API reference · Norvya Developers

API reference

Every endpoint is documented once, on its product family's page. 381 operations across 35 families. The machine-readable contract is openapi-v1.json (OpenAPI 3.1): each operation is tagged with its family, and webhook events are in its webhooks section.

Foundation

PlatformBuilt — gated4 endpoints Enrolment & messagingBuilt — gated12 endpoints Events (webhooks)Built — gated5 endpoints Records & documentsBuilt — gated4 endpoints

Clinical

Clinical intelligenceBuilt — gated23 endpoints Specialty careBuilt — gated5 endpoints Practice operations & reportsBuilt — gated13 endpoints EHR: cards and chart documentsBuilt — gated3 endpoints EHR: SMART launch and CDS HooksBuilt — gated6 endpoints

Specialty practices

Behavioral healthBuilt — gated10 endpoints OncologyBuilt — gated6 endpoints DermatologyBuilt — gated12 endpoints Skin AI (switched off)Built — gated2 endpoints Rehab (PT / OT / speech)Built — gated18 endpoints Nutrition (dietitians)Built — gated15 endpoints Med spasBuilt — gated12 endpoints

Life stages & aging

Older adultsBuilt — gated8 endpoints Life stagesBuilt — gated4 endpoints Hospice agenciesBuilt — gated5 endpoints

Data in

Data inBuilt — gated4 endpoints Enrolment rosterBuilt — gated9 endpoints Member data in: observations and workoutsBuilt — gated4 endpoints Claims inBuilt — gated7 endpoints

Population & programmes

PopulationBuilt — gated13 endpoints Social needs & programmesBuilt — gated9 endpoints Public-health reportingBuilt — gated21 endpoints Unit readinessBuilt — gated1 endpoint

Operations

Care transitionsBuilt — gated10 endpoints Hospital at home, days at home & woundsBuilt — gated7 endpoints Billing & schedulingBuilt — gated17 endpoints PharmacyBuilt — gated23 endpoints Care sitesBuilt — gated19 endpoints Medical travelBuilt — gated47 endpoints

Employers & fitness

Employers & occupational healthBuilt — gated21 endpoints Fitness intelligenceBuilt — gated8 endpoints

All scopes

Scopes are granted per organisation type; see Scopes.

Scope	Allows
`behavioral.read`	Read your measurement-based-care caseload (PHQ-9 / GAD-7 / PCL-5 totals and trend, what is due, the not-improving prompt, homework progress as counts), one patient's scores and homework, and your Collaborative Care / BHI registry with each episode's status and flags; with billing.read also an episode's month as a candidate for your biller. Only patients who share mental health with you; never psychotherapy notes, safety plans, homework entry text or 42 CFR Part 2 records (treating practices with a BAA on file; not a designated Part 2 program).
`behavioral.write`	Assign and end between-session homework (Norvya's own generic notification), enrol a patient in Collaborative Care or general BHI, record the documented consent and discharge, each attributed to a named clinician of your practice (patients who share mental health with you only).
`billing.estimates.write`	Issue a No Surprises Act Good Faith Estimate for a patient from your system: your codes and your charges, the same required-contents check as Norvya's own screen (treating practices only).
`billing.read`	Read care-management time and remote-monitoring days per patient per month, with the program's published reference marks reached, as candidates for your biller's review (never a charge or an eligibility determination); billing candidates for staff review; and Good Faith Estimates (treating practices only).
`care_sites.events.write`	Record a round check, report a medication incident, and report an incident or a change in a resident's condition (Norvya alerts the site's nurses with its own generic wording) (pharmacies and care-facility operators).
`care_sites.family.write`	Issue a family member read-only access to a resident (a one-time code by email; a named staff member attests the resident's or guardian's consent), list it and revoke it at once (pharmacies and care-facility operators, BAA on file).
`care_sites.mar.write`	Record a scheduled dose as given, held or refused, and an as-needed dose with its reason and follow-up, on a resident's medication administration record; only doses on the resident's schedule (pharmacies and care-facility operators).
`care_sites.read`	Read the assisted living, group home and nursing home sites your organisation runs: the census, each resident's medication administration record, rounds, medication incidents, incident and change-of-condition reports, care plans and emergency-preparedness attestations (pharmacies and care-facility operators, their own sites only, BAA on file).
`care_sites.residents.write`	Admit a resident to one of the assisted living, group home or nursing home sites your organisation runs: an existing patient by member_ref, or a resident without a Norvya login by your own resident ID; a named staff member attests the consent basis (the resident, a guardian or the facility's admission agreement) (pharmacies and care-facility operators, BAA on file).
`claims.import.write`	Send claims files (CMS CCLF Part A / B / D, or your plan's claims as CSV / NDJSON in the documented shape): staged with a dry run (match rate, row errors by code), then committed or discarded. MBIs and plan member ids are fingerprinted and never stored (treating practices and programme organisations with a BAA on file).
`claims.read`	Read a member's claims summary (counts by part and setting, dates, top diagnosis categories, CMS-HCC categories only when an official model is loaded) from your imported claims and, when the member shares their medical history with you, their own Medicare Blue Button summary; and whether they connected Blue Button or VA records (read-only).
`claims.risk_adjustment.read`	Read risk-adjustment audit evidence for a member: the diagnosis codes in the claims you imported with the dated claims documenting each, grouped into CMS-HCC categories only when an official model is loaded; never a risk score (treating practices and programme organisations with a BAA on file).
`clinical.annual_review.read`	Read a patient's member annual review content (their year in numbers, what is going well, screenings and vaccines, the open findings a physician may select); urgent and practice-internal findings are never selectable (treating practices only).
`clinical.brief.read`	Read the clinician pre-visit brief for a patient (medical practices only; per-section consent).
`clinical.credentials.read`	Read your practice's clinicians with the licence and NPI fields Norvya holds for them and whether Norvya verified them (treating practices only).
`clinical.loops.write`	Close the loop on results and referrals from your system: record that a named clinician acknowledged a result, that the patient was told, the action taken, and move a tracked referral through scheduled, seen, report received and closed (medical practices only).
`clinical.morning_brief.read`	Read one clinician's morning brief for a day: the members on their schedule, what changed since each member's last visit, open referrals and suggested labs, on what the practice may use for each member (treating practices only).
`clinical.outreach.read`	Read rule-based message drafts for your patients' open worklist findings, in the patient's language; never sent by this call (send with messages.write) and never for urgent or practice-internal findings (treating practices only).
`clinical.panel.read`	Read the practice's ranked panel worklist and start worklist runs (medical practices only).
`clinical.panel.write`	Triage your practice's worklist findings from your system (addressed, snoozed until a date, dismissed with a reason, or reopened) with the same rules as Norvya's own worklist screen (medical practices only).
`clinical.patient.match`	Find the member_ref of one of your practice's patients from your own identifier (MRN) plus date of birth; exactly one match or 404 (medical practices only; tightly rate limited, audited).
`clinical.patient.read`	Read a patient's care gaps and between-visit home-data signals (medical practices only; consent and data basis respected).
`clinical.ratings.write`	Record a clinician-rated or clinician-timed measure (for example FOIS, Nine-Hole Peg Test, AIMS) that a named clinician of your practice assigned; scored by Norvya (treating practices only).
`clinical.record.read`	Read one patient's record as a FHIR R4 Bundle (the same builders and the same consent scope as the population export: the patient's sharing choices, your practice's own records, 42 CFR Part 2 records only under a covering consent); size-capped, with the population export for large records (treating practices with a BAA on file, or a sandbox).
`clinical.reports.read`	Read your practice's quarterly value report and programme outcomes report as JSON: aggregates only, counts below the small-cell minimum withheld, with the reports' honest framing (observational, this practice only); no dollar figure (treating practices only).
`clinical.specialty.read`	Read a patient's specialty hub results (cardio, nephro, endo, neuro, pulmo, rheum, GI and questionnaires) under their sharing switches, and run the stateless spirometry, lung-cancer screening and GI alarm checks (treating practices only).
`clinical.video.write`	Open a telehealth video room for an existing appointment of your practice (Daily, under Norvya's BAA; recording and transcription off); participants join in the Norvya app (treating practices only).
`derm.classify`	Skin-lesion image classification. NOT ENABLED: every call answers 409 skin_classifier_not_enabled until the model passes validation and a regulatory decision is recorded (see /model-cards/isic_binary). When enabled it returns calibrated probabilities with their uncertainty, never a diagnosis and never a single label.
`derm.read`	Read a patient's tracked skin lesions (location, monitoring cadence, next recheck, and per photograph the date, the symptoms recorded and any biopsy result; size changes between photographs as image-based estimates; never the photograph and never the classifier's label or probabilities), your panel's lesion rechecks that are due, hidradenitis and acne severity history, patch tests with the allergen avoidance list, and the wound log (each wound's location and assessment dates, never its measurements) (treating practices with a BAA on file; lesions and wounds need the patient to share skin scans with you, severity and patch tests their medical history).
`derm.write`	Record a hidradenitis suppurativa (IHS4 / Hurley) or acne (IGA) assessment, start a patch test with your own panel and record its 48h / 96h / day 7 reads, each attributed to a named clinician of your practice and scored by Norvya; never from a photograph (treating practices with a BAA on file).
`documents.read`	List and download the documents Norvya already produces about a patient (care plans, survivorship plans, reviews, summaries, estimates) as PDF, in the patient's language where the document supports it; each document kind keeps its own consent gate (treating practices, including medical-travel desks, and pharmacies).
`employer.challenges.read`	Read your sponsor recognition challenges, the allow-listed catalog and each challenge's suppressed group counts (joined, completed, completions per week) (employers only).
`employer.challenges.write`	Create or update a recognition challenge for your programme's members: a participation or activity item from the allow-listed catalog, a 7 to 92 day window, a badge only (no cash, no health-outcome targets) (employers only).
`employer.programs.read`	Read your GLP-1 programme set-up (enrolment code, the enrolled count) and its aggregate report: persistence, weight and HbA1c change, engagement, your own drug-cost arithmetic and recognition counts, every number suppressed below the minimum group size; never a person (employers only).
`employer.programs.write`	Create or update your GLP-1 programme (name, start date, your drug cost per member month, active) and regenerate its enrolment code; employees join only in the app, with their own consent (employers only).
`fitness.analytics.read`	Read your gym's member retention against your own baseline and whether more-engaged members get better results, as aggregate counts with small cells withheld; members who do not share activity are excluded (gyms, fitness and personal-training organisations only).
`fitness.guidance.read`	Read gym-safe trainer guidance for a member (consent-filtered; no diagnoses, drugs or readings).
`fitness.notes.read`	Read your trainers' notes about a member (your organisation's own notes; the member does not see them) (gyms, fitness and personal-training organisations only).
`fitness.notes.write`	Add a trainer note about a member: training notes only, length-capped, kept as your organisation's record (gyms, fitness and personal-training organisations only).
`fitness.nudge.write`	Ask Norvya to send a member its standard re-engagement push (gyms only; Norvya's own wording, deduplicated; never your text).
`fitness.roster.read`	Read the at-risk roster: your active members ranked for a trainer's attention (churn level, gym-safe flags, the one priority action), consent-filtered; no diagnoses, drugs or readings.
`fitness.training.read`	Read a member's training: completed workouts, estimated one-rep max per lift, weekly hard sets per muscle group against the volume landmarks, and the training-load ratio while the member shares activity with you; the readiness band (never a recovery score or a reading) only while they share wearables (gyms, fitness and personal-training organisations only).
`hospice.read`	Read your hospice agency's census (election date, level of care, care site, length of stay, discharge), one patient's hospice record with the benefit period and the recertification and face-to-face dates computed from your recorded dates, and the IDG plan-of-care reviews due; never a prognosis or an eligibility statement (hospice agencies only, BAA on file).
`hospice.visits.read`	Read planned and completed visits by discipline for your hospice patients: a visit is missed only when your staff recorded it not done, and a past visit with nothing recorded is 'not recorded' (hospice agencies only, BAA on file).
`hospital.days_at_home.read`	Read a patient's observed days at home from recorded care events, only inside a recorded ascertainment period (no period, no number) (hospitals only, with a BAA on file; the patient must share their medical history with you).
`hospital.wounds.read`	Read a patient's wound log: each wound's location, whether it is a wound or a burn, and its assessment dates; never the measurements (image-based estimates) or the photographs (hospitals only, with a BAA on file; the patient must share their skin scans with you).
`hospital_at_home.read`	Read your hospital-at-home episodes: contacts against your own protocol, escalations, and the NEWS2 observation timeline (hospitals only, with a BAA on file).
`hospital_at_home.write`	Open and close hospital-at-home episodes for your patients; the admission attestations are your clinician's, recorded as such (hospitals only, with a BAA on file).
`instruments.read`	Read questionnaire scores (total, severity band, subscales) with the instrument version and completion time, never item-level answers; mental-health instruments only when the patient shares mental health with you (treating practices only).
`instruments.request`	Ask a patient to complete a validated questionnaire from Norvya's instrument library; Norvya sends its own generic notification (treating practices only).
`life_stages.read`	Read what a parent or guardian shared with your practice about their child (the well-child and vaccine schedule, growth measurements with WHO / CDC percentiles, EPSDT screening status, never adolescent screening answers) and a patient's own pregnancy or postpartum summary; the newborn record and milestone checklists are never shared with an organisation (treating practices only).
`medspa.aftercare.read`	Read aesthetic treatments with their aftercare check-in schedule and alerts, adverse events, and the retreatment-due list on your practice's own intervals (treating practices, BAA on file).
`medspa.aftercare.write`	Record an aesthetic treatment (its aftercare check-ins are scheduled) and an adverse event for a patient of your practice (treating practices, BAA on file).
`medspa.clearance.read`	Read your practice's treatment-clearance intakes: the screen's flags with their reason and source, and the supervising provider's decision and expiry (treating practices that offer clearance, BAA on file).
`medspa.glp1_oversight.read`	Read your medical director's GLP-1 oversight roster: patients on a GLP-1 / GIP medicine whose medication data they share with you, the therapy as recorded, last injection logged, weight trend, latest labs, diabetes monitoring status and each finding with its verbatim FDA label citation (pending clinician sign-off); never a dose suggestion or a prescribing recommendation (treating practices, BAA on file).
`medspa.photos.read`	Read a patient's before / after photo timeline as metadata (view, phase, area, date, consent flags); image files are not served through the API (treating practices).
`members.claim_invite`	Invite a patient your practice imported (no Norvya login yet) to claim their own account: Norvya emails its own invitation in the patient's language with a one-time code that also needs their date of birth; follow the invitation to claimed (treating practices with a BAA on file).
`members.invite`	Invite people to join your organisation on Norvya (Norvya emails its own invitation in the person's language; never a pre-granted consent: the person chooses what to share in the app) and create printable join codes; follow each invitation to joined. Daily cap, de-duplicated per address, and the answer never says whether an address has an account.
`members.read`	List the organisation's linked members as opaque member references.
`members.roster.read`	Read your rosters and their enrolment report: invited, opened, joined, expired, revoked and declined as small-cell-suppressed counts by cohort, plus the status of each of your roster rows (medical practices / programmes only).
`members.roster.write`	Upload a roster of your eligible members (CSV / NDJSON, or a CMS eligibility / attribution file), review its dry run, then have Norvya invite them in bulk (its own email in each person's language; daily cap, queued not dropped), send reminders and collect phone-only join links. MBIs never stored raw (medical practices / programmes with a BAA only).
`messages.read`	Read your organisation's in-app conversation with a member, including their replies (audited as a disclosure).
`messages.write`	Send a member a secure in-app message from your organisation (the conversation your staff use in Norvya); Norvya notifies them with its own generic wording, never your text. Members who turned messages off are refused.
`nutrition.mnt.read`	Read a patient's Medicare MNT referrals, recorded visits and hours next to the rule text, and superbill candidates for your biller as JSON: the codes and units your dietitian recorded, never a code Norvya chose, never submitted, not a coverage decision (treating practices only).
`nutrition.read`	Read your dietitians' caseload (Norvya-convention flags), a patient's dietitian nutrition targets, food rules and meals, the food-log review against targets (only when the patient shares nutrition; unlogged days are unknown, never missed) and structured MNT visit notes (treating practices only).
`nutrition.write`	Act for a named dietitian of your practice: set or release nutrition targets the app then holds the patient to, add or end food rules, set or release RD meals, write a structured MNT visit note (treating practices only).
`observations.write`	Write measurements to a member's own record: vitals, lab results and body composition (practices with a BAA on file), or body composition and the vitals a gym measures (gyms; never labs). Idempotent per item by your external_id; units converted, implausible values refused; DELETE retracts only your own item.
`occupational.injuries.write`	Record a work injury report for an employer you examine for under an active service agreement; the employer sees only the classification inputs, never the description (treating practices only).
`occupational.read`	Read your occupational-health roster, the exam programmes, each worker's released exam conclusions (determination, restrictions, follow-up, due dates; never findings or the worker's answers), next-due dates and injury reports for your own log (employers only).
`occupational.write`	Add workers to your occupational-health roster and request an exam from a practice you hold a service agreement with (employers only).
`older_adults.read`	Read an older patient's falls risk tier (CDC STEADI) and falls-prevention programmes, physical function (Katz ADL / Lawton IADL only where this deployment holds the licence and the patient completed them), medication burden for medication review (count, anticholinergic burden, sedatives; never advice), your care dyads (caregiver link and consent status, never the caregiver's contact details), the sleep-apnoea pathway and CPAP adherence (an unlogged night is unknown, not missed), the status of the five fillable dementia risk factors (never a risk score) and the hospice review status (never an eligibility answer); each under the patient's sharing choices (treating practices only).
`older_adults.write`	Log a contact with one of your care dyads (navigator check-in, care-plan review, education, support line, respite arranged, referral), attributed to a named member of your staff; no free text (treating practices only).
`oncology.import.write`	Send a FHIR R4 oncology treatment-summary bundle for one patient: staged as a draft with what was mapped and what was not (nothing is written to the record), then commit the values a named clinician reviewed, or discard it.
`oncology.read`	Read your survivorship caseload with the status flags Norvya computes (plan status, next dated follow-up, open red flags by lane) and a patient's cancer treatment summary; never the side-effect check-in answers (treating practices with a BAA on file; the patient must share their medical history with you).
`panel.import.write`	Stage, review, commit and discard practice panel imports (FHIR Bulk Data, or a spreadsheet with a saved mapping profile; medical practices with a BAA on file only).
`pharmacy.adherence.read`	Read a patient's dose log and adherence summary: taken, skipped and unrecorded kept apart (an unrecorded dose is never counted as missed) and never a proportion of days covered (pharmacies only; the patient must share medications with you).
`pharmacy.delivery.write`	Record a verified pack (the four-item checklist, all confirmed) and a delivery confirmed at the door (pharmacies only).
`pharmacy.episodes.write`	Open a discharge follow-up episode and record the day-3 / day-30 contacts, how each medication difference was resolved, the 30-day outcome and closing (pharmacies only).
`pharmacy.patients.read`	Read your pharmacy's patients (medicines-sharing status, pack cycle, open discharge follow-up), discharge follow-up episodes, medication reviews, the packing queue and deliveries, the monitoring-due list (a consensus schedule, not an order) and refills due (pharmacies only, BAA on file).
`pharmacy.reviews.write`	Start a medication review, add the pharmacist's recommendations and the prescriber's answer, and complete it (pharmacies only).
`population.aggregate.read`	Read aggregate counts for your whole active panel (worklist tiers, rising risk, care gaps); every count below the small-cell minimum is suppressed, no ids (medical practices only).
`population.export`	Run asynchronous FHIR Bulk Data exports of your panel, identified (each patient's sharing choices apply) or HIPAA Safe Harbor de-identified; audited per file (medical practices only).
`population.measures.export`	Download the QRDA Category III file for the 2026 period: TRUE counts, not submission-validated, audited and refused when the audit log is down (medical practices only).
`population.measures.read`	Read five eCQM-style quality measures and the Million Hearts ABCS as suppressed rates; NOT a certified eCQM calculation (medical practices only).
`programs.benefits.read`	Read your practice's benefits-coordination worklist (transport and home-modification requests on open community referrals); Norvya never determines eligibility or books a ride (treating practices only).
`programs.community_care.read`	Read the VA Community Care, IHS Purchased/Referred Care and TRICARE referrals and authorisations your practice recorded in Norvya, with authorised dates, visits used and documentation deadlines; Norvya never authorises care or determines eligibility (treating practices only).
`programs.readiness.read`	Read unit readiness as counts only (physiology, training load, duty status), small cells and dominance suppressed, no individual, no questionnaire or behavioural-health data and never a projection (military unit and first-responder organisations only).
`public_health.case_reports.read`	Read electronic case reporting readiness, candidates, reports and the Reportability Responses public health sent back (treating practices and hospitals).
`public_health.case_reports.write`	Electronic case reporting: match a patient against the loaded trigger codes, confirm or dismiss a candidate, build the eICR, transmit it, and file a Reportability Response (treating practices and hospitals; refused unless case reporting is active for you).
`public_health.immunizations.read`	Read your registry connection's readiness, the patient's immunization record, your submissions and their acknowledgements, and query the registry for a patient's history (treating practices and hospitals; the patient must share their medical history with you).
`public_health.immunizations.write`	Report a patient's immunization to your state immunization registry (HL7 v2 VXU) and preview what would be sent; an explicit act, audited, refused unless your registry connection is active under a signed state agreement (treating practices and hospitals).
`public_health.syndromic.read`	Read your syndromic surveillance readiness and what was sent where (no patient data in the message list).
`public_health.syndromic.write`	Syndromic surveillance (NSSP): record an emergency or urgent-care visit and send its HL7 v2 ADT message, one explicit send at a time (registered reporting facilities only).
`rehab.read`	Read a patient's physical, occupational and speech therapy record with your practice: recovery episodes (discipline, restrictions, milestones), home exercise programs with the days the patient recorded (an unrecorded day is never a missed one), functional goals and the patient's own ratings, the home-safety checklist (no score), IDDSI food and drink levels and episode outcome measures; the patient must share their medical history with you (treating practices only).
`rehab.write`	Act in Norvya for a named clinician of your practice on that record: set an episode's discipline, lead therapist and restrictions, assign or end a home program, create or update goals, set or end IDDSI levels, recommend home-safety items, request a patient-reported outcome measure for an episode or record a clinician-rated one (treating practices only).
`scheduling.read`	Read your practice's appointments (booked in Norvya or sent by your system), one practice zone, cursor-paginated, plus the scheduling settings (treating practices only).
`scheduling.write`	Send appointments from your practice-management system, idempotently by your own appointment id; cancel never deletes. Change whether Norvya sends its own reminders for them (treating practices only).
`social_needs.read`	Read a patient's health-related social needs screen (AHC-HRSN core) with the positive domains coded to ICD-10-CM Z-codes and SNOMED CT as Norvya asserts them, and the closed-loop community referrals your practice made, with Gravity-aligned Task status (treating practices only; the patient must share their medical history with you; a positive interpersonal-safety screen never leaves Norvya).
`social_needs.write`	Ask a patient to complete a social needs screen (Norvya's generic push), and create and update closed-loop referrals to community organisations (treating practices only).
`staff_wellbeing.read`	Read your own staff's combined burnout check-in results: participation, bands and scores, only once enough people answered; never who answered or who did not (employers and treating practices).
`transitions.adt.write`	Send HL7 v2 ADT messages (A01 / A02 / A03 / A04) from your feed; matched only to your own linked patients on MRN + date of birth, counts returned, nothing echoed (treating practices and hospitals with a BAA on file).
`transitions.notices.read`	Read the hospital admissions, discharges and ED visits Norvya received for a patient of your practice, with the Transitional Care Management windows (treating practices and hospitals; each patient's sharing choices apply).
`transitions.read`	Read your hospital's post-discharge worklist, episode detail and operational outcomes (hospitals only, BAA on file).
`transitions.write`	Enrol post-discharge episodes and record calls, follow-up visits, closes and returns from your care-management system (hospitals only, BAA on file).
`travel.billing.read`	Read the monthly home-nursing invoices per PRN (lines, hold flags, totals in integer minor units) and download them as PDF or HTML.
`travel.documents.read`	Download a journey's documents: the HL7 International Patient Summary, the FHIR repatriation packet, the bilingual readable summary and the weekly nursing reports (each an audited export, inside the patient's sharing choices).
`travel.inquiries.read`	Read your desk's travel inquiries (contact, origin, language, sponsor, the coordinator's summary, status history) with their quote versions (each an immutable Good Faith Estimate). Medical-travel desks with a BAA on file.
`travel.inquiries.write`	Create an inquiry from your own system by its id, edit it, link a patient on your roster, issue or revise its quote, and move it through the desk's own statuses. Converting an accepted inquiry to a journey also needs travel.journeys.write.
`travel.journeys.read`	Read your desk's care journeys (phase, dates, continuity after repatriation, timeline), their flights and transfers with live flight status where configured, the care team and staff hours, approval progress, and your partner-hospital directory (accreditations as recorded; Norvya verifies none). Medical-travel desks with a BAA on file.
`travel.journeys.write`	Open a care journey for a patient on your roster (it waits for the patient's acceptance), move it forward a phase, add, edit and cancel flights and transfers, and keep your partner-hospital directory.
`travel.messages.read`	Read the in-app message thread on a journey: the desk, the patient and the caregiver the patient approved (who see the same thread).
`travel.messages.write`	Post in a journey's thread as your desk's system (shown as "Partner system", never as a person); the patient and caregiver get Norvya's generic push. Refused until the patient has accepted the journey.
`travel.nursing.read`	Read home-nursing cases: the sponsor's PRN, LOMN and LOG versions, shifts, the hours check, visit records (notes, vitals, medication administration, incidents), satisfaction survey results and sponsor referrals.
`travel.nursing.write`	Record a new LOG version, plan, confirm and cancel nursing shifts (never outside the newest LOG's dates or in a pause: the server refuses), move a nursing case forward, and send a sponsor referral for a patient without the app.
`travel.translations.write`	Ask Norvya to machine-translate a free-text item on a journey (the reason for travel, a visit note, a medication line, an incident, a LOMN instruction) into a supported language; the original stays the record.
`vendor.practices.read`	EMR vendors: list the practices that have approved your integration (a vendor-level token, requested without a practice; no patient data).
`webhooks.manage`	Register HTTPS webhook endpoints (payloads carry no PHI). Each event also needs its own scope: worklist / attention events clinical.panel.read, import events panel.import.write, population.export_completed population.export (medical practices only), member.at_risk fitness.roster.read, public_health.iis_ack_received public_health.immunizations.read, public_health.case_report_response public_health.case_reports.read. claims.import_completed needs claims.import.write (medical practices only). member.account_claimed needs members.claim_invite (medical practices only). hospital_at_home.escalation needs hospital_at_home.read (hospitals only). hospice.idg_review_due needs hospice.read (hospice agencies only). pharmacy.refill_due and pharmacy.discharge_episode_opened need pharmacy.patients.read; care_site.change_of_condition, care_site.incident_recorded and care_site.mar_exception need care_sites.read (pharmacies and care-facility operators, their own sites). travel.journey_updated and travel.leg_status_changed need travel.journeys.read, travel.nursing_visit_recorded travel.nursing.read, travel.invoice_issued travel.billing.read (medical-travel desks only). travel.inquiry_updated needs travel.inquiries.read, travel.journey_message_posted travel.messages.read (medical-travel desks only). instrument.batch_dispatched needs instruments.request (medical practices only). roster.enrolment_summary needs members.roster.read (medical practices only). older_adults.falls_tier_raised needs older_adults.read (medical practices only). employer.challenge_completed needs employer.challenges.read and occupational.exam_due occupational.read (employers only); medspa.adverse_event_reported needs medspa.aftercare.read (treating practices only). rehab.goal_met needs rehab.read; nutrition.caseload_flagged needs nutrition.read (medical practices only). cocm.review_due needs behavioral.read (medical practices only). derm.lesion_recheck_due and derm.patch_test_read_recorded need derm.read (medical practices only).
`workouts.write`	Write completed training sessions (exercises, sets, reps, load, RPE, duration) to a member's record, so strength progress, weekly sets and readiness see them (gyms, fitness and personal-training organisations only).