Developer API

Integrate Aegis directly.

Everything in the platform is available over a REST API: request a patient study, fulfill it, and receive it under the same encryption, metering, audit, and time-boxed controls. Request access below, then read the docs.

Apply for API access Read the docs

Documentation

REST API reference

Issued per organization after verification. Keys are scoped to your role and partner relationships, and every call is recorded in the tamper-evident audit trail.

Authentication

# exchange your issued serial for an API key
curl -X POST https://www.aegisbiocryption.com/api/activate \
  -H "Content-Type: application/json" \
  -d '{ "serial": "XXXX-XXXX-XXXX-XXXX" }'
# -> { "ok": true, "apiKey": "ak_live_xxxx", "role": "consumer" }

Then send Authorization: Bearer ak_live_xxxx on every call. Keys activate once your BAA is signed.

Base URL

https://www.aegisbiocryption.com/api

Audit trail

Every authorization, access, delivery, and destruction is written to a hash-chained, Bitcoin-anchored log. Fetch it with GET /state (returns auditChain, auditRoot, and recent events).

Endpoints

Method	Path	Role
POST	/consumer/request	Consumer
GET	/consumer/requests	Consumer
GET	/consumer/inbox	Consumer
POST	/consumer/open	Consumer
GET	/provider/requests	Provider
POST	/provider/fulfill	Provider
GET	/state	Both

Example: request and receive a study

# consumer requests a specific patient
curl -X POST https://www.aegisbiocryption.com/api/consumer/request \
  -H "Authorization: Bearer $AEGIS_API_KEY" -H "Content-Type: application/json" \
  -d '{ "providerId":"prov-a", "lastName":"Doe", "firstName":"Jane", "dob":"1971-03-05", "reason":"AI review" }'

# once the provider fulfills, open it -> short-lived, scoped URL + masked display metadata
curl -X POST https://www.aegisbiocryption.com/api/consumer/open \
  -H "Authorization: Bearer $AEGIS_API_KEY" -H "Content-Type: application/json" \
  -d '{ "sasId":"<transfer-id>" }'

Apply for API access

Keys are issued after verification (verified organization, signed BAA, approved partner relationship). Not self-serve.

What to expect

A short path to a secure exchange.

Intro call to confirm scope and compliance requirements
BAA / DPA and a controls summary for your security review
Sandbox exchange with synthetic data, no PHI
Production connection inside your own cloud or on-prem boundary

HIPAA-aligned by architecture. Endpoint-encrypted, BAA-backed, audit-ready.