Use the TypeScript SDK as a thin transport over the protocol.

Install

Get the client package.

The TypeScript SDK is real and current — it is the same client OpenDoc's own surfaces use. It is not yet on the public npm registry: registry publication opens with the first design-partner wave. Until then, request the package at [email protected] when you create a sandbox key.

# Opening with first partners (public npm registry):
npm install @opendoc/sdk

Public discovery

Search and browse without auth.

Public endpoints work without an agent token or identity session. Use them for provider/service discovery, route exploration, and capability detection.

import { OpenDocClient } from "@opendoc/sdk";

const client = new OpenDocClient({
  baseUrl: "https://api.opendoc.com",
});

const protocol = await client.protocol();
console.log(protocol.version);
console.log(protocol.tools.length);

const { data } = await client.search({
  q: "knee MRI",
  geo: "us-GA",
  limit: 10,
});

for (const result of data) {
  console.log(result.providerName, result.cashPriceCents);
}

Delegated calls

Add an agent token when acting for a patient or provider.

Agent tokens are OpenDoc-issued delegated authority. They are not generic API keys; each token has a subject, permissions, expiry, data tier, ecosystem identity, and optional spending limits.

const client = new OpenDocClient({
  baseUrl: "https://api.opendoc.com",
  agentToken: process.env.OPENDOC_AGENT_TOKEN,
});

const { data: intent } = await client.declareIntent({
  providerHsoId: "00000000-0000-4000-8000-000000000001",
  availabilitySlotId: "00000000-0000-4000-8000-000000000002",
  idempotencyKey: "partner-order-123-declare",
});

await client.authorize(intent.transactionId, "partner-order-123-authorize");
await client.acceptTerms(intent.transactionId, "partner-order-123-terms");
await client.commit(intent.transactionId, "partner-order-123-commit");

Webhooks

Verify signatures with the SDK helper.

Read the raw body before parsing JSON. OpenDoc signs the raw request body using HMAC-SHA256 and sends the hex digest in x-opendoc-signature.

import { verifyWebhookSignature } from "@opendoc/sdk/webhooks";

const rawBody = await request.text();
const ok = await verifyWebhookSignature({
  rawBody,
  signatureHeader: request.headers.get("x-opendoc-signature"),
  signingSecret: process.env.OPENDOC_WEBHOOK_SECRET,
  toleranceSeconds: 300,
});

if (!ok) {
  return new Response("bad signature", { status: 401 });
}

const event = JSON.parse(rawBody);

Boundaries

The SDK does not bypass the protocol.