generated: '2026-08-14'
method: searched
source: >-
  https://docs.redoxengine.com/ ; https://api.redoxengine.com/.well-known/oauth-authorization-server ;
  https://docs.redoxengine.com/api-reference/quotas-and-constraints/ ;
  https://docs.redoxengine.com/api-reference/error-handling-and-responses/ ;
  HL7 FHIR R4 conventions for the Redox FHIR API
notes: >-
  Cross-cutting semantics for the Redox APIs. Combines the published OAuth authorization server
  metadata, the FHIR R4 basis of the modern API, and the quotas/error-handling reference docs;
  not every field below is individually re-documented by Redox.
authentication:
  style: "OAuth2 bearer access token (Authorization: Bearer); Platform API also supports
    user-level API keys and, historically, legacy source-level API keys"
  token_endpoint: https://api.redoxengine.com/platform/v1/oauth/token
  ref: authentication/redox-authentication.yml
idempotency:
  supported: false
  header: null
  notes: >-
    No idempotency-key header, parameter, or documented idempotent-retry contract was found
    across the docs pages fetched (auth/send, error-handling, Platform API reference, quotas).
    This is an honest absence, not an unchecked field — no `type: Idempotency` common[] pointer
    is emitted.
pagination:
  style: FHIR Bundle link relations (self/next/previous) on search responses
  applies_to: Redox FHIR API
metadata: null
request_tracing:
  header: Redox-Trace-Id (observed on live api.redoxengine.com responses, e.g. the /mcp 401 challenge)
  notes: Not documented on a public page as of this pass; recorded from a live response header only.
error_envelope:
  fhir: FHIR OperationOutcome resource on the FHIR API
  http_reference: errors/redox-problem-types.yml
versioning:
  style: parallel product lines (modern FHIR API and legacy Data Model API); no deprecation policy published
  ref: lifecycle/redox-lifecycle.yml
rate_limits:
  documented: true
  ref: rate-limits/redox-rate-limits.yml
  summary: 10,000 requests / 5-minute rolling window per IP; 5 requests / 5 minutes for DevTools; 429 on exhaustion.
webhooks:
  supported: true
  ref: asyncapi/redox-webhooks.yml
  summary: Signed/authenticated push notifications to a configured destination endpoint; 32 published FHIR
    notification event types plus the legacy Data Model event set.
security:
  transport: TLS 1.3, HSTS enabled on api.redoxengine.com
  ref: security/redox-domain-security.yml