GuideLab Docs
Smileline

Open an embedded screen

Records the actor's role and capabilities at its authority version (an older version is refused; the same one replays), creates or updates the patient for a new order, and returns a URL whose fragment holds a single-use code valid for 60 seconds. The page trades it for a 2-hour session bound to one patient and lab (new_order, resuming that user's latest draft), one submitted order (order) or one lab's finance pages (billing, acting as the practice limited by the capabilities). parentOrigin must be one of the cell's app origins; it is the only origin the page posts messages to.

POST
/smileline/v1/embed-sessions

Records the actor's role and capabilities at its authority version (an older version is refused; the same one replays), creates or updates the patient for a new order, and returns a URL whose fragment holds a single-use code valid for 60 seconds. The page trades it for a 2-hour session bound to one patient and lab (new_order, resuming that user's latest draft), one submitted order (order) or one lab's finance pages (billing, acting as the practice limited by the capabilities). parentOrigin must be one of the cell's app origins; it is the only origin the page posts messages to.

Authorization

smilelineBearer
AuthorizationBearer <token>

Smileline cell credential gl_sl_v1_<cell>_<secret>, one per Smileline cell; accepted only on /smileline/v1. A practice belongs to one cell and is not found from any other.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/smileline/v1/embed-sessions" \  -H "Content-Type: application/json" \  -d '{    "practiceRef": "string",    "actor": {      "userRef": "string",      "name": "string",      "role": "admin"    },    "capabilities": {      "submitOrders": true,      "viewInvoices": true,      "payInvoices": true    },    "authorityVersion": 0,    "purpose": "new_order",    "parentOrigin": "http://example.com",    "locale": "string"  }'
{  "url": "http://example.com",  "expiresAt": "string"}
{  "error": "string",  "code": "string"}
Empty
{  "error": "string",  "code": "string"}
{  "error": "string",  "code": "string"}
{  "error": "string",  "code": "string"}
Empty

Close a practice POST

Ends every hidden membership and refuses later profile, member, patient and file writes. Orders, files and partnerships stay for the labs' records; patient erasure still works. Idempotent.

Decline a lab's invitation POST

Declines a pending invitation; the same practice's replay answers as before.