LAPIS Getting Started: Account, Keys, and First API Call (2026)

Getting started overview

To begin integrating with LAPIS, the primary steps involve establishing a developer account, obtaining API credentials, and then executing an initial authenticated API request. LAPIS offers a Developer Sandbox, which provides a non-production environment to test integrations without incurring costs or impacting live patient data. This sandbox includes access to the Lapis Bridge API, which facilitates healthcare data exchange and standardization.

The LAPIS platform is designed to standardize healthcare data and integrate with Electronic Health Records (EHRs) using APIs. Developers typically use the provided SDKs (Python, Node.js) or make direct HTTP requests to interact with the API. The initial setup focuses on securely authenticating your application to access LAPIS services.

This guide will walk through the process of signing up for the Developer Sandbox, generating necessary API keys, and constructing a basic API call to verify your setup. Familiarity with RESTful API concepts and JSON data structures will be beneficial for a smooth integration experience.

Create an account and get keys

The first step in using LAPIS is to create a Developer Sandbox account. This account provides access to the necessary tools and credentials for testing and development.

1. Sign up for the Developer Sandbox

Navigate to the LAPIS homepage and locate the option to sign up for the Developer Sandbox. This process typically involves providing an email address, setting a password, and agreeing to the terms of service. Upon successful registration, you will usually receive a confirmation email to verify your account.

2. Access the Developer Dashboard

After verifying your email, log in to the LAPIS Developer Dashboard. This dashboard is your central hub for managing applications, viewing API usage, and generating credentials.

3. Generate API Keys

Within the Developer Dashboard, navigate to the “API Keys” or “Credentials” section. LAPIS typically uses a combination of a Client ID and Client Secret for authentication. Follow the prompts to generate a new set of API keys. It is critical to copy and securely store your Client Secret immediately, as it is often shown only once for security reasons. If lost, you may need to regenerate it, which could invalidate previous integrations.

LAPIS's authentication mechanism typically relies on OAuth 2.0 for secure access. The Client ID identifies your application, while the Client Secret is a confidential key used to authenticate your application when requesting an access token. This access token is then used in subsequent API calls to authorize requests. For a deeper understanding of OAuth 2.0 flows, refer to the OAuth 2.0 specification.

4. Note down your API Endpoint

The LAPIS documentation (docs.lapishealth.com) will specify the base URL for the API endpoints in the Developer Sandbox environment. This URL will be different from the production environment. Ensure you are using the correct sandbox endpoint for your initial tests.

Your first request

Once you have your Client ID, Client Secret, and the sandbox API endpoint, you can make your first authenticated request. This example will demonstrate retrieving an access token and then using it to make a simple API call, typically to a health data endpoint.

1. Obtain an Access Token

First, you need to exchange your Client ID and Client Secret for an access token. This is usually done by making a POST request to an authentication endpoint. The request body typically contains your client_id, client_secret, and a grant_type (e.g., client_credentials).

CLIENT_ID="your_client_id"
CLIENT_SECRET="your_client_secret"
TOKEN_URL="https://sandbox.lapishealth.com/oauth/token" # Example URL

curl -X POST \
  "$TOKEN_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET"

The response will be a JSON object containing your access_token and its expires_in duration. Extract the access_token for subsequent API calls.

2. Make an authenticated API call

With the access_token, you can now make a request to a protected API endpoint. The access token should be included in the Authorization header of your request, typically in the format Bearer <access_token>.

For this example, let's assume there's a /patients endpoint to retrieve a list of test patients in the sandbox.

ACCESS_TOKEN="your_obtained_access_token"
API_BASE_URL="https://sandbox.lapishealth.com/api/v1" # Example API base URL

curl -X GET \
  "$API_BASE_URL/patients" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json"

A successful response would return a JSON array of patient objects, indicating that your authentication and API call were correctly configured. The exact structure of the patient data will be detailed in the LAPIS API Reference.

Quick Reference Table: First Steps

Common next steps

After successfully making your first API call, consider these next steps to further your integration with LAPIS:

• Explore the API Reference: Dive into the LAPIS API Reference to understand all available endpoints, data models, and query parameters. This will help you leverage the full capabilities of the Lapis Bridge API for integrating with EHRs and standardizing healthcare data.
• Utilize SDKs: If you are working with Python or Node.js, consider using the LAPIS SDKs. SDKs often simplify API interactions by handling authentication, request construction, and response parsing, streamlining development.
• Understand Data Models: Familiarize yourself with how LAPIS represents healthcare data (e.g., patients, encounters, observations). This understanding is crucial for correctly interpreting data received and formatting data sent to the API.
• Implement Webhooks: For real-time notifications about data changes or events, explore LAPIS's webhook capabilities. Webhooks allow your application to react to events without continuous polling, which is more efficient for automating clinical workflows. Twilio provides a general guide on webhook security best practices, which can be applied when implementing LAPIS webhooks.
• Error Handling: Implement robust error handling in your application. The API reference will detail common error codes and messages, allowing your application to gracefully manage issues like invalid requests, rate limits, or authentication failures.
• Monitor Usage: Regularly check your API usage in the Developer Dashboard to stay within sandbox limits or to plan for transitioning to a paid plan when moving to production.
• HIPAA Compliance: As LAPIS handles Protected Health Information (PHI), ensure your application's design and deployment adhere to HIPAA compliance standards, particularly when moving beyond the sandbox environment. LAPIS itself is HIPAA compliant, but your integration must also maintain this standard.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some troubleshooting steps:

• Check API Keys: Double-check that your Client ID and Client Secret are correct. Ensure there are no leading or trailing spaces. If you suspect an issue, regenerate the keys in your Developer Dashboard.
• Verify Token Scope/Permissions: Ensure the access token you obtained has the necessary permissions (scopes) for the API endpoint you are trying to access. The authentication response will usually indicate the granted scopes.
• Correct Endpoint: Confirm you are using the correct sandbox API endpoint. The base URL for the sandbox is distinct from the production environment.
• Authorization Header: Verify that the Authorization header is correctly formatted as Bearer <access_token>, with a space between "Bearer" and the token.
• Content-Type Header: For POST requests, ensure the Content-Type header is set correctly (e.g., application/x-www-form-urlencoded for token requests, or application/json for data payloads).
• Request Body Format: If you are sending a request body (e.g., for creating a resource), ensure it is valid JSON and matches the expected schema described in the API Reference.
• Network Issues: Temporarily disable any VPNs or firewalls to rule out network interference. Ensure you have a stable internet connection.
• Consult Documentation: Refer to the specific endpoint documentation in the LAPIS API Reference for expected request formats, parameters, and potential error codes.
• Review Error Messages: Pay close attention to the error messages returned by the API. They often provide specific clues about what went wrong (e.g., "Invalid client credentials," "Missing required parameter").
• Check Rate Limits: Although less common for a first call, be aware of potential rate limits. If you make too many requests in a short period, the API might temporarily block you.
• Contact Support: If you've exhausted all troubleshooting steps, reach out to LAPIS support for assistance. Provide them with your Client ID (not Client Secret), the exact request you are making, and any error messages received.