Sarva PMS Integration API
Connect your system to a practice's schedule, patients and billing.
One API for appointments, balances, payments, documents and work, with signed webhooks when anything changes. A practice decides what your system may do, and can take it back.
Your first call
# 1. A token for your client (10 minutes)
curl -X POST https://core-api.sarvahealth.ai/oauth/token \
-u "$CLIENT_ID:$CLIENT_SECRET" \
-d grant_type=client_credentials \
-d audience=pms-integrations
# 2. Today's schedule at one practice
curl https://pms-api.sarvahealth.ai/integrations/v1/appointments?service_date=2026-11-02 \
-H "Authorization: Bearer $TOKEN" \
-H "Sarva-Practice-Id: $PRACTICE_ID"
46endpoints
33webhook events
24scopes a practice grants
OAuth 2.0client credentials
What you can build
Appointments
7 endpoints- One day's schedule, cancelled and missed visits included
- Book an appointment
- One appointment
Billing
9 endpoints- Patients who owe this practice, largest first
- Claims on this practice
- One claim
Records
9 endpoints- Charges on this practice
- Enter a charge on an encounter
- Submit a document. It arrives unfiled and a person places it
Webhooks
8 endpoints- Queue this delivery again
- List this client's webhook endpoints on the practice
- Register an endpoint; the signing secret is shown once
Events
2 endpoints- Events on this practice, newest first, last 30 days
- One event
Patients
6 endpoints- Find patients on this practice by name, MRN or external id
- Register a patient
- One patient
Meta
1 endpoint- Is the Integration API reachable
Voice
1 endpoint- Report what a call achieved; applied automatically where it can be
Work items
3 endpoints- Work items on this practice
- Ask a person at the practice to do something about a patient
- Close a work item with a code
How it works
- Get a clientSarva issues your system a client id and secret, with the scopes it may ever ask for.
- A practice installs youIn the Sarva Console the practice chooses which of those scopes you get. Nothing works on a practice until then.
- Call the APIExchange your credentials for a 10-minute token and name the practice on every request. Subscribe to webhooks for changes.
Built for systems that retry
Safe retriesEvery write takes an
Idempotency-Key. A payment posts once, whatever happens.
Signed webhooksHMAC-signed, at least once,
retried for 3 days and replayable from /events.
Clear limitsPer practice and class of work, with
RateLimit-* headers on every answer.
Stable v1Changes only add. A breaking change is
v2, with six months' notice.