# API reference

Canonical page: https://docs.ovok.com/api

The Ovok API is a JSON API over HTTPS. Each page in this reference covers one operation: what it does, who may call
it, its parameters and responses, and a request you can send from the page.

| | |
| --- | --- |
| Base URL | `https://api.sandbox.ovok.com` |
| Authentication | `Authorization: Bearer {{ACCESS_TOKEN}}`, from [sign-in](/authentication) |
| FHIR | `https://api.sandbox.ovok.com/fhir/R4/`, documented under [FHIR R4](/api/fhir) |
| Errors | [`application/problem+json`](/errors), with a stable `type` URI per error |

## Errors on every route [#errors-on-every-route]

Each operation lists its own errors. Any route can also answer with these:

| Status | Meaning |
| --- | --- |
| [`401`](/errors/unauthenticated) | The bearer token is missing, invalid or expired. The response includes `WWW-Authenticate: Bearer`. |
| [`429`](/errors/too-many-requests) | Too many requests. Wait the seconds in `Retry-After`, then retry. |
| [`500`](/errors/internal-error) | Unexpected server fault. Retry; if it persists, contact support with the `traceId`. |
| [`503`](/errors/service-unavailable) | Over capacity or briefly unavailable. Wait the seconds in `Retry-After`, then retry. |

## Availability [#availability]

Routes reach the sandbox first, then staging and production. Each operation page shows the environments that
serve it. Routes being retired are listed with their sunset date and replacements in
[deprecated routes](/deprecated-routes).

## See also [#see-also]

- [Authentication](/authentication)
- [Access policies](/access-policies)
- [Errors](/errors)
- [JavaScript SDK](/web-sdk)