openapi: 3.0.3
info:
  title: Tebra Data Clinical Documents API
  description: 'Read-only REST access to a patient''s clinical health information held in the Tebra (formerly Kareo + PatientPop) platform. This is Tebra''s ONC / 21st Century Cures Act "patient access" API surface (published under tebra.com/macra), exposing USCDI-aligned clinical resources for a single authenticated patient. Every request is authenticated with an API Key passed in the `X-Api-Key` header; the key is generated by the patient from the Tebra Patient Portal under My Account > API Access Key. Connections must use HTTPS (TLS) and callers are asked to limit connection frequency to what their use case requires.

    The resource paths and the X-Api-Key authentication in this document are confirmed from Tebra''s official "General API Documentation" (Oct 2023). The request query parameters and response schemas below are MODELED to reflect typical USCDI / FHIR-flavored patient-access payloads and should be verified against the current Tebra API documentation before production use.'
  version: '1.0'
  contact:
    name: Tebra
    url: https://www.tebra.com/macra
  license:
    name: Proprietary (Tebra API Terms of Use)
    url: https://www.tebra.com
servers:
- url: https://api.tebra.com/clinical/v1/api
  description: Tebra Clinical Data API (production)
security:
- apiKeyAuth: []
tags:
- name: Documents
  description: Binary clinical summary documents (e.g. C-CDA).
paths:
  /patient/binary/summary:
    get:
      tags:
      - Documents
      summary: Get clinical summary document
      description: Retrieves the patient's clinical summary as a binary document (e.g. a C-CDA). Confirmed endpoint; response modeled.
      operationId: getBinarySummary
      responses:
        '200':
          description: Binary clinical summary document.
          content:
            application/xml:
              schema:
                type: string
                format: binary
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    Error:
      type: object
      properties:
        status:
          type: integer
          example: 401
        message:
          type: string
          example: Unauthorized
  responses:
    Unauthorized:
      description: The API Key is missing, revoked, or otherwise not valid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Patient-generated API Key from the Tebra Patient Portal (My Account > API Access Key). A missing, revoked, or invalid key returns 401 Unauthorized.