Mediflo
REST APIPatients

Find a patient by phone number

Reads only — a POST because the phone number belongs in a body, not in a URL that logs keep. An unknown number answers 200 with `found: false` — a new patient is the normal case, not an error, and a 404 here would be an existence oracle. Names are masked; patients are named by an opaque `patientRef`. Required scope: `patients.read`.

POST/patients/lookup

Authorization

ApiKeyAuth
AuthorizationBearer <token>

An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/patients/lookup" \  -H "Content-Type: application/json" \  -d '{    "contactPhone": "string"  }'
{  "data": {    "found": true,    "patients": [      {        "patientRef": "string",        "maskedName": "string"      }    ],    "upcomingAppointments": [      {        "actionToken": "string",        "patientMaskedName": "string",        "start": "string",        "startIso": "string",        "spokenLabel": "string",        "specialist": "string",        "appointmentType": "string",        "durationMin": 0,        "price": "string",        "location": {          "name": "string",          "address": "string"        },        "instructions": "string",        "status": "string",        "contactId": "b5ec5d98-4bee-4da1-ad24-dde86346cb1d"      }    ]  }}

Find a patient by phone number (deprecated) GET

An unknown number answers 200 with `found: false` — a new patient is the normal case, not an error, and a 404 here would be an existence oracle. Names are masked; patients are named by an opaque `patientRef`. **Deprecated:** the phone number (and the optional surname) travel in the query string, where proxy logs and error trackers keep them. Use POST /patients/lookup, which takes the same fields in a body and answers identically. This form keeps working. Required scope: `patients.read`.

List phone numbers GET

Read-only. Numbers and trunks are provisioned by Mediflo; this API binds an existing number to a bot. Required scope: `phone-numbers.read`.