Documentation

Getting started

The base URL for your tenant is provisioned at signup (self-hosted deployments use your own domain). Every request is JSON-in / JSON-out with bearer authentication. Start with capability discovery, which never requires credentials:

curl https://api.biomedora.com/health
curl -X POST https://api.biomedora.com/v1/documents \
  -H "Authorization: Bearer $BIOMEDORA_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"content": "...", "patient_id": "patient_123", "source_format": "text"}'

Document creation runs billing + quota gates, optional fail-closed de-identification, NLP compilation, graph materialization, and indexing — returning the document plus a job handle you can poll via /v1/jobs.

Authentication

• Bearer tokens — issued by your identity provider in production; dev/demo tenants can mint short-lived tokens via POST /auth/token?user_id=&tenant_id=&role=.
• API keys — machine-to-machine access as service principals via the X-API-Key header. Secrets are displayed exactly once at creation; only a SHA-256 hash persists; revocation is instant.
• Tenancy is derived server-side from credentials — clients cannot assert another tenant's ID. Cross-tenant access is denied and audited.

Conventions

Errors & rate limits

{
  "error": {
    "code": "MODEL_NOT_ENTITLED",
    "message": "Model 'gpt-4o-mini' is not entitled for this plan.",
    "category": "entitlement",
    "request_id": "req_01J8...",
    "details": {"allowed_models": ["qwen2.5-vl-7b"]},
    "retryable": false
  }
}

API reference

Generated at build time from openapi/openapi.json — the same contract the platform serves and the Python SDKs are built against. Click any operation to inspect parameters, request schemas, and responses.