Deployment-aware catalog
The summary identifies the current environment and API origin, while counts distinguish deployed, executable, planned, and WebSocket operations. Newly registered HTTP routes appear automatically.
Super AdminAvailable
API Explorer
The internal catalog for every application API. Browse deployed HTTP routes, protocol-specific references, and planned contracts, then test eligible HTTP operations against the current environment with your signed-in Super Admin session.
What you can do here
Grouped navigation
Operations are grouped into functional categories and then by domain, so related interfaces sit together. Each category can be collapsed, and the counts show how many operations match the current search and filters.
Search and filters
Search across titles, descriptions, methods, paths, categories, domains, tags, authorization tiers, protocols, and lifecycle status, or combine the focused filters.
Full operation contract
Each operation documents the credentials it needs, its path, query, and header parameters with types and bounds, the request body schema, every response status with the operator-facing failure copy it can return, and its stable error codes.
OpenAPI specification download
Export the complete, current contract as an OpenAPI 3.1 document in JSON or YAML. The document is generated from the same catalog on screen. The API enforces the Super Admin requirement itself, so hiding the control is never the only protection.
Controlled request composer
Fill required path values, repeatable query values, an optional approved idempotency key, and a bounded JSON body. The environment, authorization, cookies, and tenant header cannot be edited.
In-memory response inspector
Eligible operations use a fresh session token. Text and JSON previews are capped, binary bodies are omitted, and request and response material is cleared when the operation or tenant changes.
Follow these steps
Discover or test an API
- Confirm the environment and fixed API origin in the deployment summary.
- Expand a category, then search or filter the catalog and select an operation with the keyboard or pointer.
- Read the operation contract (authentication, parameters, request body, responses, and error codes) before composing a request.
- For tenant-scoped operations, choose the exact tenant before entering synthetic parameters or JSON.
- Review write-operation confirmation carefully; DELETE also requires typing DELETE exactly.
- Inspect the status, content type, duration, and bounded response preview, then clear it when finished.
- Download the OpenAPI specification when you need the contract outside this screen, for a client generator or an API review.
Helpful habits
- Use synthetic test data only; never paste patient information, credentials, access tokens, or production secrets into a request.
- Treat a Super Admin session as platform authority, not patient or clinician authority. Endpoint-specific ownership, relationship, provider, feature, and clinical checks remain active.
- Verify the selected tenant and operation before every mutation. The Explorer never retries requests automatically.
- Use the public developer console only for approved API-key integrations; it is intentionally separate from this internal catalog.
- Treat a downloaded specification as internal material: it describes every workspace surface and is not the public developer API.
Tips
- Planned APIs, dedicated callbacks, WebSocket actions, and special-credential operations are catalog references and cannot be executed here.
- A 403 or workflow denial can be the correct result when the selected session lacks endpoint-specific authority.
- Responses exist only in memory and are removed when you change operation or tenant or leave the screen.
- The contract is generated from the deployed handlers, so a documented parameter, status, or error code reflects the code this environment is running.