API Keys, Webhooks & Integrations
The API section of the Provider Portal lets your organization connect MediMic to your own systems. It is available on the Clinic plan and above.
Who Can Manage API Access
Only members with the Owner or Admin role can create or revoke API keys and webhooks. Members with the Billing or Member role can see the section but cannot change anything.
See Organizations & Teams for what each role can do.
API Keys
Creating a Key
- Sign in to portal.medimic.ai and open API.
- Type a label describing what the key is for (e.g. "Scheduling sync", "Reporting job").
- Click + Create key.
The full key is displayed once, immediately after creation:
Copy your key now — it won't be shown again.
This is deliberate. MediMic stores only a hash of the key plus a short non-secret prefix, so nobody — including MediMic staff — can recover the full value later. If you lose it, revoke the key and create a new one.
Reading the Key List
| Column | Meaning |
|---|---|
| Label | The description you gave it |
| Key | The non-secret prefix, enough to identify which key is which |
| Env | live or test |
| Created | When the key was issued |
Environments
Keys are marked live or test so you can tell production credentials from development ones at a glance. Give test keys obvious labels and keep them out of production configuration.
Revoking a Key
Click Revoke next to any key. Revocation is immediate and permanent — the key stops working at once and cannot be reinstated. Revoked keys drop off the active list but the record is retained for audit purposes.
Revoke a key whenever:
- Someone who had access to it leaves your organization
- It may have been committed to source control, pasted into a ticket, or shared over chat
- The integration using it has been retired
Keeping Keys Safe
An API key acts on behalf of your organization. Treat it like a credential that can reach PHI:
- Store it in a secrets manager or environment variable, never in source control
- Never put it in client-side code, a mobile app binary, or a browser
- Use separate keys per integration so you can revoke one without breaking the others
- Rotate keys periodically by creating the replacement first, cutting over, then revoking the old one
If a key is exposed, revoke it first and investigate second. Revocation takes one click and cannot be undone by an attacker.
Webhooks
Webhooks let MediMic notify your systems when something happens, instead of you polling for changes.
Adding a Webhook
- In the API section, find the Webhooks card.
- Enter the HTTPS URL of your endpoint (e.g.
https://your-endpoint.com/webhook). - Click + Add.
Each webhook shows its URL, the events it is subscribed to (All events by default), and its current status.
Requirements for Your Endpoint
- Must be HTTPS. Plain HTTP is not accepted.
- Should respond quickly with a
2xxstatus and do slow work asynchronously. - Must be idempotent — assume any delivery may arrive more than once.
Do not treat webhook payloads as a PHI transport. Use them as signals that something changed, then fetch what you need over an authenticated API call. Anything you receive and store lands inside your own compliance boundary and must be covered by your own safeguards.
EHR & Workflow Integrations
The Integrations card lists the connectors on the MediMic roadmap:
| Integration | Purpose | Status |
|---|---|---|
| Epic | EHR integration via SMART on FHIR | Not yet available |
| Cerner | EHR integration via FHIR R4 | Not yet available |
| Slack | Session notifications and alerts | Not yet available |
| Zapier | Automation workflows | Not yet available |
These connectors are not live yet. The Connect buttons are visible but disabled in the portal. They are shown so you can see what is planned — nothing is currently connected to your EHR.
If an EHR integration is on your critical path, contact [email protected] to discuss scope and timing before committing to a rollout date. Enterprise deployments are scoped individually.
In the meantime, API keys and webhooks are the supported route for building your own integration.