> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Introduction

> REST API for EHR integrations, clearinghouses, and custom automations.

The Denialbase API is organized around REST. Requests accept JSON-encoded bodies, return JSON-encoded responses, and use standard HTTP status codes, authentication, and verbs.

## Base URL

<CodeGroup>
  ```text Production theme={null}
  https://api.denialbase.com/api/v1
  ```

  ```text Staging theme={null}
  https://api.staging.denialbase.com/api/v1
  ```
</CodeGroup>

## Authentication

Denialbase uses **httpOnly cookie-based JWT** authentication. See [Authentication](/api-reference/authentication) for the full flow.

<Warning>
  Never use `localStorage` or Bearer tokens from client-side JavaScript — all session cookies are `httpOnly` and `Secure`. If you need programmatic access outside a browser, see [API tokens](/api-reference/authentication#api-tokens).
</Warning>

## Supported authentication factors

* Password (12+ chars, zxcvbn score ≥ 3)
* TOTP (RFC 6238)
* Passkeys (WebAuthn / FIDO2)
* Magic links (email-based, short TTL)
* Google OAuth 2.1

## Rate limits

| Endpoint group    | Limit                     |
| ----------------- | ------------------------- |
| Auth (login, 2FA) | 5 req / 20 s per IP       |
| Read endpoints    | 300 req / minute per user |
| Write endpoints   | 60 req / minute per user  |
| File uploads      | 30 req / minute per user  |

Rate limits are enforced by Rack::Attack backed by Memorystore Redis and return `429 Too Many Requests` with a `Retry-After` header. See [Rate Limits](/api-reference/rate-limits) for more detail.

## Versioning

The API is versioned via URL prefix (`/api/v1`). Breaking changes ship as a new version; non-breaking additions (new fields, new endpoints) are added to the current version without a new URL.

## SDKs

We don't publish official SDKs yet. The OpenAPI spec is available at [`openapi.yaml`](https://trust.denialbase.com/api-reference/openapi.yaml) — use it to generate a client in your language of choice.

## Errors

Denialbase uses conventional HTTP response codes:

| Code | Meaning                                            |
| ---- | -------------------------------------------------- |
| 200  | OK                                                 |
| 201  | Created                                            |
| 204  | No Content                                         |
| 400  | Bad Request — malformed or missing required fields |
| 401  | Unauthorized — missing or invalid authentication   |
| 403  | Forbidden — authenticated but not authorized       |
| 404  | Not Found                                          |
| 422  | Unprocessable Entity — validation failed           |
| 429  | Too Many Requests — rate limit hit                 |
| 5xx  | Server error — we're on it                         |