# Attach patients to a subscriber

Canonical page: https://docs.ovok.com/signals/standalone/api/patients/attach-patients-to-a-subscriber

{/* Generated from the API Explorer document by scripts/generate-signals-api-pages.mjs. Edit ovok-core, not this page. */}


# Attach patients to a subscriber [#attach-patients-to-a-subscriber]

| Method | Path |
| --- | --- |
| `POST` | `/v1/signals/api/subscriber/{id}/patients` |

<Availability route="POST /v1/signals/api/subscriber/{id}/patients" />

Grants the client permission to read those patients' records and receive their alert webhooks. Unknown patient ids are skipped, so a caller can re-post a superset of ids without a 404.

### Through ovok [#through-ovok]

- **Who can call it:** Manager apps, and users whose access policy grants the capabilities.
- **Capabilities, all required:** `signals_associations:update`. Project admins have every capability; client applications get no admin bypass.
- If your access covers only some patients (anyone but project admins, manager or submitter apps, and anyone whose Patient access has no criteria), every patient the body names must be one you can update. A patient is named by its Signals id, or by its Medplum Patient id where Signals takes a `refId`; ovok asks Signals which patient a Signals id is.

## Request [#request]

### Path parameters [#path-parameters]

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The client's `clientId`: the value a patient's `submitters`/`subscribers` hold. |

### Body [#body]

Required. Schema `AssociatePatientsDto`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `patients` | array of string | Yes | — |

## Responses [#responses]

| Status | Meaning |
| --- | --- |
| `200` | `associated`: patients newly attached; `patients`: every requested patient now attached. |
| `400` | A path value holds a character ovok does not send to Signals, such as a raw `:` or `+`. Percent-encode it. The query carries a raw `#`, or more than 200 parameters. |
| `401` | Your ovok access token, or your client id and secret, are missing or invalid. |
| `403` | ovok refused the call: you lack a capability this route needs, or your session has no project, or your access covers only some patients and the call names none, or you can read a patient the call names but not update it. From Signals: Authenticated, but the client's role does not permit this, or it is not attached to the patient. |
| `404` | A patient the call names is not one you can read. From Signals: `CLIENT_NOT_FOUND`: no SUBSCRIBER with that `clientId` in this tenant. |
| `409` | Your project has no Signals tenant of its own (`SIGNALS_TENANT_NOT_OWN`), or it is moving to another one. |
| `415` | The body is not JSON. |
| `422` | A patient id is not 1 to 64 letters, digits, `.`, `_`, `~` or `-`. More than 100 patients are named. A patient is named by something other than a string. From Signals: The payload failed validation. |
| `429` | Too many requests. Retry after the seconds in `Retry-After`. |
| `500` | ovok hit an unexpected fault, such as your project having no Signals submitter. |
| `502` | Signals answered with something ovok couldn't use, or refused ovok's own credential. |
| `503` | Signals is unavailable. Retry after the seconds in `Retry-After`. |
| `504` | Signals did not answer in time. |

## Example [#example]

```bash
curl --request POST 'https://api.sandbox.ovok.com/v1/signals/api/subscriber/:id/patients' \
  --user "${OVOK_CLIENT_ID}:${OVOK_CLIENT_SECRET}" \
  --header 'Content-Type: application/json' \
  --data @body.json
```