Authentication

The API uses the OAuth 2.0 client-credentials (machine-to-machine) grant. Generate a client_id and client_secret from Settings → Integrations → API access in the ManaNotes app; each credential is bound to your clinic and a set of scopes, so requests only ever see that clinic’s data.

Get an access token

Exchange your credentials at the API’s token endpoint. It returns a short-lived bearer token:

curl --request POST \
  --url https://api.mananotes.co.nz/api/v1/oauth/token \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET

The response contains a short-lived access_token (plus token_type, expires_in and granted scope). Cache it until it expires rather than requesting one per call:

{
  "access_token": "eyJhbGci...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "patients:read appointments:read"
}

Make a request

Send the token in the Authorization header as a bearer token:

curl https://api.mananotes.co.nz/api/v1/patients \
  -H "Authorization: Bearer eyJhbGci..."

A missing or invalid token returns 401 Unauthorized; a valid token whose client lacks the required scope returns 403 Forbidden.

Scopes

Each client is granted a subset of the scopes below, and every endpoint asserts the scope it needs. write covers create, update and delete (deletes are soft).