SmileCloud Public API
The SmileCloud Public API is the single internet-facing surface for clinic integrations. It exposes three coordinated surfaces over one curated, versioned read contract - REST for scripts, webhooks for push, and MCP for AI agents - all authenticated with a per-clinic key.
v1 is read-first
Every endpoint reads clinic data - patients, appointments, availability, treatments, payments, and catalog - with three deliberate exceptions: managing your own webhook subscriptions, recording a payment (scope payments:write, granted explicitly), and capturing a lead (scope leads:write).
#Choose your surface
Plain HTTPS + JSON for clinic IT and scripts. Cursor pagination, predictable errors, an OpenAPI spec.
Subscribe to appointment, patient, treatment, and payment events. Signed, retried, at-least-once delivery.
A Model Context Protocol server so AI agents can read clinic data over the same contract, with the same key.
The sc CLI wraps the REST surface for the terminal - for clinic IT, scripts, and agents.
#How it works
Authenticate every request with a per-clinic secret key as a bearer token. The key identifies your clinic and carries a set of scopes that gate which data it can read.
curl https://api.smile-app.co.il/v1/catalog/branches \
-H "Authorization: Bearer sk_live_..."
{
"data": [
{ "id": "1", "name": "Downtown Branch", "phone": "+972-3-555-0100", "color": "#4f46e5" },
{ "id": "2", "name": "North Branch", "phone": "+972-4-555-0200", "color": "#16a34a" }
]
}
The API holds no domain logic and no direct database access. Every read is a thin, authenticated forward to SmileCloud's backend, which returns a small, stable, versioned schema. That means the shapes you see here are intentionally compact and safe to depend on.
#Base URL
All requests go to the production host over HTTPS:
https://api.smile-app.co.il
Endpoints are versioned under /v1. We will never make breaking changes to /v1 - new fields may be added, but existing fields will not be removed or repurposed.