Patient Portal API

The public, patient-facing API for Yakap MS. A patient signs in with their PhilHealth PIN and a password, then reads their own consultations, lab results, dental treatments, prescriptions and Konsulta benefit balances. Built for native mobile clients.

Getting started

Every endpoint lives under /api/public/portal. Sign in once to get an access token, then send it as Authorization: Bearer {token} on every request. There is no Sanctum session and no CSRF token — the whole surface is designed to be reachable from a native app.

Three things to get right before writing much code:

• Bearer, not cookies. The token comes back as data.token on login and is valid for 7 days. There is no refresh endpoint — on 401, sign in again.
• 10 requests per minute, per IP, shared across the entire public surface. Load lazily, per screen.
• 404 is not 401. A patient registered by the clinic has no registration record, so registration endpoints return 404 for them. Hide the feature; don't sign them out.