# Waystar > Waystar is a US healthcare payments and revenue cycle management (RCM) company operating a national > clearinghouse between providers and payers. Its platform spans financial clearance (eligibility, > prior authorization, patient estimation), claim management, payment and remittance management, and > denial prevention and recovery. Waystar publishes NO OpenAPI, no llms.txt of its own, no MCP server > and no A2A agent card. This file was generated by API Evangelist from the public Waystar surface and > from the artifacts in this repository; it is not published by Waystar. ## What an agent needs to know first - **There is no machine-readable contract.** `/openapi.json`, `/openapi.yaml`, `/swagger.json`, `/api-docs` and `/llms.txt` all return 404 on `developer.waystar.com`, `www.waystar.com` and on every documented API host. Specifications exist only as PDF companion guides behind the developer portal login. - **The developer portal document bodies require a login.** `developer.waystar.com` renders its full navigation publicly but serves a login form in place of every document body. - **Access is contractual.** API credentials are issued to Waystar clients and to signed technology partners. There is no self-service signup, no published pricing, and no self-service sandbox: a test account is requested by email from `waystartechnicalintegrationteam@waystar.com`. - **This is not one API.** Waystar runs several product APIs built in different eras on different styles - form-POST with an HMAC body signature, CAQH CORE SOAP, and a newer JSON/REST layer - all of them wrapping X12 EDI transactions. Conventions differ per surface. - **The payload standard is X12, not JSON.** Real error semantics live in the X12 code sets (277 STC status/category codes, 835 CARC/RARC, 271 EB codes, 278 review response codes), not in a Waystar error registry. ## APIs - [Waystar Eligibility Verification API](https://www.waystar.com/our-platform/financial-clearance/eligibility-verification/): Real-time and batch eligibility and benefits (X12 270/271). Base host `eligibilityapi.zirmed.com`. - [Waystar Authorization & Referral API](https://www.waystar.com/our-platform/financial-clearance/authorizations/): Prior authorization and referral determination and status (X12 278). Base host `priorauthorizationapi.waystar.com`. - [Waystar Patient Estimation API](https://www.waystar.com/our-platform/financial-clearance/coverage-detection/): Pre-service good-faith patient cost estimates. Base host `estimationapi.zirmed.com`. - [Waystar Claim Management API](https://www.waystar.com/our-platform/claim-management/claim-manager/): Claim submission, scrubbing and history (X12 837P/I/D). Base host `claimsapi.zirmed.com`. - [Waystar Claim Status API](https://www.waystar.com/our-platform/claim-management/claim-monitoring/): Claim status inquiry and monitoring (X12 276/277). Base host `claimsapi.zirmed.com`. - [Waystar Remittance & ERA API](https://www.waystar.com/our-platform/payment-management/remit-manager/): Electronic remittance advice and payment posting (X12 835). Base host `remitsapi.waystar.com`. - [Waystar Denial & Appeal Management API](https://www.waystar.com/our-platform/denial-prevention-recovery/denial-recovery/): Denial and remark codes, appeal packaging and resubmission. No public base host documented. ## Authentication - [Authentication profile](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/authentication/waystar-authentication.yml): Six distinct models across the surface, not interchangeable - HMAC-SHA1 Base64 body signature (classic Developer Suite), HMAC-SHA256 `Authorization` header (Estimation), UserID/Password form fields (Eligibility REST), HTTP Basic (Credential Management, Prior Authorization), WS-Security UsernameToken (SOAP claims/claim status), X.509 client certificate (Eligibility SOAP), plus SAML 2.0 for portal SSO. - No OAuth 2.0 and no OpenID Connect. `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration` are 404 on every host. - The identity unit is `CustID`, a hierarchical Waystar customer identifier. A token created under one CustID cannot be used under another. - Waystar publishes a first-party credential-rotation API, which is unusual in this sector. ## Conventions and runtime semantics - [API conventions](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/conventions/waystar-conventions.yml): idempotency, replay window, async pattern, versioning, content negotiation, identifiers, file services. - **Idempotency**: content-addressed, not client-supplied. Duplicate Estimation POSTs inside a 30-second window with an identical HMAC signature and content are collapsed. There is no `Idempotency-Key` header. The ZPay payment, eligibility and claim-intake endpoints publish no deduplication window - a retried claim or card debit is a NEW transaction. - **Replay protection**: signed requests carry a UTC timestamp that must be within +/- 30 seconds of Waystar's clock. - **Async**: Estimation and Prior Authorization are submit-then-poll. `GatewayAsync.ashx` on eligibility is named async but responds synchronously. - **Pagination**: none. Bulk retrieval is SFTP file download, not paged reads. - **Content negotiation is by request PARAMETER, not `Accept`.** On eligibility, `DataFormat` selects the inbound payload and `ResponseType` the outbound. Waystar warns that the HTML and TEXT responses are cosmetic and change without notice - machine consumers must request `271`, `FullJSON` or `X12definedXML`. - **Rate limiting**: no `RateLimit-*` or `Retry-After` headers and no published per-second caps. The one hard published limit is 50 claims per ImmediateClaims submission. - **Tracing**: no request-id header. Correlate with `TransID`, `RequestID`, `TracingNumber`, `InquiryId` and the X12 TRN segment. ## Errors - [Error catalog](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/errors/waystar-problem-types.yml) - No RFC 9457 `application/problem+json`. Each surface returns its own shape. - **On the eligibility surface an HTTP 200 can be a failure.** Errors default to HTML even when X12 was requested; verify the ISA/GS/ST envelope is present as the first step on receipt. ## Operations - [Lifecycle, versioning and deprecation](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/lifecycle/waystar-lifecycle.yml) - [Status page](http://status.esolutionsinc.com/): a first-party Pingdom uptime dashboard on the Waystar-owned esolutionsinc.com domain. HTTP only - no TLS - unlinked from waystar.com, and it does not cover the newer API hosts. - Versioning is a URI path segment (`/1.0/`, `/2.0/v1/`). No deprecation policy, no RFC 8594 `Sunset`/`Deprecation` headers, no public SLA. - Effective availability of every real-time transaction is bounded by the downstream PAYER, not by Waystar. ## Testing - [Sandbox posture](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/sandbox/waystar-sandbox.yml) - A sandbox exists but is human-provisioned: email `waystartechnicalintegrationteam@waystar.com`. Test HMAC keys come from `apisupport@waystar.com`. - No test card numbers, no test member IDs, no decline triggers, no test clocks, and no `test_`/`live_` key prefix - a caller cannot tell from the credential which environment it is pointed at. ## Compliance - [Conformance and compliance](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/conformance/waystar-conformance.yml) - Waystar is a HIPAA-covered healthcare clearinghouse and asserts HIPAA, GLBA, PCI DSS, SSAE 16 and EHNAC accreditation. There is no trust center and no downloadable attestation reports. - Standards actually implemented: ASC X12N 005010 transaction sets, CAQH CORE Phase II Connectivity Rule 2.2.0 (envelope standards A and B), HL7 v2.3 ADT, SAML 2.0. - **No FHIR.** No FHIR resources, capability statement or SMART-on-FHIR surface anywhere - notable given CMS-0057-F prior-authorization FHIR requirements land on payers. ## Security - [Responsible disclosure](https://www.waystar.com/responsible-disclosure/): contact `security@waystar.com`. No bug bounty, no safe harbor, no PGP key. - No RFC 9116 `/.well-known/security.txt` on any host. - [Domain security probe](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/security/waystar-domain-security.yml) ## SDKs and tooling - **None.** Waystar publishes no client library in npm, PyPI, RubyGems, NuGet, crates.io, Packagist or Maven Central, no CLI, and no Postman collection. See [packages](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/packages/waystar-packages.yml). - Waystar's GitHub organization is [WaystarInc](https://github.com/WaystarInc) - two forked CI/CD example repos, last pushed 2023, no API artifacts. - No MCP server and no A2A agent card. See [MCP](https://raw.githubusercontent.com/api-evangelist/waystar/refs/heads/main/mcp/waystar-mcp.yml). ## Docs and access - [Developer portal](https://developer.waystar.com/) (navigation public, document bodies require login) - [Developer portal registration](https://developer.waystar.com/register/) - [Become a client or technology partner](https://www.waystar.com/clients-partners/) - [Client login](https://www.waystar.com/login/) - [Support](https://www.waystar.com/support/) - [Blog](https://www.waystar.com/blog/) - [Terms and conditions](https://www.waystar.com/terms/) - [Privacy policy](https://www.waystar.com/privacy-policy/) ## About this file Generated by [API Evangelist](https://apievangelist.com) on 2026-08-15 from the public Waystar surface and the artifacts in . Waystar does not publish an llms.txt. Corrections and removal are free: .