The same API the app calls
HyperCRM's REST API is a JSON-only interface, scoped to your practice and authenticated with a bearer token. It is the same layer the web app uses internally, not a stripped-down copy, covering patients, scheduling, billing, forms, files, tags, search and reporting.
Resource families
Patients & notes
Create, update and search patient records, with tag toggling and revision-tracked clinical notes.
Scheduling
Appointments, chair-blocking entries, and a derived availability endpoint for a chair on a given day.
Billing
A service catalogue, per-patient charges/credits/receipts, and a computed invoice view with tax.
Forms & files
A dynamic form builder with shareable public links, and private file storage served via signed URLs.
Which plan this needs
The REST API and the MCP server are included on the Complete plan and are not available on Essential. The pricing page lists every band. An OAuth client is not created in settings: it registers itself the first time it connects, and an owner on Complete approves it. Settings is where you see what is connected and disconnect it.
Authentication
Every endpoint requires Authorization: Bearer <token>. For REST that token is a Firebase ID token from a signed-in HyperCRM session, and there is no separate signup step: your user, practice and membership are found or created on first successful verification. An OAuth access token works on the MCP endpoint only — a REST call carrying one is rejected with 401.
So be clear about what REST is for today: a script or a tool run by someone who is signed in. A session token lasts an hour, and a practice that requires two-step sign-in will refuse bearer-only calls with mfa_required, so an unattended integration that runs on its own schedule cannot be built on REST yet. For an AI app that acts on its own, use the MCP server, where OAuth is the point.
What's there
Patients and patient notes, tags, appointments and chair availability, courses of appointments booked in one request with a preview of the dates they would get, booking requests from your website and the answers to them, the service catalogue and per-patient billing with a computed invoice view, a form builder with public shareable links, private file storage served through short-lived signed URLs, search across your own practice, over patients and appointments, dashboard KPIs and owner-only reports, and staff/invitation management. A patient also carries the consent to use their files for teaching or promotion. Every practice also carries a packId (generic or dental today), and pack-specific values like patient status options come back from a bootstrap endpoint rather than being hardcoded in the API.
Requests and responses
Successful responses share one envelope: a data field holding the resource, and a requestId you can use for support correlation. Errors share the mirror shape — a stable code, a safe display message, and optional details for field-level validation issues. List endpoints such as patients accept limit and offset; out-of-range values are clamped rather than rejected, and the response echoes back the values actually used.
What to expect from it
The API is the one the product itself calls, so it moves with the product rather than lagging behind it. There is no official client SDK and no webhook system. Rate limits are published: every operation in the OpenAPI document states the policy that governs it. The full reference — every endpoint, its fields, and the errors it returns — is at API reference.
Common questions
HyperCRM is paid software. Every practice starts with a 30-day free trial of the Complete plan, with no card needed. After that, Essential starts at €19 a month and Complete at €34, VAT included. The price depends on how many practitioners you have. Every price is on the pricing page, so you never need a sales call.
Patient records are encrypted, both where they are stored and on their way to your screen. Files are private, and a link to one stops working after a short time. Changes to patient records are recorded, with who made them and when. There is no shared practice password: everyone has their own account. On the Complete plan, the practice owner can also require two-step sign-in for the whole team.
Every call sends Authorization: Bearer <token>, normally a Firebase ID token from a signed-in session, verified server-side on each request. There is no separate API-key step: your practice and membership are resolved from that same token, and access is always scoped to your own practice's data.
Yes. Every endpoint is rate limited, and each operation in the OpenAPI document at /api/v1/openapi.json states the limit that applies to it. Every response also carries your remaining budget in the RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, so a client can back off before it is throttled rather than after. A throttled request returns 429 with rate_limit_exceeded and a Retry-After header.
Build against the same data the app uses
A bearer token against your own practice's data, on the trial. No card to start.
Start the free trial