API reference · Specialty practices

Skin AI (switched off)

Built — gated2 endpoints · OpenAPI tag derm_ai

The skin-lesion classifier is built but switched off by product decision: every call answers 409 skin_classifier_not_enabled, and a continuous-monitoring check fails if it is ever turned on. Listed so nobody builds against it expecting an answer.

Who calls it: No market yet.
Before production: Off. Turning it on needs a validation report and a recorded regulatory decision.
Sandbox: Build against synthetic members first. What each sandbox holds

Scopes

Scope	Allows
`derm.classify`	Skin-lesion image classification. NOT ENABLED: every call answers 409 skin_classifier_not_enabled until the model passes validation and a regulatory decision is recorded (see /model-cards/isic_binary). When enabled it returns calibrated probabilities with their uncertainty, never a diagnosis and never a single label.

Endpoints

Whether the skin-lesion classifier is enabled, and its model card

GET/v1/derm/classifierderm.classify

enabled false today, with the reason and the measured performance from the model card. Needs derm.read or derm.classify. No patient data.

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/derm/classifier" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]

resp = requests.get(
    BASE + "/v1/derm/classifier",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const url = new URL(`${BASE}/v1/derm/classifier`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Classify a skin-lesion photograph (NOT ENABLED: 409 skin_classifier_not_enabled)

POST/v1/patients/{member_ref}/skin-classificationsderm.classify

NOT ENABLED. Every call answers 409 skin_classifier_not_enabled (body: reason and model_card {id, url}; Link header to /model-cards/isic_binary) while PARTNER_SKIN_CLASSIFIER_ENABLED is off, and always in a sandbox. The model's malignant recall is 0.411 and its sensitivity differs by Fitzpatrick skin type. Nothing is read from the image first.

If it is ever enabled (after validation and a recorded regulatory decision): multipart `file` (JPEG / PNG, at most 10 MB, cleaned in memory, never stored). The answer is never a diagnosis and never a single label: not_a_diagnosis true, the model card id and checkpoint version, every class's temperature-calibrated probability with its MC-dropout sd and 95% interval, the uncertainty summary, the card's must-not list and its measured performance. 503 + Retry-After while the models load.

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: multipart/form-data

filefile | null

Errors specific to this call

409skin_classifier_not_enabled

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/patients/$MEMBER_REF/skin-classifications" \
  -H "Authorization: Bearer $TOKEN" \
  -F file="$FILE"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.post(
    f"{BASE}/v1/patients/{member_ref}/skin-classifications",
    headers={"Authorization": f"Bearer {TOKEN}"},
    data={"file": os.environ["FILE"]},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.
import { readFile } from "node:fs/promises";

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/patients/${encodeURIComponent(member_ref)}/skin-classifications`);
const form = new FormData();
form.append("file", process.env.FILE);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
  body: form,
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Generated from the Partner API router and developers_catalog.py. The router docstring is the source of each description.