Mediflo
REST APIPatients

Find a patient by phone number (deprecated)

An unknown number answers 200 with `found: false` — a new patient is the normal case, not an error, and a 404 here would be an existence oracle. Names are masked; patients are named by an opaque `patientRef`. **Deprecated:** the phone number (and the optional surname) travel in the query string, where proxy logs and error trackers keep them. Use POST /patients/lookup, which takes the same fields in a body and answers identically. This form keeps working. Required scope: `patients.read`.

Deprecated

GET/patients/lookup

Authorization

ApiKeyAuth
AuthorizationBearer <token>

An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.

In: header

Query Parameters

contactPhone*string
Match^\+[1-9]\d{6,14}$
lastName?string
Length1 <= length <= 80

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/patients/lookup?contactPhone=string"
{  "data": {    "found": true,    "patients": [      {        "patientRef": "string",        "maskedName": "string"      }    ],    "upcomingAppointments": [      {        "actionToken": "string",        "patientMaskedName": "string",        "start": "string",        "startIso": "string",        "spokenLabel": "string",        "specialist": "string",        "appointmentType": "string",        "durationMin": 0,        "price": "string",        "location": {          "name": "string",          "address": "string"        },        "instructions": "string",        "status": "string",        "contactId": "b5ec5d98-4bee-4da1-ad24-dde86346cb1d"      }    ]  }}

Create a location POST

`code` must be unique within the tenant. Required scope: `locations.write`.

Find a patient by phone number POST

Reads only — a POST because the phone number belongs in a body, not in a URL that logs keep. An unknown number answers 200 with `found: false` — a new patient is the normal case, not an error, and a 404 here would be an existence oracle. Names are masked; patients are named by an opaque `patientRef`. Required scope: `patients.read`.