Skip to main content
The Partner API lets practice management systems and other platforms embed Everbility’s report writing into their own workflow. Your platform starts a launch session for a client, the clinician writes the report in Everbility under their own login, and your platform retrieves the finished document. Unlike the Public API, which uses per-user API keys, the Partner API is built for third-party platforms: a practice admin connects your app once with OAuth 2.0, and your server acts on behalf of that whole practice.
Partner apps are provisioned manually. Email support@everbility.com to register as a partner and receive your client_id and client_secret.

How it works

The three building blocks

Connection

A practice admin approves your app once. You exchange the authorization code for tokens and refresh them on a 90-day rolling window.

Launch session

A single report-writing hand-off. You create it with a clinician email and your client ID, then send the clinician to the launch_url.

Document retrieval

Poll the session until it completes, then pull the rendered report as Markdown or HTML into your platform.

Base URL

https://api.everbility.com/v1/partner
All partner endpoints, including the OAuth token endpoint, live under this prefix. See the API reference for full request and response schemas.

Client mapping

Your platform and Everbility each have their own client records. The first time a clinician opens a session for one of your clients, Everbility asks them to link it to an Everbility client (or they create one). The mapping is remembered per connection, so every later session for that external_client_id skips straight to writing.

Lifetimes at a glance

Credential / objectLifetimeNotes
Authorization code5 minutesSingle use. A new approval invalidates any outstanding codes.
Access token1 hourOpaque bearer token for all partner endpoints.
Refresh token90 daysSingle use — each refresh returns a new pair (rotation).
Launch session48 hoursExpires if the clinician does not complete the report in time.

Security model

  • PKCE is mandatory. Every authorization uses code_challenge_method=S256, in addition to your client_secret.
  • Tokens are opaque and hashed at rest. Everbility stores only SHA-256 hashes of codes, tokens, and your client secret.
  • Refresh tokens rotate. Reusing an already-consumed refresh token revokes the whole token family and flags the connection for re-authorization.
  • Clinicians use their own login. Your platform never handles Everbility user credentials; sessions are bound to a specific clinician by verified email.

Start here

1

Get credentials

Email support@everbility.com with your redirect URI to receive a client_id and client_secret.
2

Connect a practice

Send a practice admin through the consent flow and exchange the code for tokens.
3

Launch and retrieve

Create a launch session, hand the clinician the launch_url, and poll for the finished document.