Developer Portal
The developer platform is in preview and not generally available — the portal below is switched off by default while we finish it. Building something for Australian healthcare practices? Register your interest and we'll be in touch.
The Praxi Developer Portal provides tools for managing API keys, configuring webhooks, and building custom integrations. Once you've registered as a developer (see below), a Developer tab appears in the Marketplace navigation.
Requires an Enterprise plan subscription. API keys inherit the permissions of the user who creates them.
API Key Management
- Click Create API Key and enter a descriptive name.
- Choose the environment (test or live) and select the permission scopes the key should access.
- Generate the key. It is displayed once -- copy it immediately.
Keys don't expire by default; revoke a key when it's no longer needed.
Available Scopes
| Scope | Access |
|---|---|
clients:read | Read client records |
clients:write | Create and update client records |
appointments:read | Read appointment data |
appointments:write | Create and manage appointments |
invoices:read | Read invoices and payment data |
invoices:write | Create and update invoices |
billing:read | Read billing and revenue data |
notes:read | Read clinical notes (requires client consent) |
notes:write | Create and modify clinical notes (requires client consent) |
practitioners:read | Read practitioner profiles |
reports:read | Read reports |
files:read | Read uploaded files (requires client consent) |
export:bulk | Bulk data export in FHIR format (requires client consent) |
webhooks:manage | Manage webhook subscriptions |
ai:invoke | Access AI-powered features |
Scopes marked "requires client consent" access Protected Health Information (PHI). The client must have an active data-sharing consent record before data is returned through these scopes.
To revoke a key, find it in the API Keys list and click Revoke. The key stops working immediately.
Webhook Configuration
- Navigate to the Webhooks tab and click Add Webhook.
- Enter the endpoint URL and select the events to subscribe to.
- Store the generated signing secret securely -- use it to verify payloads via
the
X-Praxi-SignatureHMAC-SHA256 header.
Available Events
| Category | Events |
|---|---|
| Clients | client.created, client.updated, client.archived, client.erased |
| Appointments | appointment.created, appointment.updated, appointment.completed, appointment.cancelled, appointment.no_show |
| Invoices | invoice.created, invoice.sent, invoice.paid, invoice.voided |
| Notes | note.created, note.signed |
| Forms | form.submitted |
| Referrals | referral.created, referral.accepted, referral.completed |
| Tasks | task.created, task.completed |
| Practitioners | practitioner.created, practitioner.updated |
client.erased fires when a client exercises their right to erasure. The
payload contains only the client ID — your app must cascade-delete any data it
holds for that client.
Failed deliveries are retried automatically with exponential backoff (starting at about one second). After retries are exhausted, the event is logged as undeliverable.
Developer Registration
Before creating API keys or publishing apps, you need a developer account:
- Open the Developer Portal at
app.praxi.au/dev-portal— you'll see the Become a Praxi Developer screen - Click Register as Developer
- Choose your developer type:
- Practice -- for internal integrations (auto-approved)
- Marketplace -- for apps published to other practices (requires ABN and manual review)
- Partner -- for strategic integration partners (requires ABN and manual review)
- Enter your details and click Register
Practice developers can begin creating API keys immediately. Marketplace and Partner developers are reviewed by the Praxi team before approval. Once registered, the Developer tab appears in your Marketplace navigation.
OAuth 2.0 for Apps
If you are building an app that other practices will install, the Developer Portal supports full OAuth 2.0 authorisation:
- Register your app in the Developer Portal
- Configure redirect URIs and requested scopes
- When a practice installs your app, they see a consent screen showing exactly what data your app will access
- The practice owner approves or denies access
- Your app receives an authorisation code, which it exchanges for access and refresh tokens
Supported grant types:
| Grant Type | Use Case |
|---|---|
| Authorisation Code | User-facing apps (recommended) |
| Client Credentials | Server-to-server (no user context) |
| Refresh Token | Renew expired access tokens |
Access tokens expire after 1 hour. Refresh tokens are valid for 30 days.
SDK Modules
Apps installed on a practice gain access to Praxi's SDK endpoints for secure data access. The SDK covers:
| Module | Capabilities |
|---|---|
| Clients | Read and manage client records (PHI-filtered) |
| Tasks | Create and manage tasks with app tracking |
| Files | Upload and download files via secure storage |
| Workflows | Trigger workflows and register custom actions |
| Consent | Check and manage client data-sharing consent |
All SDK calls are tenant-isolated, scope-gated, and audit-logged.
AI App Builder
The Developer Portal includes an AI-powered app builder that helps you create integrations through a conversational interface:
- Go to Marketplace > Developer > AI Builder
- Describe what your app should do in plain language
- The AI generates app scaffolding, including compliance checks and testing
- Review the generated code and approve each step
- Your app is created and ready for testing
The AI Builder handles security, PHI protection, and consent requirements automatically, ensuring your app meets Praxi's compliance standards.
Usage Metrics
The portal displays API call counts per key, rate limit status (60 requests per minute by default, configurable up to 1,000), and webhook delivery success rates.
Next Steps
- App Marketplace -- Explore pre-built integrations.
- Integrations Overview -- See all available platform integrations.