Authentication and security

API Key for API authentication and HMAC-SHA256 signatures for webhook verification

API authentication (API Key)

All operations use an API Key in the X-Api-Key header:

X-Api-Key: <your-api-key>

The same API key is used for both inbound and outbound calls. For outbound calls, questionnaireId is sent in the body of POST /api/v1/calls/external-questionnaire.

HMAC signatures on webhooks

Webhooks (both MarIA→Client and EHR/HIS) are signed with HMAC‑SHA256 over the RAW body. Integrators can validate the header for additional security:

X-Integration-Signature: sha256=<hex>

See the HMAC Signature Verification guide for implementation details and code examples.