EnrollPilot API

A read-only REST API for your organization's credentialing data. Sync your roster into an HR system, build enrollment dashboards in your BI tool, or feed compliance tooling with expiration dates.

What the API gives you

Every request is authenticated by an organization API key and scoped to the organization that owns that key. There is no way to reach another organization's data with your key, and the key never widens beyond the scopes you granted it when you created it.

Resource	Scope	What it returns
`GET /providers`	`providers:read`	Provider roster with specialties, contact details, group memberships and identifiers
`GET /provider-groups`	`groups:read`	Groups with service locations and group identifiers
`GET /enrollments`	`enrollments:read`	Provider enrollment cases with status, requirements checklist and lines of business
`GET /group-enrollments`	`enrollments:read`	Group level payer contracts
`GET /expirables`	`providers:read`	Credentials and documents approaching expiration
`GET /documents`	`documents:read`	Document metadata only, never file contents

What the API does not do

No writes. Version 1 is GET only; every other method returns 405.
No file downloads or presigned URLs. Documents expose metadata only.
No webhooks. Poll with updated_since instead.
No Social Security numbers, payer portal logins, or internal notes. Those are excluded at every scope and cannot be unlocked.
No browser access. The API sends no CORS headers on purpose, because calling it from front-end code would expose your key.

Quickstart

1. Create a key

In EnrollPilot, open Admin, then Organization, then API keys. Any organization admin can create a key. Give it a name that says where it runs, select the scopes it needs, and copy the key from the dialog. The raw key is shown once and never again.

2. Call the API

Send the key as a bearer token. The base URL is https://app.enrollpilot.com/api/v1.

curl -sS "https://app.enrollpilot.com/api/v1/providers?limit=2" \
  -H "Authorization: Bearer epk_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

3. Read the envelope

List endpoints answer with data and nextCursor. Detail endpoints answer with data alone. Dates are ISO 8601 strings in UTC.

{
  "data": [
    {
      "id": "clv2h9c1k0001abcd1234efgh",
      "name": "Jordan Reyes",
      "npi": "1234567890",
      "isActive": true,
      "specialty": "Family Medicine",
      "groupMemberships": [
        { "providerGroupId": "clv2h9c1k0002abcd", "name": "Northside Family Care", "npi": "9876543210", "tin": "12-3456789" }
      ],
      "createdAt": "2026-01-14T16:02:11.482Z",
      "updatedAt": "2026-07-19T13:44:02.115Z"
    }
  ],
  "nextCursor": "MjAyNi0wNy0xOVQxMzo0NDowMi4xMTVafGNsdjJoOWMxazAwMDFhYmNk"
}

Failures use a single envelope with a stable machine readable code.

{
  "error": {
    "code": "insufficient_scope",
    "message": "This key is missing the required scope: documents:read."
  }
}

Keep your key server side

An API key carries your organization's data with no further login. Store it in your deployment's secret manager, never in a repository, a browser bundle, or a shared spreadsheet. If a key is exposed, revoke it in the console; revocation takes effect on the next request.

Where to go next

Authentication and scopes for the key format and what each scope unlocks.
Pagination and sync for walking a full list and polling for changes.
Errors and rate limits for every status code the API can return.
API reference for the full field list of every response.