Attachments API

Use the Attachments API to retrieve approved patient file attachments for partner workflows.

Endpoint

POST /getAttachmentsAPI

Authentication and security

Send x-api-key with attachment access and only request files for authorized patient workflows.

Request example

curl -X POST "https://popularishealth.web.app/getAttachmentsAPI" \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-request-id: partner-attachment-fetch-20260307-001" \
  -d '{
    "patientId": "5tWgcsn11CLXNVNT2KME"
  }'

Success response

{
  "status": "success",
  "attachments": [
    {
      "id": "abc123",
      "fileName": "image1.jpg",
      "mimeType": "image/jpeg",
      "base64Content": "<long_base64_string>"
    }
  ],
  "requestId": "partner-attachment-fetch-20260307-001"
}

Response headers

• x-request-id is echoed so support can trace a specific submission.
• x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset describe the active key limit state.

Error handling

• 400: patientId is missing or invalid.
• 401: the API key is missing or invalid.
• 403: the key is blocked by scope or partner policy.
• 405: only POST requests are supported for this endpoint.
• 429: the rate limit was exceeded.

For file ingestion instead of retrieval, review the FHIR intake guide.