Documentation / API reference
REST API reference
This is the detailed reference beneath the API overview page: exactly how bearer-token authentication works, the request and response shape for patients and appointments, and every error code an endpoint can return.
Which plan this needs
The REST API and the MCP server are included on the Complete plan and are not available on Essential — integrations are a larger-practice need and a real support burden, so they sit on the plan that pays for them. The pricing page lists every band. OAuth clients are created from practice settings once you are on Complete.
How to use this reference
All endpoints are rooted at /api/v1 and require Authorization: Bearer <token>. Successful responses share one envelope with a data field and a requestId; errors share the mirror shape with a code, a display message, and optional details. The four pages below cover, in order: how the bearer token itself works, the patients resource, the appointments resource, and the full error code table.
What this reference does not cover
Billing, forms, files, tags, search, reporting, and staff/invitations are all part of the API — the API overview names them — and per-field pages for them are still to come. Every one of them is already in the machine-readable OpenAPI document at /api/v1/openapi.json, which covers the whole API rather than just the four resources written up here. There is no official client SDK yet.
Reference pages
Authentication
Bearer tokens, Firebase ID tokens vs. OAuth access tokens, and every auth-specific error code.
Patients
The patient and patient-note object shapes, every endpoint, and its request and response fields.
Appointments
The appointment object, overlap/double-booking rules, and the availability endpoint.
Errors
The full error code table, the success and error envelope shapes, and request-id correlation.
Common questions
HyperCRM is paid software. Every practice starts with a 30-day free trial of the full Complete plan, with no card required. After that, plans start at €19 and €29 a month excluding VAT, banded by how many practitioners you have. Every price is printed on the pricing page rather than quoted on a call.
Patient records are encrypted in transit and at rest, files are stored privately and served through short-lived signed links, and every change is written to an audit log. Staff accounts sign in with passkeys rather than shared passwords.
The overview page at /developers/api is a readable summary meant to be read once. This hub and its four detail pages are reference material: exact field names, required and optional parameters, status codes and error codes, for looking one thing up while you are writing against it.
Yes — an OpenAPI 3.1 document is served at `/api/v1/openapi.json`, and it covers the whole API, not just the resources written up on these pages. It is generated from the same validation schemas the server enforces, so request shapes in the spec are the request shapes the server actually accepts, and a test fails our build if the two drift apart. Point any OpenAPI client generator at it.