Developers

Getting started

From zero to your first authenticated call. Every example uses a placeholder key read from an environment variable — no real secret appears in this documentation.

1. Create an application

Sign in and open the Public API workspace. Create a sandbox application first: it activates immediately, works only with synthetic data you create through the API, and can never read production clinical records. Production applications are created in review and issue credentials once authorised.

2. Issue a scoped key

Least privilege: Grant only the scopes the integration uses. A key can narrow the application's scopes but never widen them.
Shown once: The secret appears exactly once at creation. Only a SHA-256 hash is stored, so it cannot be recovered — rotate instead.
Prefixes: Sandbox keys start with smd_sk_test_, production keys with smd_sk_live_.
Expiry: Optionally set an expiry in days. Expired keys are rejected with 401.

3. Make your first request

curl

# Unauthenticated liveness probe
curl https://gelypticmd.com/api/public/v1/health

# Authenticated read. Never put a real key in client-side code.
curl "https://gelypticmd.com/api/public/v1/clinical/encounters?limit=25&offset=0" \
  -H "Authorization: Bearer $GELYPTIC_API_KEY"

JavaScript (Node 18+)

const res = await fetch("https://gelypticmd.com/api/public/v1/clinical/encounters?limit=25", {
  headers: { Authorization: `Bearer ${process.env.GELYPTIC_API_KEY}` },
});

if (!res.ok) {
  const { error } = await res.json();
  throw new Error(`${error.code}: ${error.message} (request ${error.request_id})`);
}

const { data, pagination } = await res.json();

Python

import os, requests

res = requests.get(
    "https://gelypticmd.com/api/public/v1/clinical/encounters",
    params={"limit": 25, "offset": 0},
    headers={"Authorization": f"Bearer {os.environ['GELYPTIC_API_KEY']}"},
    timeout=30,
)
res.raise_for_status()
payload = res.json()
print(payload["data"], payload["pagination"])

4. Submit audio for transcription

curl — multipart upload

curl -X POST https://gelypticmd.com/api/public/v1/transcription \
  -H "Authorization: Bearer $GELYPTIC_API_KEY" \
  -F "encounter_id=00000000-0000-0000-0000-000000000000" \
  -F "audio=@consultation.webm"

Returns 202 with a job id. Transcription and SOAP drafting run asynchronously; subscribe to webhooks rather than polling. Drafts are always returned as drafts — clinician review is not bypassable.

One-call SOAP intake

Prefer a single call? POST /v1/soap accepts a finished transcript or the consultation audio, files the encounter and queues the whole pipeline — the structured SOAP note, ICD-10 candidates matched from the curated code table, WHO/IMCI-aligned triage and NHIS billing items arrive on your webhook.

Full /v1/soap documentation

Reference SDKs

Downloadable, framework-independent clients for trusted server environments.

TypeScript / Node 18+

import { GelypticMD } from "./gelyptic-md";

const client = new GelypticMD({
  apiKey: process.env.GELYPTIC_API_KEY ?? "",
});
const { data, pagination } = await client.listEncounters({ limit: 25 });

Download TypeScript source

Python 3.10+

import os
from gelyptic_md import GelypticMD

client = GelypticMD(os.environ["GELYPTIC_API_KEY"])
result = client.list_encounters(limit=25)

Download Python source

The Python CSV helper accepts approved aggregate rows only. It does not activate planned research or global-health data endpoints.

Pagination

limit: 1–100, default 25. Values outside the range are rejected with INVALID_REQUEST.
offset: Zero or greater, default 0.
Response: Collections return { data, pagination } where pagination carries limit, offset, count, total and has_more.

Errors and request ids

Error envelope

{
  "error": {
    "code": "INVALID_SCOPE",
    "message": "This credential does not carry the required scope.",
    "request_id": "req_9f2c4b1e8a7d4c2fb0a1d3e5f6071829"
  }
}

X-Request-ID: Every response carries a request id, repeated inside error bodies. Quote it in support requests.
No internals: Errors never contain stack traces, database messages or internal identifiers.
401 vs 403: 401 means the credential is missing, invalid, revoked or expired. 403 means it is valid but lacks the scope.
501: A documented but planned endpoint. The response body includes status: planned.
429: Rate limited. Honour Retry-After with exponential backoff.

Data boundaries

Your records only: Clinical endpoints return records the calling application created. There is no cross-tenant read path.
Global health is aggregate: Global health and early warning endpoints expose de-identified, aggregated signals — never names, contacts, addresses, record numbers or raw notes.
No compliance claim: These are the security controls we implement. They are not, by themselves, a regulatory compliance certification.

About GELYPTIC MD

GELYPTIC MD is the Clinical Intelligence Layer for healthcare. We provide clinical intelligence infrastructure via a single offline-first API that powers any EMR, telemedicine, or pharmacy platform.

With one API call, developers can generate structured SOAP notes, clinical summaries and referral letters, extract evidence-linked ICD-10 and SNOMED codes, surface WHO and IMCI-aligned triage and danger signs, and produce claim-ready NHIS and insurance billing — in 30 seconds, in English, Yoruba, Hausa, Swahili and Pidgin, with or without internet.

Unlike English-only, online-only scribes, GELYPTIC MD was built for real-world care: multilingual consultations, low-connectivity clinics, and community health workflows. Our on-device engine includes cultural translation, syndromic early warning, and CHW playbooks that run fully offline and sync when connection returns.

The platform

Public API v1: Versioned endpoints for clinical reasoning
Scoped API Keys: Least-privilege, revocable credentials
Signed Webhooks: HMAC-signed event delivery
Offline-First Engine: Encrypted on-device capture

GELYPTIC MD powers the GELYPTIC MD clinical app and any third-party health app through the same intelligence layer. Built as infrastructure, used as intelligence.