Give or withdraw the medical consent
- Sandbox: available
- Staging: available
- Production: unknown
Gives or withdraws the medical settings notifications consent for the signed-in practitioner and returns the resulting medical consent. Other consents are not changed.
Auth: Bearer token for a practitioner session (the profile must be a Practitioner). The caller's access policy must grant Consent:read, Consent:search, Consent:create and Consent:update (a project admin who holds no access policy skips this check).
Scope: The caller's practitioner profile in the caller's project (from the token).
Behaviour
medicalSettingsNotificationsConsent: truerecords the consent on the currently published version.falsewithdraws it.- Sending the current value again writes nothing.
- The value read by
GET /v1/slim/user/consentschanges in the same commit. - The response has the shape of
GET /v1/me/consent/medical:medicalisnullafter a withdrawal.
Example
curl -X POST 'https://api.sandbox.ovok.com/v1/me/consent/medical' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "medicalSettingsNotificationsConsent": true }'bearerAuthorizationBearer <JWT>application/json- body
medicalSettingsNotificationsConsent*booleanMedical consent updated successfully.
application/json- response
medical*curl -X POST 'https://api.sandbox.ovok.com/v1/me/consent/medical' \ -H 'Content-Type: application/json' \ -d '{ "medicalSettingsNotificationsConsent": true}'{ "medical": { "consentId": "string", "acceptedAt": "string" }}Get medical consent GET
Returns the signed-in practitioner's medical settings notifications consent, or `null` when it is not given. Use it on app load to decide whether to show the medical notifications prompt. **Auth:** Bearer token for a practitioner session (the profile must be a `Practitioner`). The caller's access policy must grant `Consent:read` and `Consent:search` (a project admin who holds no access policy skips this check). **Scope:** The caller's practitioner profile in the caller's project (from the token). ## Behaviour - `medical` is `null` when the practitioner never gave the consent or withdrew it. - Only withdrawing ends it. Unlike `GET /v1/slim/user/consents`, a newly published version does not turn it off here. - `acceptedAt` is when it was given, `null` when that is not recorded. - Answers are cached for a rolling day. Any consent write by the practitioner refreshes them right away. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/v1/me/consent/medical' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ``` ```json { "medical": { "consentId": "c3499c27-2973-0a7f-807e-fb8676a92dcb", "acceptedAt": "2026-09-02T07:30:00.000Z" } } ```
Email organization codes POST
Emails a user the tenant codes of every organization (project) they have an account in. Use it on a sign-in screen for users who forgot their organization code. **Auth:** none. ## Behaviour - The route always answers 202 with no body and does the work in the background, so the answer does not tell you whether the email has an account. - The background job finds every account with this email, then looks up the tenant code of each project. If there are no accounts or no codes, no email is sent. - The email lists each project's name and code. It uses the `PATIENT_ORGANIZATION_CODES` template when the first account found is a Patient, and `OVOK_ORGANIZATION_CODES` otherwise. Language and domain come from the request. - The email address is lowercased. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/organizations/code/email' \ -H 'Content-Type: application/json' \ -d '{ "email": "max.mustermann@example.com" }' ```