# NeuroFlow

> NeuroFlow is a Philadelphia-based behavioral health technology company that gives payers, health systems, provider groups and federal agencies the infrastructure to identify and manage behavioral health risk at scale. Its IntegrateBH platform pairs patient-facing mobile and web applications with measurement-based care and screening workflows, clinical dashboards, care-coordination tooling and population-level behavioral health analytics.

<!--
generated: '2026-08-04'
method: generated
source: apis.yml + artifacts in this repository (API Evangelist enrichment pipeline)
note: NeuroFlow does not publish an llms.txt. This file is authored by API
      Evangelist as an independent third-party profile and is NOT served from
      any NeuroFlow host.
-->

## What is callable

NeuroFlow's platform API is real but **customer-only**. The NeuroFlow Live web and
mobile applications call a same-origin REST API at `https://neuroflowlive.com/api/`
(versioned `/api/v2/` routes, served by gunicorn). The service publishes a Swagger
document at `/api/swagger.json`, but anonymous requests to it return:

```
HTTP/2 401
content-type: application/json

{"message": "Please log in to continue", "code": 0}
```

The same route and the same 401 were observed on the sandbox, QA, staging and dev
environments. There is no public developer portal, no anonymous OpenAPI/Swagger,
no GraphQL endpoint, no MCP server, and no A2A agent card on any NeuroFlow host.

- [NeuroFlow Live API base](https://neuroflowlive.com/api/): session-authenticated REST API behind the NeuroFlow Live applications. Contract gated (401).
- [Swagger document (gated)](https://neuroflowlive.com/api/swagger.json): exists, returns 401 to anonymous callers.

## Integration surface

NeuroFlow reaches customers through EHR and partner platforms rather than through a
self-serve developer program.

- Epic — listed in the Epic App Orchard / Epic Showroom marketplace since 2020.
- Xealth — backend integration; tracked as its own component on the NeuroFlow status page.
- The NeuroFlow Live `Content-Security-Policy` permits framing by `appmarket.epic.com`,
  `vendorservices.epic.com`, `*.xealth.io` and `*.mynovant.org`, confirming an
  EHR-embedded deployment model.

## Operations

- [Status page](https://status.neuroflowlive.com/): Atlassian Statuspage. Components: Web App, Mobile Apps, API, Integrations, Xealth. Machine-readable at `/api/v2/summary.json` and `/api/v2/incidents.json`.
- [Status page (alias)](https://status.neuroflow.com/): same page.
- No public changelog, deprecation policy, sunset-header policy, SLA or rate-limit documentation was found.

## Security and compliance

- HITRUST Implemented (i1) Certification, announced September 2022, covering NeuroFlow Engage and NeuroFlow Manage.
- SOC 2 examination by A-LIGN, re-assessed annually; the report is released to customers and prospects under NDA only.
- HIPAA: a Business Associate Agreement is published as a public PDF.
- [Subprocessor list](https://www.neuroflow.com/subprocessors/)
- No `/.well-known/security.txt`, no published vulnerability-disclosure policy, and no bug-bounty program were found.
- Domain security (probed 2026-08-04): TLS 1.3 on both hosts; HSTS present on `neuroflowlive.com` (max-age 31536000) and absent on `www.neuroflow.com`; DMARC `p=reject` on both registrable domains; SPF present on `neuroflow.com` only; no DNSSEC and no CAA records on either domain.

## Company

- [Website](https://www.neuroflow.com/)
- [IntegrateBH](https://www.neuroflow.com/integratebh/)
- [Blog](https://www.neuroflow.com/blog/)
- [Help center](https://neuroflow.zendesk.com/hc/en-us)
- [Sign in](https://neuroflowlive.com/login)
- [Privacy policy](https://www.neuroflow.com/privacy-policy/)
- [Terms of use](https://www.neuroflow.com/terms-of-use/)

## Notes for agents

- `www.neuroflow.com` is fronted by a SiteGround bot-challenge that answers HTTP 202
  with a `/.well-known/sgcaptcha/` redirect for every path, including `/robots.txt`
  and `/sitemap.xml`. Marketing and legal pages are indexed by search engines but are
  not directly fetchable by a plain HTTP client.
- `api.neuroflow.com`, `developer.neuroflow.com`, `docs.neuroflow.com`,
  `app.neuroflow.com` and `trust.neuroflow.com` are wildcard DNS entries that serve
  the same challenge under a certificate valid only for `neuroflow.com` /
  `www.neuroflow.com`. None of them is a developer surface.
- `api.neuroflowlive.com` resolves to CloudFront but fails the TLS handshake — a
  dangling record, not an API host.
- On `neuroflowlive.com`, every unrecognised path returns HTTP 200 with a 1,579-byte
  single-page-app HTML shell. Do not treat a 200 from that host as evidence a
  document exists; check `content-type`.