fields you want to change; at least one of npi, legal_entity_name, or ein must be present. None can be cleared to null. ein is stored encrypted and never returned; only its last-4 is retained on the clinic.

clinic.external_idstringrequired

1 to 128 characters.

clinic.npistringoptional

10-digit group/organization NPI. Pattern ^\d{10}$.

clinic.legal_entity_namestringoptional

1 to 255 characters.

clinic.einstringoptional

Employer Identification Number. 9 digits, XX-XXXXXXX accepted. Stored encrypted; never returned.

Responses

Status	Meaning
200	Identity updated (or a no-op when nothing changed)
400	The request was malformed. validation_failed means the body or query failed schema validation (see issues). On a mutating endpoint you can also get idempotency_key_required (no Idempotency-Key header), idempotency_key_invalid (empty, or longer than 128 characters), or idempotency_key_mismatch (the header and the body's idempotency_key are different strings).
401	Missing, expired, or invalid HMAC signature / timestamp
403	production_not_enabled. You signed with a production key, but Axiom has not yet flipped the production gate on your partner account. Holding a production key is deliberately not enough to place live orders. Contact Axiom to enable it.
404	No clinic with that external_id exists for this partner.
409	The NPI you sent is already used by ANOTHER clinic under your account (npi_conflict). A group NPI must be unique per clinic so orders resolve correctly.
422	The partner is not attestation-mode (identity_requires_attestation) or the clinic has no partner-attested agreement on record (clinic_not_attested).
423	partner_inactive or tenant_suspended. Your partner account is deactivated or suspended, so no request will be served until it is reinstated.
429	Per-partner rate limit exceeded

Response fields (200)

oktruerequired

 

clinicIdintegerrequired

 

updatedarray of stringrequired

The field names that actually changed. Empty when the values you sent already matched what was on file (a no-op).

Request

PATCH /api/inbound/acme-health/clinics/identity
Host: api.axiomscript.com
Content-Type: application/json
X-Axiom-Timestamp: 1767225600
X-Axiom-Signature: sha256=<hex>
Idempotency-Key: <your key>

{
  "clinic": {
    "external_id": "acme-clinic-001",
    "legal_entity_name": "Example Wellness Group LLC"
  }
}

Response 200

{
  "ok": true,
  "clinicId": 43962,
  "updated": [
    "legal_entity_name"
  ]
}

Replace a clinic's bank account

PUT/api/inbound/{partnerSlug}/clinics/banking

Deliberately replace an existing clinic's bank account, identified by external_id. This is the authorized way to change banking: the enroll endpoint refuses a different account with 409 banking_conflict precisely so a re-enroll cannot silently overwrite payment-authorization material. Send the full account (a bank account is atomic, so this is a PUT, not a partial patch). Account and routing numbers are stored encrypted and are NEVER returned; the only visible result is whether the account changed. Where Axiom keeps the clinic's bank accounts as revisions, the new account is saved beside the current one and debits keep using the current account until Axiom makes the new one active. Neither this call nor authorizing the new account (POST /clinics/banking/authorize) switches debits by itself, so neither stops debits against the old account. Otherwise the account is replaced and a new ACH authorization must be captured before a debit. If Axiom bills your account directly and it is not partner-attested, your clinics are never debited: the call is a 200 no-op (changed: false) with banking_ignored_partner_billed in warnings, and nothing you sent is stored. With a sandbox key nothing is saved: the request is checked, then answered 200 with sandbox: true and saved: false for a clinic enrolled with a sandbox key, or 404 clinic_not_found for any other. A sandbox key never changes a real clinic.

Parameters

partnerSlugstringpathrequired

The partner's Axiom-issued slug (e.g. acme-health).

Idempotency-Keystringheaderrequired

REQUIRED on every endpoint that creates or changes something (see the Idempotency section of the API description for the list). Omitting it is a 400 idempotency_key_required. Replaying the same key with the SAME body returns the original response. Reusing a key with a DIFFERENT body is a 409 idempotency_key_reused. Max 128 characters.

Request body

clinicobjectrequired

 

clinic.external_idstringrequired

1 to 128 characters.

bankingobjectrequired

The full bank account. Stored ENCRYPTED at rest; routing and account numbers are NEVER returned in any response.

banking.account_holder_namestringrequired

1 to 255 characters.

banking.account_typestringrequired

One of: checking, savings.

banking.bank_namestringrequired

1 to 120 characters.

banking.routing_numberstringrequired

9-digit ACH routing number. Checksum-validated, and the first two digits must be an ACH range (01-12, 21-32, 61-72). Use your bank's ACH routing number, not its wire routing number. They are often different.

banking.account_numberstringrequired

4 to 17 digit account number.

Responses

Status	Meaning
200	Bank account replaced (or a no-op when the account already matched)
400	validation_failed (see fields and issues; a message can quote a submitted value), or banking_invalid (a bank field failed the storage check, for example a bank name or account-holder name that is only spaces; malformed routing or account numbers are normally caught first as validation_failed).
401	Missing, expired, or invalid HMAC signature / timestamp
403	production_not_enabled. You signed with a production key, but Axiom has not yet flipped the production gate on your partner account. Holding a production key is deliberately not enough to place live orders. Contact Axiom to enable it.
404	clinic_not_found: no clinic with that external_id exists for this partner.
409	ach_debit_in_flight: a debit for this clinic is being processed, so the account cannot change until it settles. Retry later. Or idempotency_key_reused / idempotency_key_in_flight.
422	banking_requires_attestation (your account is not partner-attested, so banking cannot be changed through the API) or clinic_not_attested (this clinic has no partner attestation on file; enroll it with POST /clinics first).
423	partner_inactive or tenant_suspended. Your partner account is deactivated or suspended, so no request will be served until it is reinstated.
429	bank_change_quota (where the clinic's bank accounts are kept as revisions, one change per clinic per 24 hours, with a message), or rate_limit_exceeded (the per-partner rate limit, with retryAfterSec and a Retry-After header).

Response fields (200)

oktruerequired

 

clinicIdintegerrequired

 

changedbooleanrequired

true when the bank account was replaced; false when the account you sent already matched what was on file (a no-op), or was ignored (see warnings).

warningsarray of objectrequired

NON-BLOCKING notices, always present ([] when there are none). For an account Axiom bills directly that is NOT partner-attested this holds banking_ignored_partner_billed: nothing was stored and changed is false. A partner-attested account's account is replaced as usual, whoever pays.

warnings[].codestringrequired

Stable machine code. Today only banking_ignored_partner_billed.

warnings[].fieldstringrequired

Dotted path of the field, e.g. clinic.banking.

warnings[].messagestringrequired

Human-readable explanation. Never contains a value you sent.

Request

PUT /api/inbound/acme-health/clinics/banking
Host: api.axiomscript.com
Content-Type: application/json
X-Axiom-Timestamp: 1767225600
X-Axiom-Signature: sha256=<hex>
Idempotency-Key: <your key>

{
  "clinic": {
    "external_id": "acme-clinic-001"
  },
  "banking": {
    "account_holder_name": "Example Wellness LLC",
    "account_type": "checking",
    "bank_name": "Example Bank",
    "routing_number": "110000000",
    "account_number": "000987654321"
  }
}

Response 200

{
  "ok": true,
  "clinicId": 43962,
  "changed": true,
  "warnings": []
}

Authorize a clinic's newest saved bank account for ACH

POST/api/inbound/{partnerSlug}/clinics/banking/authorize

Authorize the bank account you most recently saved for a clinic, so Axiom may debit it by ACH. Name the account by its routing and account numbers: they must match the clinic's newest saved account, or the request is refused with account_mismatch. A changed account must first be approved by Axiom, so an authorization sent before that is refused with approval_pending; send it again once approved. Accepted only for a partner-attested partner and a clinic of yours with its own partner-attested agreement (the same rules as replacing banking). Available only once Axiom has switched bank account history on for the clinic; until then the answer is 409 bank_revisions_off. Numbers are never returned. With a sandbox key nothing is saved: the request is checked, then answered 200 with sandbox: true and saved: false for a clinic enrolled with a sandbox key, or 404 clinic_not_found for any other. A sandbox key never changes a real clinic.

Parameters

partnerSlugstringpathrequired

The partner's Axiom-issued slug (e.g. acme-health).

Idempotency-Keystringheaderrequired

REQUIRED on every endpoint that creates or changes something (see the Idempotency section of the API description for the list). Omitting it is a 400 idempotency_key_required. Replaying the same key with the SAME body returns the original response. Reusing a key with a DIFFERENT body is a 409 idempotency_key_reused. Max 128 characters.

Request body

clinicobjectrequired

 

clinic.external_idstringrequired

1 to 128 characters.

accountobjectrequired

 

account.routing_numberstringrequired

Pattern ^\d{9}$.

account.account_numberstringrequired

Pattern ^\d{4,17}$.

authorizedtruerequired

The authorization itself. Must be sent explicitly as true.

Responses

Status	Meaning
200	The account is authorized
400	The request was malformed. validation_failed means the body or query failed schema validation (see issues). On a mutating endpoint you can also get idempotency_key_required (no Idempotency-Key header), idempotency_key_invalid (empty, or longer than 128 characters), or idempotency_key_mismatch (the header and the body's idempotency_key are different strings).
401	Missing, expired, or invalid HMAC signature / timestamp
403	production_not_enabled. You signed with a production key, but Axiom has not yet flipped the production gate on your partner account. Holding a production key is deliberately not enough to place live orders. Contact Axiom to enable it.
404	No clinic with that external_id exists for this partner.
409	bank_revisions_off, or bank_authorize_refused with a reason of account_mismatch, approval_pending, already_authorized, rejected or not_newest.
422	banking_requires_attestation or clinic_not_attested.
423	partner_inactive or tenant_suspended. Your partner account is deactivated or suspended, so no request will be served until it is reinstated.
429	Per-partner rate limit exceeded

Response fields (200)

oktruerequired

 

clinicIdintegerrequired

 

authorizedtruerequired

 

Request

POST /api/inbound/acme-health/clinics/banking/authorize
Host: api.axiomscript.com
Content-Type: application/json
X-Axiom-Timestamp: 1767225600
X-Axiom-Signature: sha256=<hex>
Idempotency-Key: <your key>

{
  "clinic": {
    "external_id": "acme-clinic-001"
  },
  "account": {
    "routing_number": "110000000",
    "account_number": "000987654321"
  },
  "authorized": true
}

Response 200

{
  "ok": true,
  "clinicId": 43962,
  "authorized": true
}