API reference · Specialty practices

Nutrition (dietitians)

Built — gated15 endpoints · 1 webhook event · OpenAPI tag nutrition

For dietitians and nutrition professionals: the caseload with lapse flags, a patient's food-log review, targets and meal rules released to the patient, ADIME notes, and Medical Nutrition Therapy hours with superbill candidates for the biller's review (never a charge). Webhook: nutrition.caseload_flagged.

Who calls it: Core for Rehab & nutrition practices
Before production: Treating practices; the patient must share nutrition with you.
Sandbox: Build against synthetic members first. What each sandbox holds
Standards: ADIME notes; Medical Nutrition Therapy hours

Markets that use this family

Rehab & nutrition practices (core)

Scopes

Scope	Allows
`nutrition.mnt.read`	Read a patient's Medicare MNT referrals, recorded visits and hours next to the rule text, and superbill candidates for your biller as JSON: the codes and units your dietitian recorded, never a code Norvya chose, never submitted, not a coverage decision (treating practices only).
`nutrition.read`	Read your dietitians' caseload (Norvya-convention flags), a patient's dietitian nutrition targets, food rules and meals, the food-log review against targets (only when the patient shares nutrition; unlogged days are unknown, never missed) and structured MNT visit notes (treating practices only).
`nutrition.write`	Act for a named dietitian of your practice: set or release nutrition targets the app then holds the patient to, add or end food rules, set or release RD meals, write a structured MNT visit note (treating practices only).

Endpoints

Your practice's dietitians (and providers) as staff_ref values

GET/v1/nutrition/staffnutrition.read

The active staff a nutrition write may name (role admin, provider or dietitian), with role and display name. Staff names are not patient data.

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/staff" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]

resp = requests.get(
    BASE + "/v1/nutrition/staff",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const url = new URL(`${BASE}/v1/nutrition/staff`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Your dietitians' caseload

GET/v1/nutrition/caseloadnutrition.read

dietitian_practice.caseload: each active member with whether they share nutrition, target status (set here / elsewhere / none), the next visit date, last logged date, logged days in 14 and flags (never_logged, no_logs_7d, off_target_14d). The thresholds are NORVYA CONVENTIONS, not clinical guidelines (`conventions`). No flag or log date for a member who does not share nutrition. ?member_ref= narrows to one (the nutrition.caseload_flagged event's resource_url).

Parameters

member_refquery · string | null

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/caseload" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]

resp = requests.get(
    BASE + "/v1/nutrition/caseload",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const url = new URL(`${BASE}/v1/nutrition/caseload`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

The food-log review against targets (the dietitian's view)

GET/v1/nutrition/patients/{member_ref}/reviewnutrition.read

dietitian_practice.client_review: days logged and NOT logged (unknown, never missed or non-adherent), daily totals, averages over logged days only, days within +/-10 % of each target with the target's source, sodium / potassium with how many items carried a value, water (only when the patient shares daily logs) and context (conditions / medications, each under its own sharing switch). The patient must share nutrition (409 nutrition_not_shared).

Parameters

member_refpath · stringrequired

daysquery · integer

7 | 14 | 30

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/review" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/review",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/review`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

A patient's dietitian nutrition targets

GET/v1/nutrition/patients/{member_ref}/targetsnutrition.read

The active targets (which Norvya holds the patient's plan to while they are in force), whether your practice set them, your practice's history with the guardrail findings the dietitian saw, and the bounds.

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/targets" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/targets",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/targets`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Set nutrition targets for a named dietitian

PUT/v1/nutrition/patients/{member_ref}/targetsnutrition.write

dietitian_practice.set_targets: the values lock onto the patient's plan; DRI / AMDR guardrail findings are RETURNED (guardrail_issues), never clamped. Targets another practice set are 409 targets_set_by_another_practice. The patient gets Norvya's generic in-app notice.

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

caloriesnumber | null

protein_gnumber | null

carbs_gnumber | null

fat_gnumber | null

fiber_gnumber | null

water_oznumber | null

sodium_mg_limitnumber | null

potassium_mgnumber | null

potassium_modestring | null

limit | goal (required with potassium_mg)

training_day_caloriesnumber | null

Training-day value. Any training_day_* / rest_day_* value turns the patient's macro schedule on with your values (a missing one falls back to the flat value).

training_day_protein_gnumber | null

training_day_carbs_gnumber | null

training_day_fat_gnumber | null

rest_day_caloriesnumber | null

Rest-day value.

rest_day_protein_gnumber | null

rest_day_carbs_gnumber | null

rest_day_fat_gnumber | null

post_session_protein_gnumber | null

Protein (g) within post_session_window_h hours after a session; needs the window.

post_session_window_hnumber | null

Hours after a session (0.25-12). Alone, the patient's per-sitting protein threshold is the amount.

pre_session_protein_gnumber | null

Protein (g) within pre_session_window_h hours before a session; needs the window.

pre_session_window_hnumber | null

Hours before a session (0.25-12).

patient_notestring | null

Shown to the patient in Norvya.

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X PUT "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/targets" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "calories": 0.0,
    "protein_g": 0.0,
    "carbs_g": 0.0,
    "fat_g": 0.0,
    "fiber_g": 0.0,
    "water_oz": 0.0,
    "sodium_mg_limit": 0.0,
    "potassium_mg": 0.0,
    "potassium_mode": "string",
    "training_day_calories": 0.0,
    "training_day_protein_g": 0.0,
    "training_day_carbs_g": 0.0,
    "training_day_fat_g": 0.0,
    "rest_day_calories": 0.0,
    "rest_day_protein_g": 0.0,
    "rest_day_carbs_g": 0.0,
    "rest_day_fat_g": 0.0,
    "post_session_protein_g": 0.0,
    "post_session_window_h": 0.0,
    "pre_session_protein_g": 0.0,
    "pre_session_window_h": 0.0,
    "patient_note": "string"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.put(
    f"{BASE}/v1/nutrition/patients/{member_ref}/targets",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
        "calories": 0.0,
        "protein_g": 0.0,
        "carbs_g": 0.0,
        "fat_g": 0.0,
        "fiber_g": 0.0,
        "water_oz": 0.0,
        "sodium_mg_limit": 0.0,
        "potassium_mg": 0.0,
        "potassium_mode": "string",
        "training_day_calories": 0.0,
        "training_day_protein_g": 0.0,
        "training_day_carbs_g": 0.0,
        "training_day_fat_g": 0.0,
        "rest_day_calories": 0.0,
        "rest_day_protein_g": 0.0,
        "rest_day_carbs_g": 0.0,
        "rest_day_fat_g": 0.0,
        "post_session_protein_g": 0.0,
        "post_session_window_h": 0.0,
        "pre_session_protein_g": 0.0,
        "pre_session_window_h": 0.0,
        "patient_note": "string",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/targets`);

const res = await fetch(url, {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "calories": 0.0,
    "protein_g": 0.0,
    "carbs_g": 0.0,
    "fat_g": 0.0,
    "fiber_g": 0.0,
    "water_oz": 0.0,
    "sodium_mg_limit": 0.0,
    "potassium_mg": 0.0,
    "potassium_mode": "string",
    "training_day_calories": 0.0,
    "training_day_protein_g": 0.0,
    "training_day_carbs_g": 0.0,
    "training_day_fat_g": 0.0,
    "rest_day_calories": 0.0,
    "rest_day_protein_g": 0.0,
    "rest_day_carbs_g": 0.0,
    "rest_day_fat_g": 0.0,
    "post_session_protein_g": 0.0,
    "post_session_window_h": 0.0,
    "pre_session_protein_g": 0.0,
    "pre_session_window_h": 0.0,
    "patient_note": "string"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Release the targets your practice set

POST/v1/nutrition/patients/{member_ref}/targets/releasenutrition.write

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/targets/release" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.post(
    f"{BASE}/v1/nutrition/patients/{member_ref}/targets/release",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/targets/release`);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

A patient's dietitian food rules and RD meals

GET/v1/nutrition/patients/{member_ref}/meal-rulesnutrition.read

Avoid / limit food rules and the meals a dietitian pinned, which the patient's generated plans are held to (matching by name: `matching` states its limits).

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/meal-rules" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/meal-rules",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/meal-rules`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Add an avoid / limit food rule

POST/v1/nutrition/patients/{member_ref}/meal-rules/rulesnutrition.write

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

kindstringrequired

avoid | limit

termstringrequired

max_per_dayinteger | null

max_per_weekinteger | null

patient_notestring | null

All responses

201Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/meal-rules/rules" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "kind": "string",
    "term": "string",
    "max_per_day": 0,
    "max_per_week": 0,
    "patient_note": "string"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.post(
    f"{BASE}/v1/nutrition/patients/{member_ref}/meal-rules/rules",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
        "kind": "string",
        "term": "string",
        "max_per_day": 0,
        "max_per_week": 0,
        "patient_note": "string",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/meal-rules/rules`);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "kind": "string",
    "term": "string",
    "max_per_day": 0,
    "max_per_week": 0,
    "patient_note": "string"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

End a food rule your practice set

POST/v1/nutrition/patients/{member_ref}/meal-rules/rules/{rule_ref}/endnutrition.write

Parameters

member_refpath · stringrequired

rule_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/meal-rules/rules/$RULE_REF/end" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]
rule_ref = os.environ["RULE_REF"]

resp = requests.post(
    f"{BASE}/v1/nutrition/patients/{member_ref}/meal-rules/rules/{rule_ref}/end",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const rule_ref = process.env.RULE_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/meal-rules/rules/${encodeURIComponent(rule_ref)}/end`);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Set the dietitian's meals (replaces your practice's active set)

PUT/v1/nutrition/patients/{member_ref}/meal-rules/meal-plannutrition.write

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

entriesarray of objectrequired

{day (monday..sunday | every_day), slot, food_name, calories?, protein_g?, carbs_g?, fat_g?, ingredients?}

patient_notestring | null

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X PUT "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/meal-rules/meal-plan" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "entries": [
      {}
    ],
    "patient_note": "string"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.put(
    f"{BASE}/v1/nutrition/patients/{member_ref}/meal-rules/meal-plan",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
        "entries": [
            {},
        ],
        "patient_note": "string",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/meal-rules/meal-plan`);

const res = await fetch(url, {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "entries": [
      {}
    ],
    "patient_note": "string"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Release your practice's dietitian meals

POST/v1/nutrition/patients/{member_ref}/meal-rules/meal-plan/releasenutrition.write

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/meal-rules/meal-plan/release" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.post(
    f"{BASE}/v1/nutrition/patients/{member_ref}/meal-rules/meal-plan/release",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/meal-rules/meal-plan/release`);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b"
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Your practice's structured MNT visit notes (ADIME)

GET/v1/nutrition/patients/{member_ref}/notesnutrition.read

The four Nutrition Care Process sections as free text (Norvya ships no NCPT code list), draft or final, author as staff_ref.

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/notes" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/notes",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/notes`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Write a structured MNT visit note for a named dietitian

POST/v1/nutrition/patients/{member_ref}/notesnutrition.write

dietitian_practice.create_note: stored as the practice's clinic note (not visible to the patient), the targets in force appended; finalize signs it.

Parameters

member_refpath · stringrequired

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Request body

Content type: application/json (required)

clinicianstringrequired

staff_ref of the clinician who decided this (rehab: GET /v1/panel/clinicians; nutrition: GET /v1/nutrition/staff).

assessmentstring | null

diagnosisstring | null

interventionstring | null

monitoring_evaluationstring | null

titlestring | null

follow_up_timeframestring | null

finalizeboolean

All responses

201Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s -X POST "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/notes" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "assessment": "string",
    "diagnosis": "string",
    "intervention": "string",
    "monitoring_evaluation": "string",
    "title": "string",
    "follow_up_timeframe": "string",
    "finalize": false
  }'

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.post(
    f"{BASE}/v1/nutrition/patients/{member_ref}/notes",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={
        "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
        "assessment": "string",
        "diagnosis": "string",
        "intervention": "string",
        "monitoring_evaluation": "string",
        "title": "string",
        "follow_up_timeframe": "string",
        "finalize": False,
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/notes`);

const res = await fetch(url, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "clinician": "stf_4c1d2e3f4a5b6c7d8e9f0a1b",
    "assessment": "string",
    "diagnosis": "string",
    "intervention": "string",
    "monitoring_evaluation": "string",
    "title": "string",
    "follow_up_timeframe": "string",
    "finalize": false
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Medicare MNT referrals, recorded visits and hours vs the rule text

GET/v1/nutrition/patients/{member_ref}/mntnutrition.mnt.read

dietitian_billing.hours_summary for one calendar year: the referrals your practice recorded, the visits with the code and units YOUR dietitian recorded (each status candidate_for_biller_review), hours recorded vs the hours in the rule text (NCD 180.1, quoted in rule_text), flags and caveats. Never a coverage decision; hours billed by another practice are not visible to Norvya.

Parameters

member_refpath · stringrequired

yearquery · integer | null

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/mnt" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/mnt",
    headers={"Authorization": f"Bearer {TOKEN}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/mnt`);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

A superbill candidate for your biller (JSON; never submitted)

GET/v1/nutrition/patients/{member_ref}/mnt/superbill-candidatesnutrition.mnt.read

dietitian_billing.build_claim_snapshot for the chosen recorded visits (the same snapshot the staff superbill prints): practice block, referring provider, diagnoses with pointers, service lines with the code and units the dietitian recorded, rendering clinician (staff_ref + NPI), charges, and missing_fields your biller must complete. The patient identity block is left out (you hold the patient's identity under your own record). status candidate_for_biller_review: Norvya never submits it, never picks a code and makes no coverage decision. Audited as a PHI export before it is returned (503 when the audit log is down).

Parameters

member_refpath · stringrequired

visit_refsquery · stringrequired

Comma-separated visit_ref values (max 60).

EMR vendors also pass vendor (the practice) with a vendor-issued token. EMR vendor tokens

Errors specific to this call

503when

All responses

200Successful Response401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity429Too Many Requests503Service Unavailable

Codes every call can return are in Errors & limits.

curl -s "https://norvya.fly.dev/v1/nutrition/patients/$MEMBER_REF/mnt/superbill-candidates?visit_refs=$VISIT_REFS" \
  -H "Authorization: Bearer $TOKEN"

import os

import requests

BASE = "https://norvya.fly.dev"
TOKEN = os.environ["TOKEN"]
member_ref = os.environ["MEMBER_REF"]

resp = requests.get(
    f"{BASE}/v1/nutrition/patients/{member_ref}/mnt/superbill-candidates",
    headers={"Authorization": f"Bearer {TOKEN}"},
    params={"visit_refs": os.environ["VISIT_REFS"]},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

// Node.js 18+ (ES module). Keep production credentials on your server.

const BASE = "https://norvya.fly.dev";
const member_ref = process.env.MEMBER_REF;
const url = new URL(`${BASE}/v1/nutrition/patients/${encodeURIComponent(member_ref)}/mnt/superbill-candidates`);
url.searchParams.set("visit_refs", process.env.VISIT_REFS);

const res = await fetch(url, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.TOKEN}`,
  },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log(await res.json());

Webhook events

Payloads carry no health data, only a reference to fetch with your token. Each event needs its scope as well as webhooks.manage. Signing and retries

Event	Scope	When
`nutrition.caseload_flagged`	`nutrition.read`	A member of the dietitian caseload carries a caseload flag: no food logged for 7 days, or 14-day calories outside 10 % of the target (Norvya conventions, not clinical guidelines).

Generated from the Partner API router and developers_catalog.py. The router docstring is the source of each description.