Skip to content
/Webhooks

Hero Health Public API (1.0.0)

The Hero Health Public API enables healthtech partners to build products that leverage Hero Health's IM1-assured EMIS/TPP integrated functionality.

Key capabilities

  • Patient messaging — Send SMS, email, and NHS App messages on behalf of a practice
  • Appointment booking — List available slots, create reservations, and confirm bookings
  • Patient management — Register and look up patients via PDS (Personal Demographics Service)
  • Webhooks — Subscribe to events such as appointment confirmations and write-to-record outcomes
  • Booking & form links — Generate sharable links for patient self-service flows
  • Elements — Generate access tokens for embedding pre-built Hero UI components

Authentication

All endpoints require an x-api-key and x-practice-group-id header. API keys are scoped to specific functionality (messaging, booking, booking links). Contact Hero support to request your key.

Rate limits

Rate limits are defined in your Partner agreement. If you exceed your limit you will receive a 429 Too Many Requests response.

Download OpenAPI description
Download API docs
Languages
Servers
Mock server
https://developer.herohealth.net/_mock/apis/public-api/openapi/
Staging
https://api.staging.htech.app/
Production
https://api.herohealth.net/

Practice Group

Manage practice group settings, access tokens, and configuration. Use the access token endpoint to generate short-lived JWTs for Hero Elements.

Operations

Patients

Register, search, and manage patient records. Supports PDS (Personal Demographics Service) lookups to trace patients against the NHS Spine.

Operations

Messages

Send SMS, email, NHS App, and Hero-only messages to patients. Supports write-to-record to persist messages in the patient's EHR.

Operations

Booking

Create appointment reservations, confirm bookings, cancel, and reschedule. Query available slots filtered by location, practitioner, and appointment type.

Operations

Episode

Manage clinical episodes — containers for related patient interactions and messages.

Operations

Care Navigation

Manage care navigation pathways and patient submissions for triage workflows.

Operations

Prescription

Create and manage prescriptions.

Operations

Prescriptions

List and manage prescriptions.

Operations

WriteToRecord

Check the status of write-to-record operations for messages sent to the EHR.

Operations

Admin

Manage admin users, signatures, and preferences within a practice group.

Operations

ApiKey

List and manage API keys for your practice group.

Task

Manage tasks assigned to admin users.

Operations

Partner

Retrieve partner information and integrations.

Operations

Partners

Retrieve partner information and integrations.

Form

List and retrieve forms (questionnaires) configured for a practice group.

Operations

Form Response

Create, retrieve, and update form responses submitted by patients.

Operations

Subscriptions

Manage notification subscriptions and subscribers.

Operations

Webhooks

Subscribe to Hero events (e.g. appointment confirmations, write-to-record outcomes) and receive real-time notifications via HTTP callbacks.

Operations

Create a Webhook

Request

Create a webhook subscription for the authenticated practice group. Hero will send an HTTP POST request to the specified URL whenever the subscribed event occurs.

Available events: appointment.confirmed, appointment.cancelled, appointment.rescheduled, prescription.issued, patient.medical-record-updated, patient.added-to-sequence, write-to-record.succeeded, write-to-record.failed.

Optionally provide a signing_key to enable HMAC-SHA256 signature verification on incoming webhook requests. See the webhook security documentation for verification examples.

Security
apiKeyAuth and practiceGroupId
Bodyapplication/jsonrequired
descriptionstring
event_typestringrequired
Enum"appointment.confirmed""appointment.cancelled""appointment.rescheduled""prescription.issued""patient.medical-record-updated""patient.added-to-sequence""write-to-record.succeeded""write-to-record.failed"
signing_keystring
urlstring(uri)required
headersobject
curl -i -X POST \
  https://developer.herohealth.net/_mock/apis/public-api/openapi/v1/webhooks \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: YOUR_API_KEY_HERE' \
  -H 'x-practice-group-id: YOUR_API_KEY_HERE' \
  -d '{
    "description": "Notify our system when appointments are confirmed",
    "event_type": "appointment.confirmed",
    "signing_key": "whsec_your-secret-key-here",
    "url": "https://example.com/webhooks/hero"
  }'

Responses

Ok

Bodyapplication/json
idstringrequired
event_typestringrequired
urlstringrequired
signing_keystring
headersobject
created_atstringrequired
updated_atstringrequired
Response
application/json
{
  "id": "string",
  "event_type": "string",
  "url": "string",
  "signing_key": "string",
  "headers": {
    "property1": "string",
    "property2": "string"
  },
  "created_at": "string",
  "updated_at": "string"
}

List Webhooks

Request

Retrieve all webhook subscriptions for the authenticated practice group. Use this to audit active subscriptions or check event types you are subscribed to.

Security
apiKeyAuth and practiceGroupId
Query
event_typestring
curl -i -X GET \
  'https://developer.herohealth.net/_mock/apis/public-api/openapi/v1/webhooks?event_type=string' \
  -H 'x-api-key: YOUR_API_KEY_HERE' \
  -H 'x-practice-group-id: YOUR_API_KEY_HERE'

Responses

Ok

Bodyapplication/json
dataArray of objectsrequired
data[].​idstringrequired
data[].​event_typestringrequired
data[].​urlstringrequired
data[].​signing_keystring
data[].​headersobject
data[].​created_atstringrequired
data[].​updated_atstringrequired
countnumberrequired
Response
application/json
{
  "data": [
    { … }
  ],
  "count": 0
}

Delete a Webhook

Request

Delete a webhook subscription. Hero will immediately stop sending events to the webhook URL. This action cannot be undone — you will need to create a new webhook to resubscribe.

Security
apiKeyAuth and practiceGroupId
Path
idstringrequired
curl -i -X DELETE \
  'https://developer.herohealth.net/_mock/apis/public-api/openapi/v1/webhooks/{id}' \
  -H 'x-api-key: YOUR_API_KEY_HERE' \
  -H 'x-practice-group-id: YOUR_API_KEY_HERE'

Responses

No Content

Response
No content

Invoicing

Manage invoicing customers, products, coupons, and membership schemes.

Operations

Utilities

Utility endpoints for address lookup and SNOMED code validation.

Booking - HCA

Specialist booking endpoints for HCA (Healthcare Assistant) diary consultants and appointments.

Operations