This API is not yet open to third-party clients. Authentication is a session cookie tied to a person's credentials, and cross-origin requests are admitted only from the CareTrack portal. There is no API key or client-credentials flow yet. These pages describe the API as deployed — talk to us before building against it.