AI Medical Tourism Platform API
Case Orchestration
Clinic/Hospital B2B Network
Quoting & Packages
Eligibility & Document AI
Scheduling & Teleconsult
Messaging + Audit Trail
Payments + Settlement Hooks
Policy/Consent Controls
Operated by Spyface Tech Company, LLC • 30 N Gould St Ste N, Sheridan, WY 82801 USA •
Support: hello@spyface.com
What this API does
The AI Medical Tourism Platform API is an orchestration layer for cross-border care journeys. It unifies: provider network (hospitals/clinics/doctors), patient case workflows, document intake, eligibility/readiness scoring, quotes/packages, appointments, and secure messaging into a single integration surface.
Think of it as a platform API that lets marketplaces and operators build experiences like global provider booking & orchestration (e.g., ClinicBooking-style ecosystems) without hardcoding every workflow. Example market reference: clinicbooking.com
What makes it “AI” (measurable outputs)
- Eligibility Score: readiness + missing-doc checklist + risk flags (routing signals)
- Provider Match Ranking: ranked options with reason codes (availability, fit, policy)
- Document Intelligence: extraction + normalization + summary + translation hooks
- Timeline Optimization: proposed plan dates + task ordering + constraint validation
- Operational Risk Signals: anomaly flags (identity, payment, coordination friction)
No “magic.” Every AI decision returns: confidence, reasons[], and trace_id.
Medical + Legal Notice
This API supports logistics, data routing, and operational decisioning. It does not provide medical advice, does not diagnose, and does not replace licensed clinical judgment. Any eligibility or risk output is a workflow signal to support professional review.
1) Quickstart
Base URL
https://api.spyface.com
Auth
Bearer token via header:
Authorization: Bearer <SPYFACE_API_KEY>
For B2B networks, keys are scoped by tenant_id and permissions (operator, clinic, agent).
Typical minimal flow
- Create a Case
- Submit Intake + Documents
- Run Eligibility + Provider Match
- Request Quotes (package/policy included)
- Schedule Teleconsult / procedure appointment
- Coordinate tasks + messaging + audit
2) Core Objects
| Object | What it represents | Key fields |
|---|---|---|
| Case | The entire medical travel journey container. | case_id, status, country_of_origin, destination_preference |
| Intake | Structured intake for routing and quoting. | procedure_code, constraints, timeline, notes |
| Document | Medical reports, labs, imaging summaries, IDs (policy-controlled). | doc_id, type, hash, language, pii_level |
| Provider | Clinic/hospital entity and its service catalog. | provider_id, accreditations, locations, specialties |
| Offer | A procedure package definition (inclusions/exclusions/policy). | offer_id, inclusions[], exclusions[], policy |
| Quote | Priced offer for a specific case. | quote_id, line_items[], valid_until, cancellation_terms |
| Appointment | Teleconsult or in-person schedule entry. | appointment_id, mode, time, participants |
| Task | Operational step (visa letter, lab request, pre-op clearance). | task_id, due_at, owner_role, state |
| Message | Secure case-based communication with audit. | thread_id, sender_role, attachments[], audit_id |
3) Case Workflow Model
Cases progress through explicit states. You can customize permitted transitions per tenant (operator), but the default model is designed to avoid “manual chaos” in cross-border coordination.
Default States Lead → Intake → Eligibility → Matching → Quote → Teleconsult → Pre-Op → Booking → Travel/Arrival → Procedure → Recovery → Follow-Up → Closed
Every transition emits an audit event with actor, timestamp, source, and reason.
Key endpoints
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /v1/medical/cases | Create case |
| GET | /v1/medical/cases/{case_id} | Fetch case |
| PATCH | /v1/medical/cases/{case_id} | Update metadata / status |
| POST | /v1/medical/cases/{case_id}/tasks | Create operational tasks |
| GET | /v1/medical/cases/{case_id}/timeline | Planned vs actual timeline |
4) AI Decision Endpoints (the “decision layer”)
These endpoints produce decisions you can automate against. Each response includes: confidence, reasons[], and trace_id.
| Endpoint | Output | Typical action |
|---|---|---|
| POST /v1/medical/ai/eligibility | Readiness score, missing docs, routing flags | Auto-request missing documents; require teleconsult |
| POST /v1/medical/ai/match | Ranked providers/offers with reason codes | Display top 5; request quotes from top 3 |
| POST /v1/medical/ai/document-intel | Extraction, normalization, translation hooks | Populate intake fields; build checklist |
| POST /v1/medical/ai/timeline | Proposed plan steps with constraint validation | Generate tasks; schedule teleconsult |
| POST /v1/medical/ai/risk | Operational risk flags (identity/payment/coordination) | Step-up verification; manual review |
Eligibility example
{
"tenant_id":"t_global_med",
"case_id":"case_10021",
"policy":{"scope":"MEDICAL","consent":"GRANTED"},
"intake":{
"procedure_code":"PROC_RHINOPLASTY",
"timeline":{"preferred_start":"2026-03-10","latest_start":"2026-04-15"},
"constraints":{"budget_max_usd":5200,"language":"EN","destination":["TR","MX","TH"]}
},
"documents":[
{"doc_id":"doc_aa1","type":"LAB_REPORT","hash":"sha256:...","language":"TR"},
{"doc_id":"doc_aa2","type":"MEDICAL_HISTORY","hash":"sha256:...","language":"EN"}
]
}
{
"case_id":"case_10021",
"eligibility":{
"readiness_score":0.78,
"confidence":0.88,
"reasons":[
{"code":"DOCS_PARTIAL","detail":"Missing imaging summary (if available)"},
{"code":"TIMELINE_FEASIBLE","detail":"Preferred window feasible for matched providers"}
],
"missing_documents":[
{"type":"IMAGING_SUMMARY","priority":"MEDIUM","why":"Improves surgeon review quality"}
],
"routing_flags":[
{"flag":"TELECONSULT_RECOMMENDED","severity":"LOW"}
],
"trace_id":"trace_elg_7f11c"
}
}
5) Provider Network & Offer Catalog
Providers expose structured offers, policies, availability, and operational requirements. You can onboard clinics/hospitals via API or an internal portal—API is the source of truth.
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /v1/medical/providers | Search providers |
| GET | /v1/medical/providers/{provider_id} | Provider details |
| GET | /v1/medical/providers/{provider_id}/offers | Procedure offers/packages |
| GET | /v1/medical/offers/{offer_id} | Offer definition + policy |
| GET | /v1/medical/providers/{provider_id}/availability | Capacity windows |
Offer structure (package-grade)
- Inclusions: nights, transfers, tests, surgeon fee, facility fee
- Exclusions: complications, extra nights, upgraded implants, etc.
- Pre-op requirements: labs, medical history, consult rules
- Cancellation terms: time-based penalties
Accreditation + verification hooks
- Store license/accreditation references as structured fields
- Record verification status + timestamps
- Expose to ranking reasons (without editorial claims)
6) Quotes, Packages & Policies
Quotes are case-specific, time-bounded, and policy-aware. This is the commercial core. The API supports itemized quotes or single-price packages.
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /v1/medical/quotes/request | Request quotes from selected providers |
| GET | /v1/medical/cases/{case_id}/quotes | List all quotes for a case |
| GET | /v1/medical/quotes/{quote_id} | Quote details + policy |
| POST | /v1/medical/quotes/{quote_id}/accept | Accept quote (creates booking intent) |
Quote request example
{
"tenant_id":"t_global_med",
"case_id":"case_10021",
"providers":["prov_tr_901","prov_mx_140","prov_th_333"],
"requested_offer_types":["PACKAGE","ITEMIZED"],
"policy":{"currency":"USD","consent":"GRANTED"},
"commercial":{
"payment_preference":"DEPOSIT",
"deposit_max_usd":800
}
}
7) Scheduling & Teleconsult
Scheduling must handle: time zones, provider capacity, patient availability, and teleconsult vs in-person mode. Appointments are first-class objects with participant roles and reschedule policies.
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /v1/medical/appointments | Create appointment |
| GET | /v1/medical/cases/{case_id}/appointments | List appointments |
| POST | /v1/medical/appointments/{appointment_id}/reschedule | Reschedule |
8) Secure Messaging & Audit
Medical travel requires a single source of truth for coordination. Messaging is case-scoped and auditable.
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /v1/medical/cases/{case_id}/threads | Create thread (clinic + operator + patient) |
| POST | /v1/medical/threads/{thread_id}/messages | Send message |
| GET | /v1/medical/cases/{case_id}/audit | Immutable audit trail |
9) Webhooks
Webhooks deliver state changes and decisions to your systems reliably. Use signature verification + idempotency keys.
| Event | When fired | Payload fields |
|---|---|---|
| case.status.updated | Case transitions | case_id, from, to, actor |
| ai.eligibility.completed | Eligibility output ready | readiness_score, missing_documents, trace_id |
| quote.received | Provider quote received | quote_id, valid_until, policy |
| appointment.confirmed | Confirmed teleconsult/procedure slot | appointment_id, time, participants |
10) Auth, Security & Compliance Controls
Access control model
- Tenant isolation: every object is scoped by tenant_id
- Role scopes: operator, clinic_admin, coordinator, agent, patient
- Field-level policy: restrict sensitive fields unless consent/role permits
- Audit by default: all writes produce immutable audit events
Data minimization options
- Send hashed identifiers (email/phone) where feasible
- Classify documents by pii_level and retention policy
- Use consent gates on cross-provider sharing
- Export/erase endpoints for governance workflows
11) Errors, Idempotency & Retries
Idempotency
For all POST endpoints that create objects, send Idempotency-Key to safely retry.
Error format
{
"error":{
"code":"VALIDATION_ERROR",
"message":"Missing required field: intake.procedure_code",
"details":[{"path":"intake.procedure_code","reason":"REQUIRED"}],
"request_id":"req_9a1f"
}
}
12) Code Examples
cURL — Create a case
curl -sS https://api.spyface.com/v1/medical/cases \
-H "Authorization: Bearer $SPYFACE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: case-create-10021" \
-d '{
"tenant_id":"t_global_med",
"patient":{
"external_patient_id":"ext_pat_771",
"preferred_language":"EN",
"country_of_origin":"GB"
},
"destination_preference":["TR","MX","TH"],
"source":{"channel":"B2B_PARTNER","partner_id":"partner_01"}
}'
Node.js — Run eligibility + trigger missing-doc tasks
const base = "https://api.spyface.com";
const headers = {
"Authorization": `Bearer ${process.env.SPYFACE_API_KEY}`,
"Content-Type": "application/json",
"Idempotency-Key": "eligibility-case_10021"
};
const payload = {
tenant_id: "t_global_med",
case_id: "case_10021",
policy: { scope: "MEDICAL", consent: "GRANTED" },
intake: {
procedure_code: "PROC_RHINOPLASTY",
timeline: { preferred_start: "2026-03-10", latest_start: "2026-04-15" },
constraints: { budget_max_usd: 5200, language: "EN", destination: ["TR","MX","TH"] }
},
documents: [
{ doc_id: "doc_aa1", type: "LAB_REPORT", hash: "sha256:...", language: "TR" },
{ doc_id: "doc_aa2", type: "MEDICAL_HISTORY", hash: "sha256:...", language: "EN" }
]
};
const res = await fetch(`${base}/v1/medical/ai/eligibility`, {
method: "POST",
headers,
body: JSON.stringify(payload)
});
const out = await res.json();
if (out?.eligibility?.missing_documents?.length) {
for (const d of out.eligibility.missing_documents) {
await fetch(`${base}/v1/medical/cases/${payload.case_id}/tasks`, {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.SPYFACE_API_KEY}`,
"Content-Type": "application/json",
"Idempotency-Key": `task-${payload.case_id}-${d.type}`
},
body: JSON.stringify({
tenant_id: payload.tenant_id,
title: `Request ${d.type}`,
priority: d.priority || "MEDIUM",
owner_role: "COORDINATOR",
state: "OPEN",
metadata: { why: d.why, trace_id: out.eligibility.trace_id }
})
});
}
}
console.log("Readiness:", out.eligibility.readiness_score, "Trace:", out.eligibility.trace_id);
Implementation Support
For platform architecture review (multi-tenant model, provider onboarding, quote/policy modeling, eligibility tuning, audit requirements, and rollout strategy), contact: hello@spyface.com.