API Documentation

Authentication

All API endpoints require JWT authentication. Include the access token in the Authorization header.

{
    "email": "user@example.com",
    "password": "password123",
    "mfa_code": "123456" // Optional if MFA is enabled
}

{
    "success": true,
    "tokens": {
        "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "refresh_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "expires_in": 900,
        "token_type": "Bearer"
    },
    "user": {
        "id": 1,
        "name": "John Doe",
        "email": "user@example.com",
        "role": "compliance_officer",
        "organization_id": 1,
        "organization_name": "Demo Health Inc."
    }
}

{
    "refresh_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
}

Security Risk Assessment

{
    "title": "Q4 2024 Security Risk Assessment"
}

{
    "sra_id": 1,
    "question_id": 1,
    "answer": "comprehensive",
    "comments": "We have comprehensive access control policies in place."
}

{
    "sra_id": 1,
    "answers": {
        "1": {"answer": "comprehensive", "risk_rating": "low"},
        "2": {"answer": "standard", "risk_rating": "low"},
        // ... all 25 questions
    }
}

{
    "success": true,
    "score": 85,
    "breakdown": {
        "low": 15,
        "medium": 8,
        "high": 2,
        "critical": 0
    },
    "message": "SRA completed successfully"
}

Evidence Management

evidence_file: [file]
filename: "security_policy.pdf"
description: "Updated security policy document"
tags: "policy, security, compliance"
evidence_type: "document"
sra_id: 1

{
    "evidence": [
        {
            "id": 1,
            "filename": "security_policy.pdf",
            "evidence_type": "document",
            "description": "Updated security policy document",
            "tags": "policy, security, compliance",
            "file_size": 1024000,
            "version_count": 2,
            "created_at": "2024-01-15 10:30:00",
            "uploaded_by_name": "John Doe"
        }
    ]
}

{
    "evidence_id": 1,
    "metadata": {
        "description": "Updated description",
        "tags": "policy, security, updated",
        "evidence_type": "document",
        "custom": {
            "department": "IT",
            "approval_status": "approved",
            "review_date": "2024-12-31"
        }
    }
}

Training & Certificates

{
    "course_id": 1
}

{
    "enrollments": [
        {
            "id": 1,
            "course_id": 1,
            "title": "HIPAA Essentials",
            "status": "in_progress",
            "progress_percentage": 65,
            "started_at": "2024-01-15 10:00:00",
            "certificate_url": null
        }
    ]
}

{
    "enrollment_id": 1,
    "progress_percentage": 100
}

Remediation Tasks

Remediation tasks are the corrective actions raised from risk assessment findings. Each task carries a priority score derived from the finding's risk rating and the HIPAA control it maps to.

{
    "tasks": [
        {
            "id": 42,
            "title": "Enable audit logging on the EHR database",
            "control_id": "164.312(a)(2)",
            "priority": "high",
            "priority_score": 82,
            "status": "open",
            "assigned_to": 7,
            "due_date": "2026-09-30",
            "created_from_finding": 118
        }
    ],
    "total": 1
}

{
    "title": "Rotate service account credentials",
    "control_id": "164.312(d)",
    "priority": "medium",
    "assigned_to": 7,
    "due_date": "2026-10-15"
}

{
    "task_id": 42,
    "status": "complete",
    "evidence_id": 91,
    "note": "Audit logging enabled and verified 2026-08-09"
}

{
    "open": 14,
    "in_progress": 6,
    "blocked": 1,
    "complete": 63,
    "overdue": 2,
    "by_priority": { "critical": 1, "high": 8, "medium": 9, "low": 3 }
}

Code Examples

// Login and get tokens
const loginResponse = await fetch('/api/auth.php?action=login', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        email: 'user@example.com',
        password: 'password123'
    })
});

const loginData = await loginResponse.json();
const accessToken = loginData.tokens.access_token;

// Make authenticated request
const sraResponse = await fetch('/api/sra.php?action=get_answers&sra_id=1', {
    headers: {
        'Authorization': `Bearer ${accessToken}`
    }
});

const sraData = await sraResponse.json();

// Login
$loginData = [
    'email' => 'user@example.com',
    'password' => 'password123'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://hipaaauditors.com/api/auth.php?action=login');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($loginData));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$loginResult = json_decode($response, true);
$accessToken = $loginResult['tokens']['access_token'];

// Make authenticated request
curl_setopt($ch, CURLOPT_URL, 'https://hipaaauditors.com/api/sra.php?action=get_answers&sra_id=1');
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $accessToken
]);

$response = curl_exec($ch);
$sraData = json_decode($response, true);

import requests
import json

# Login
login_data = {
    'email': 'user@example.com',
    'password': 'password123'
}

response = requests.post(
    'https://hipaaauditors.com/api/auth.php?action=login',
    json=login_data
)

login_result = response.json()
access_token = login_result['tokens']['access_token']

# Make authenticated request
headers = {'Authorization': f'Bearer {access_token}'}
response = requests.get(
    'https://hipaaauditors.com/api/sra.php?action=get_answers&sra_id=1',
    headers=headers
)

sra_data = response.json()

Error Handling

All API endpoints return consistent error responses:

{
    "error": "Error message description",
    "code": "ERROR_CODE", // Optional
    "details": {} // Optional additional details
}

Rate Limiting

API requests are rate limited to prevent abuse:

• Authentication endpoints: 5 requests per minute per IP
• General API endpoints: 100 requests per minute per user
• File upload endpoints: 10 requests per minute per user