Norvya DevelopersSolution
Med spas
Clearances before treatment, treatments and adverse events recorded from your booking system, re-treatment due dates, the aftercare photos members choose to share and the medical director's GLP-1 oversight roster.
- Credential model
- OAuth 2.0 client credentials for your organisation. Authentication
- Before production
- A BAA on file; the AI skin classifier stays off.
- Sandbox
- A medspa sandbox.
Families you'll use
| Family | Fit | Status |
|---|---|---|
| Events (webhooks) | Core | Built — gated |
| Med spas | Core | Built — gated |
| Dermatology | Useful | Built — gated |
| Enrolment & messaging | Useful | Built — gated |
Scopes to request
Ask only for what your product uses.
| Scope | Allows |
|---|---|
members.read | List the organisation's linked members as opaque member references. |
medspa.clearance.read | Read your practice's treatment-clearance intakes: the screen's flags with their reason and source, and the supervising provider's decision and expiry (treating practices that offer clearance, BAA on file). |
medspa.aftercare.read | Read aesthetic treatments with their aftercare check-in schedule and alerts, adverse events, and the retreatment-due list on your practice's own intervals (treating practices, BAA on file). |
medspa.aftercare.write | Record an aesthetic treatment (its aftercare check-ins are scheduled) and an adverse event for a patient of your practice (treating practices, BAA on file). |
medspa.photos.read | Read a patient's before / after photo timeline as metadata (view, phase, area, date, consent flags); image files are not served through the API (treating practices). |
medspa.glp1_oversight.read | Read your medical director's GLP-1 oversight roster: patients on a GLP-1 / GIP medicine whose medication data they share with you, the therapy as recorded, last injection logged, weight trend, latest labs, diabetes monitoring status and each finding with its verbatim FDA label citation (pending clinician sign-off); never a dose suggestion or a prescribing recommendation (treating practices, BAA on file). |
derm.read | Read a patient's tracked skin lesions (location, monitoring cadence, next recheck, and per photograph the date, the symptoms recorded and any biopsy result; size changes between photographs as image-based estimates; never the photograph and never the classifier's label or probabilities), your panel's lesion rechecks that are due, hidradenitis and acne severity history, patch tests with the allergen avoidance list, and the wound log (each wound's location and assessment dates, never its measurements) (treating practices with a BAA on file; lesions and wounds need the patient to share skin scans with you, severity and patch tests their medical history). |
members.invite | Invite people to join your organisation on Norvya (Norvya emails its own invitation in the person's language; never a pre-granted consent: the person chooses what to share in the app) and create printable join codes; follow each invitation to joined. Daily cap, de-duplicated per address, and the answer never says whether an address has an account. |
messages.write | Send a member a secure in-app message from your organisation (the conversation your staff use in Norvya); Norvya notifies them with its own generic wording, never your text. Members who turned messages off are refused. |
messages.read | Read your organisation's in-app conversation with a member, including their replies (audited as a disclosure). |
webhooks.manage | Register HTTPS webhook endpoints (payloads carry no PHI). Each event also needs its own scope: worklist / attention events clinical.panel.read, import events panel.import.write, population.export_completed population.export (medical practices only), member.at_risk fitness.roster.read, public_health.iis_ack_received public_health.immunizations.read, public_health.case_report_response public_health.case_reports.read. claims.import_completed needs claims.import.write (medical practices only). member.account_claimed needs members.claim_invite (medical practices only). hospital_at_home.escalation needs hospital_at_home.read (hospitals only). hospice.idg_review_due needs hospice.read (hospice agencies only). pharmacy.refill_due and pharmacy.discharge_episode_opened need pharmacy.patients.read; care_site.change_of_condition, care_site.incident_recorded and care_site.mar_exception need care_sites.read (pharmacies and care-facility operators, their own sites). travel.journey_updated and travel.leg_status_changed need travel.journeys.read, travel.nursing_visit_recorded travel.nursing.read, travel.invoice_issued travel.billing.read (medical-travel desks only). travel.inquiry_updated needs travel.inquiries.read, travel.journey_message_posted travel.messages.read (medical-travel desks only). instrument.batch_dispatched needs instruments.request (medical practices only). roster.enrolment_summary needs members.roster.read (medical practices only). older_adults.falls_tier_raised needs older_adults.read (medical practices only). employer.challenge_completed needs employer.challenges.read and occupational.exam_due occupational.read (employers only); medspa.adverse_event_reported needs medspa.aftercare.read (treating practices only). rehab.goal_met needs rehab.read; nutrition.caseload_flagged needs nutrition.read (medical practices only). cocm.review_due needs behavioral.read (medical practices only). derm.lesion_recheck_due and derm.patch_test_read_recorded need derm.read (medical practices only). |
Before production
Gate: A BAA on file; the AI skin classifier stays off.
Sandbox
Build and test against synthetic members before you touch real data. A medspa sandbox. What a sandbox holds, its credentials, limits, resets and expiry are in the Sandbox guide. To request one, write to [email protected] with your organisation and market.
Every endpoint for this market
The families this solution uses, filtered to the scopes it requests. Each link opens the endpoint on its family page.
Platform Built — gated3
- GET
/v1/members - POST
/v1/oauth/token - GET
/v1/usage
Enrolment & messaging Built — gated12
- GET
/v1/invites - POST
/v1/invites - GET
/v1/invites/{invite_ref} - POST
/v1/invites/{invite_ref}/revoke - POST
/v1/invites/{invite_ref}/simulate-join - GET
/v1/join-codes - POST
/v1/join-codes - POST
/v1/join-codes/{code_ref}/revoke - POST
/v1/join-codes/{code_ref}/simulate-join - GET
/v1/members/{member_ref}/messages - POST
/v1/members/{member_ref}/messages - POST
/v1/members/{member_ref}/messages/simulate-reply
Events (webhooks) Built — gated5
- GET
/v1/webhooks - POST
/v1/webhooks - DELETE
/v1/webhooks/{webhook_id} - GET
/v1/webhooks/{webhook_id}/deliveries - POST
/v1/webhooks/{webhook_id}/enable
Med spas Built — gated12
- GET
/v1/medspa/adverse-events - GET
/v1/medspa/adverse-events/{event_ref} - GET
/v1/medspa/clearances - GET
/v1/medspa/clearances/{clearance_ref} - GET
/v1/medspa/glp1-oversight - GET
/v1/medspa/glp1-oversight/{member_ref} - POST
/v1/medspa/members/{member_ref}/adverse-events - GET
/v1/medspa/members/{member_ref}/photos - GET
/v1/medspa/members/{member_ref}/treatments - POST
/v1/medspa/members/{member_ref}/treatments - GET
/v1/medspa/retreatment-due - GET
/v1/medspa/treatments/{treatment_ref}