Referral Tier
Send patients to Stealth-hosted enrollment, receive lifecycle webhooks for every state transition.
- referral.* + transaction.* + fulfillment.*
- Tracking-link IDs, no patient identifiers
- 30-day signed-event replay
Stealth Health Partner Platform
Build clinical experiences on top of Stealth Health.
Three integration tiers, HIPAA-compliant from day one. Refer patients and receive lifecycle webhooks, take full clinical PHI access under a BAA, or hand off your intake to our prescriber network — all on the same API surface.
- HIPAA · BAA-ready
- HMAC-SHA256 signed webhooks
- Audit-logged PHI reads
- Sandbox + production parity
Pick your integration tier
The tier you choose dictates which webhooks you receive and what data you can read. Not sure? See the decision tree →
Clinical Tier
Read patient profiles, intake, appointments, prescriptions, lab orders, and messages — or submit Rx written by your own prescribers.
- Lab orders + requisition PDFs + biomarker results
- messageThread.* push + read API
- Partner-submitted prescriptions
Prescriber-Partner
You own the patient UI and intake. Stealth Health physicians review the case, sign the prescription, and we handle fulfillment.
- POST your appointments and intake responses
- appointment.prescription_signed webhook
- Turnkey 50-state prescriber network
Building blocks
Composable surfaces that pair with any integration tier.
Questionnaire Embed
Drop-in iframe (Vanilla JS or React/npm) that renders any of our 18 intake questionnaires inside your domain. Submissions return an opaque responseId — your stack never touches PHI.
Partner SSO
OIDC-style RS256 JWT handoff into the Stealth patient or prescriber portal. Identity-only for patients; identity plus license metadata for clinicians. JWKS verified.
Lab Orders & Requisitions
List, retrieve, download requisition PDFs, and pull structured biomarker results. Clinical-tier, BAA-addendum gated, audit-logged on every read.
Messaging
Read clinician ⇄ patient threads scoped to your referrals; receive messageThread.updated webhooks on every reply. Posting stays inside our portal — chart integrity by design.
Signed Webhooks
HMAC-SHA256 over the raw body, X-Stealth-Signature: sha256=<hex>. Six retries with exponential backoff, 30-day signed replay log, dedupe on the event_id field.
Replay & Reconciliation
GET /partner/events with filters on event_type, referral_id, partner_reference, delivery_status, and time range. Use it to backfill anything your receiver missed.
Two snippets, end to end
Send your first referral, then verify the webhook you'll receive minutes later. The full reference lives in the Referral guide.
POST
/partner/referrals# Create a tracked referral from your partner system.
curl -X POST https://sandbox.stealth.health/partner/referrals \
-H "X-Partner-ID: ptr_yourpartner" \
-H "X-Api-Key: sk_test_..." \
-H "Content-Type: application/json" \
-d '{
"partner_reference": "PTR-12345",
"product_category": "weight-loss",
"patient_hint": { "email": "patient@example.com" }
}'verify-signature.ts
// Verify every inbound webhook before processing.
import crypto from 'node:crypto';
export function verify(rawBody: Buffer, header: string, secret: string) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
const got = header.replace(/^sha256=/, '');
// Constant-time compare guards against timing oracles.
return crypto.timingSafeEqual(
Buffer.from(expected, 'hex'),
Buffer.from(got, 'hex'),
);
}What's new
Lab orders API now live
Clinical-tier partners with a signed lab-orders BAA addendum can now list orders, fetch detail, stream requisition PDFs inline, and pull structured biomarker results. Seven new lab_order.* webhook events ship from the same lab lifecycle that powers our in-house clinicians. Every read writes an explicit audit row — no PHI ever lands in metadata.
Got a question?
We read every email — most replies land within one business day.