Skip to main content

AI Medical Tourism Platform API

Case Orchestration Clinic/Hospital B2B Network Quoting & Packages Eligibility & Document AI Scheduling & Teleconsult Messaging + Audit Trail Payments + Settlement Hooks Policy/Consent Controls
Operated by Spyface Tech Company, LLC • 30 N Gould St Ste N, Sheridan, WY 82801 USA • Support: hello@spyface.com

What this API does

The AI Medical Tourism Platform API is an orchestration layer for cross-border care journeys. It unifies: provider network (hospitals/clinics/doctors), patient case workflows, document intake, eligibility/readiness scoring, quotes/packages, appointments, and secure messaging into a single integration surface.

Think of it as a platform API that lets marketplaces and operators build experiences like global provider booking & orchestration (e.g., ClinicBooking-style ecosystems) without hardcoding every workflow. Example market reference: clinicbooking.com

What makes it “AI” (measurable outputs)

  • Eligibility Score: readiness + missing-doc checklist + risk flags (routing signals)
  • Provider Match Ranking: ranked options with reason codes (availability, fit, policy)
  • Document Intelligence: extraction + normalization + summary + translation hooks
  • Timeline Optimization: proposed plan dates + task ordering + constraint validation
  • Operational Risk Signals: anomaly flags (identity, payment, coordination friction)

No “magic.” Every AI decision returns: confidence, reasons[], and trace_id.

Medical + Legal Notice

This API supports logistics, data routing, and operational decisioning. It does not provide medical advice, does not diagnose, and does not replace licensed clinical judgment. Any eligibility or risk output is a workflow signal to support professional review.

1) Quickstart

Base URL

https://api.spyface.com

Auth

Bearer token via header:

Authorization: Bearer <SPYFACE_API_KEY>

For B2B networks, keys are scoped by tenant_id and permissions (operator, clinic, agent).

Typical minimal flow

  1. Create a Case
  2. Submit Intake + Documents
  3. Run Eligibility + Provider Match
  4. Request Quotes (package/policy included)
  5. Schedule Teleconsult / procedure appointment
  6. Coordinate tasks + messaging + audit

2) Core Objects

ObjectWhat it representsKey fields
Case The entire medical travel journey container. case_id, status, country_of_origin, destination_preference
Intake Structured intake for routing and quoting. procedure_code, constraints, timeline, notes
Document Medical reports, labs, imaging summaries, IDs (policy-controlled). doc_id, type, hash, language, pii_level
Provider Clinic/hospital entity and its service catalog. provider_id, accreditations, locations, specialties
Offer A procedure package definition (inclusions/exclusions/policy). offer_id, inclusions[], exclusions[], policy
Quote Priced offer for a specific case. quote_id, line_items[], valid_until, cancellation_terms
Appointment Teleconsult or in-person schedule entry. appointment_id, mode, time, participants
Task Operational step (visa letter, lab request, pre-op clearance). task_id, due_at, owner_role, state
Message Secure case-based communication with audit. thread_id, sender_role, attachments[], audit_id

3) Case Workflow Model

Cases progress through explicit states. You can customize permitted transitions per tenant (operator), but the default model is designed to avoid “manual chaos” in cross-border coordination.

Default States Lead → Intake → Eligibility → Matching → Quote → Teleconsult → Pre-Op → Booking → Travel/Arrival → Procedure → Recovery → Follow-Up → Closed

Every transition emits an audit event with actor, timestamp, source, and reason.

Key endpoints

MethodEndpointPurpose
POST/v1/medical/casesCreate case
GET/v1/medical/cases/{case_id}Fetch case
PATCH/v1/medical/cases/{case_id}Update metadata / status
POST/v1/medical/cases/{case_id}/tasksCreate operational tasks
GET/v1/medical/cases/{case_id}/timelinePlanned vs actual timeline

4) AI Decision Endpoints (the “decision layer”)

These endpoints produce decisions you can automate against. Each response includes: confidence, reasons[], and trace_id.

EndpointOutputTypical action
POST /v1/medical/ai/eligibility Readiness score, missing docs, routing flags Auto-request missing documents; require teleconsult
POST /v1/medical/ai/match Ranked providers/offers with reason codes Display top 5; request quotes from top 3
POST /v1/medical/ai/document-intel Extraction, normalization, translation hooks Populate intake fields; build checklist
POST /v1/medical/ai/timeline Proposed plan steps with constraint validation Generate tasks; schedule teleconsult
POST /v1/medical/ai/risk Operational risk flags (identity/payment/coordination) Step-up verification; manual review

Eligibility example

{
  "tenant_id":"t_global_med",
  "case_id":"case_10021",
  "policy":{"scope":"MEDICAL","consent":"GRANTED"},
  "intake":{
    "procedure_code":"PROC_RHINOPLASTY",
    "timeline":{"preferred_start":"2026-03-10","latest_start":"2026-04-15"},
    "constraints":{"budget_max_usd":5200,"language":"EN","destination":["TR","MX","TH"]}
  },
  "documents":[
    {"doc_id":"doc_aa1","type":"LAB_REPORT","hash":"sha256:...","language":"TR"},
    {"doc_id":"doc_aa2","type":"MEDICAL_HISTORY","hash":"sha256:...","language":"EN"}
  ]
}
{
  "case_id":"case_10021",
  "eligibility":{
    "readiness_score":0.78,
    "confidence":0.88,
    "reasons":[
      {"code":"DOCS_PARTIAL","detail":"Missing imaging summary (if available)"},
      {"code":"TIMELINE_FEASIBLE","detail":"Preferred window feasible for matched providers"}
    ],
    "missing_documents":[
      {"type":"IMAGING_SUMMARY","priority":"MEDIUM","why":"Improves surgeon review quality"}
    ],
    "routing_flags":[
      {"flag":"TELECONSULT_RECOMMENDED","severity":"LOW"}
    ],
    "trace_id":"trace_elg_7f11c"
  }
}

5) Provider Network & Offer Catalog

Providers expose structured offers, policies, availability, and operational requirements. You can onboard clinics/hospitals via API or an internal portal—API is the source of truth.

MethodEndpointPurpose
GET/v1/medical/providersSearch providers
GET/v1/medical/providers/{provider_id}Provider details
GET/v1/medical/providers/{provider_id}/offersProcedure offers/packages
GET/v1/medical/offers/{offer_id}Offer definition + policy
GET/v1/medical/providers/{provider_id}/availabilityCapacity windows

Offer structure (package-grade)

  • Inclusions: nights, transfers, tests, surgeon fee, facility fee
  • Exclusions: complications, extra nights, upgraded implants, etc.
  • Pre-op requirements: labs, medical history, consult rules
  • Cancellation terms: time-based penalties

Accreditation + verification hooks

  • Store license/accreditation references as structured fields
  • Record verification status + timestamps
  • Expose to ranking reasons (without editorial claims)

6) Quotes, Packages & Policies

Quotes are case-specific, time-bounded, and policy-aware. This is the commercial core. The API supports itemized quotes or single-price packages.

MethodEndpointPurpose
POST/v1/medical/quotes/requestRequest quotes from selected providers
GET/v1/medical/cases/{case_id}/quotesList all quotes for a case
GET/v1/medical/quotes/{quote_id}Quote details + policy
POST/v1/medical/quotes/{quote_id}/acceptAccept quote (creates booking intent)

Quote request example

{
  "tenant_id":"t_global_med",
  "case_id":"case_10021",
  "providers":["prov_tr_901","prov_mx_140","prov_th_333"],
  "requested_offer_types":["PACKAGE","ITEMIZED"],
  "policy":{"currency":"USD","consent":"GRANTED"},
  "commercial":{
    "payment_preference":"DEPOSIT",
    "deposit_max_usd":800
  }
}

7) Scheduling & Teleconsult

Scheduling must handle: time zones, provider capacity, patient availability, and teleconsult vs in-person mode. Appointments are first-class objects with participant roles and reschedule policies.

MethodEndpointPurpose
POST/v1/medical/appointmentsCreate appointment
GET/v1/medical/cases/{case_id}/appointmentsList appointments
POST/v1/medical/appointments/{appointment_id}/rescheduleReschedule

8) Secure Messaging & Audit

Medical travel requires a single source of truth for coordination. Messaging is case-scoped and auditable.

MethodEndpointPurpose
POST/v1/medical/cases/{case_id}/threadsCreate thread (clinic + operator + patient)
POST/v1/medical/threads/{thread_id}/messagesSend message
GET/v1/medical/cases/{case_id}/auditImmutable audit trail

9) Webhooks

Webhooks deliver state changes and decisions to your systems reliably. Use signature verification + idempotency keys.

EventWhen firedPayload fields
case.status.updated Case transitions case_id, from, to, actor
ai.eligibility.completed Eligibility output ready readiness_score, missing_documents, trace_id
quote.received Provider quote received quote_id, valid_until, policy
appointment.confirmed Confirmed teleconsult/procedure slot appointment_id, time, participants

10) Auth, Security & Compliance Controls

Access control model

  • Tenant isolation: every object is scoped by tenant_id
  • Role scopes: operator, clinic_admin, coordinator, agent, patient
  • Field-level policy: restrict sensitive fields unless consent/role permits
  • Audit by default: all writes produce immutable audit events

Data minimization options

  • Send hashed identifiers (email/phone) where feasible
  • Classify documents by pii_level and retention policy
  • Use consent gates on cross-provider sharing
  • Export/erase endpoints for governance workflows

11) Errors, Idempotency & Retries

Idempotency

For all POST endpoints that create objects, send Idempotency-Key to safely retry.

Error format

{
  "error":{
    "code":"VALIDATION_ERROR",
    "message":"Missing required field: intake.procedure_code",
    "details":[{"path":"intake.procedure_code","reason":"REQUIRED"}],
    "request_id":"req_9a1f"
  }
}

12) Code Examples

cURL — Create a case


curl -sS https://api.spyface.com/v1/medical/cases \
  -H "Authorization: Bearer $SPYFACE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: case-create-10021" \
  -d '{
    "tenant_id":"t_global_med",
    "patient":{
      "external_patient_id":"ext_pat_771",
      "preferred_language":"EN",
      "country_of_origin":"GB"
    },
    "destination_preference":["TR","MX","TH"],
    "source":{"channel":"B2B_PARTNER","partner_id":"partner_01"}
  }'

Node.js — Run eligibility + trigger missing-doc tasks


const base = "https://api.spyface.com";
const headers = {
  "Authorization": `Bearer ${process.env.SPYFACE_API_KEY}`,
  "Content-Type": "application/json",
  "Idempotency-Key": "eligibility-case_10021"
};

const payload = {
  tenant_id: "t_global_med",
  case_id: "case_10021",
  policy: { scope: "MEDICAL", consent: "GRANTED" },
  intake: {
    procedure_code: "PROC_RHINOPLASTY",
    timeline: { preferred_start: "2026-03-10", latest_start: "2026-04-15" },
    constraints: { budget_max_usd: 5200, language: "EN", destination: ["TR","MX","TH"] }
  },
  documents: [
    { doc_id: "doc_aa1", type: "LAB_REPORT", hash: "sha256:...", language: "TR" },
    { doc_id: "doc_aa2", type: "MEDICAL_HISTORY", hash: "sha256:...", language: "EN" }
  ]
};

const res = await fetch(`${base}/v1/medical/ai/eligibility`, {
  method: "POST",
  headers,
  body: JSON.stringify(payload)
});
const out = await res.json();

if (out?.eligibility?.missing_documents?.length) {
  for (const d of out.eligibility.missing_documents) {
    await fetch(`${base}/v1/medical/cases/${payload.case_id}/tasks`, {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${process.env.SPYFACE_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": `task-${payload.case_id}-${d.type}`
      },
      body: JSON.stringify({
        tenant_id: payload.tenant_id,
        title: `Request ${d.type}`,
        priority: d.priority || "MEDIUM",
        owner_role: "COORDINATOR",
        state: "OPEN",
        metadata: { why: d.why, trace_id: out.eligibility.trace_id }
      })
    });
  }
}
console.log("Readiness:", out.eligibility.readiness_score, "Trace:", out.eligibility.trace_id);

Implementation Support

For platform architecture review (multi-tenant model, provider onboarding, quote/policy modeling, eligibility tuning, audit requirements, and rollout strategy), contact: hello@spyface.com.