Skip to content
Last updated

The Hero Health Public API uses API key authentication on all requests. Every API key is tied to a specific Hero practice group and partner. Scopes control which endpoints your key can access.


Getting your API key

Step 1: Join the Partner Programme

Before you can access Hero's APIs, you need to become a verified partner:

  1. Fill out our partner onboarding form at our Get Started page
  2. Review and sign our Partner Agreement (includes SLA and rate limits)
  3. Receive access credentials for both staging and production environments

Step 2: Access developer resources

Once approved, you'll receive:

  • A staging API key for development and testing
  • A practice group ID for each practice you're integrating with
  • Access to our Slack environment for developer support

Step 3: Secure your credentials

Keep your keys secret

Never expose API keys in client-side code or commit them to source control. Store keys securely using environment variables or a secrets manager. Use separate keys for staging and production.


Making authenticated requests

All requests require two headers:

HeaderDescription
x-api-keyYour Hero Health API key
x-practice-group-idThe ID of the practice you are acting on behalf of
curl -X GET "https://api.herohealth.net/v1/practice-groups" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-practice-group-id: YOUR_PRACTICE_GROUP_ID"

Environments

EnvironmentBase URLUse for
Staginghttps://api.staging.htech.appDevelopment, testing, and integration verification
Productionhttps://api.herohealth.netLive applications serving real practices

Use test data only in staging — it does not contain real patient information.


Cross-organisational calls

Cross-org access

Cross-organisational calls allow you to make API requests on behalf of a different practice group, provided both practices belong to the same Hero-configured network.

Hero supports cross-organisational API calls. If the x-practice-group-id header you pass does not match the practice group ID configured on your API key, Hero will verify that the target practice exists within a Hero-configured network alongside your key's practice. If such a network exists, the call returns data from the specified practice group.

The primary use case is cross-organisational bookings — for example, a practice within a PCN inviting patients to book at a hub site.

Cross-organisational call flow

Network CheckHero APIYour ServerNetwork CheckHero APIYour Serveralt[Network exists][No network]API requestx-api-key: YOUR_KEYx-practice-group-id: target-practiceVerify practices share a networkConfirmed200 OK { data from target practice }Denied403 Forbidden

Authentication errors

StatusErrorCause
401invalid_credentialsAPI key is missing, invalid, or expired
403insufficient_permissionsKey does not have the required scope for this endpoint
403forbiddenCross-org access denied — practices are not in the same network
429rate_limit_exceededToo many requests — implement retry with exponential backoff

The API enforces a limit of 300 requests per minute per API key. Contact Hero support if your integration requires a higher limit.


Security best practices

  • Store API keys in environment variables or a secrets manager — never in source code
  • Use separate keys for staging and production
  • Request only the minimum scopes your integration needs
  • All API calls must use HTTPS
  • Contact Hero support to rotate a compromised key immediately

Next steps