API Reference on Novaza Docs

API Authentication

Mon, 01 Jan 0001 00:00:00 +0000

API Authentication#

All Novaza API requests must be authenticated with a JWT access token issued by Novaza SSO at id.novaza.ai. The token is carried in the Authorization: Bearer <token> header on every request to the Novaza Gateway (api.novaza.ai).

Individual products (Office, Desk, Pulse) are served from their own domains and accept access tokens obtained through the same Novaza SSO authorization flow, with a product-scoped audience.

Overview#

A user signs in at id.novaza.ai (directly or via an OAuth2 authorization redirect from your application).
Novaza SSO issues a JWT access token (short-lived) and refresh token (longer-lived).
Your client calls https://api.novaza.ai/... with Authorization: Bearer <access_token>.
When the access token expires, exchange the refresh token for a new access token at the SSO token endpoint.

OAuth2 Authorization Code Flow#

Use this flow for user-facing third-party applications that act on behalf of a signed-in Novaza user.

Office API

Mon, 01 Jan 0001 00:00:00 +0000

Office API#

Novaza Office exposes a REST API for programmatic access to namespaces, modules, records, workflows, and pages. The API is served directly by the Office product at https://office.novaza.ai and is not proxied through the Novaza Platform Gateway.

Access and Authentication#

Because the Office API is served by the product directly, it has its own authentication handshake that is separate from the Platform Gateway at api.novaza.ai. Clients must obtain an Office access token before calling Office API endpoints.

Platform Gateway API

Mon, 01 Jan 0001 00:00:00 +0000

Platform Gateway API#

The Novaza Gateway at api.novaza.ai exposes platform-level endpoints that are shared across products: medical imaging, clinical messaging (HL7), AI services, billing, and workspace administration. All endpoints accept a JWT access token issued by Novaza SSO and apply per-tenant rate limiting.

See API Authentication for how to obtain a token.

Base URL#

https://api.novaza.ai

Common Headers#

Header	Description
`Authorization: Bearer <jwt>`	Required on all endpoints except `/health`, `/health/ready`, and `/metrics`
`X-Tenant-ID`	Optional override used on service-to-service calls; the tenant is otherwise resolved from the JWT
`X-API-Version`	Returned by the gateway on every response (currently `1.0`)
`X-Request-Id`	Returned by the gateway for log correlation

Platform Endpoints#

Health & Metrics (public)#

Method	Path	Description
`GET`	`/health`	Liveness probe
`GET`	`/health/ready`	Readiness probe (checks downstream services)
`GET`	`/metrics`	Prometheus metrics

Medical Imaging#

Requires the medical_imaging add-on on the tenant.

Desk API

Mon, 01 Jan 0001 00:00:00 +0000

Desk API#

Novaza Desk exposes a REST API for contacts, conversations, messages, and tickets. The API is served by the Desk product directly at https://desk.novaza.ai and is not proxied through the Novaza Platform Gateway.

Access and Authentication#

Because the Desk API is served by the product directly, it has its own authentication handshake that is separate from the Platform Gateway at api.novaza.ai. Clients must obtain a Desk access token before calling Desk API endpoints.

Pulse API

Mon, 01 Jan 0001 00:00:00 +0000

Pulse API#

Novaza Pulse exposes a REST API for subscribers, lists, templates, campaigns, and transactional email. The API is served by the Pulse product directly at https://pulse.novaza.ai and is not proxied through the Novaza Platform Gateway.

Access and Authentication#

Because the Pulse API is served by the product directly, it has its own authentication handshake that is separate from the Platform Gateway at api.novaza.ai. Clients must obtain a Pulse access token before calling Pulse API endpoints.

Webhooks

Mon, 01 Jan 0001 00:00:00 +0000

Webhooks#

Webhooks allow Novaza products to push real-time event notifications to external systems or to the Novaza Middleware. Today, Novaza supports inbound webhooks (receiving events into the Novaza Middleware from connected products) and product-scoped outbound event forwarding. A single unified outbound webhook bus with Novaza-branded headers is planned and not yet available.

Inbound Webhooks (available today)#

The Novaza Middleware exposes dedicated webhook endpoints that accept events from specific Novaza products. These are intended for internal platform integration and are authenticated per source.