API Reference

Comprehensive reference for all Payload CMS collections and globals endpoints.

Base URL

Development: https://dev-api.picoshealth.com/v1
Production: https://api.picoshealth.com/v1

Authentication

All endpoints require a Bearer JWT token:

Authorization: Bearer YOUR_JWT_TOKEN

##s (24)

Users

Endpoint: GET/POST /api/users

Field	Type	Description
email	string	User email address
password	string	Hashed password
role	string	admin, provider, patient
firstName	string	First name
lastName	string	Last name

Create User:

POST /api/users
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "SecurePass123",
  "role": "patient",
  "firstName": "John",
  "lastName": "Doe"
}

Products

Endpoint: GET/POST /api/products

Field	Type	Description
title	string	Product name
price	number	Price in USD
sku	string	Stock keeping unit
hcpcs_code	array	Medical procedure codes
status	string	draft, published, archived

Orders

Endpoint: GET/POST /api/orders

Field	Type	Description
customer	ID	Customer user ID
line_items	array	Items in order
total	number	Order total
status	string	pending, approved, shipped, delivered, cancelled

Transactions

Endpoint: GET/POST /api/transactions

Field	Type	Description
user	ID	User ID
type	string	charge, credit, refund
amount	number	Transaction amount
status	string	completed, pending, failed

Patients

Endpoint: GET/POST /api/patients

Field	Type	Description
user	ID	Associated user ID
dateOfBirth	date	Date of birth
medicalConditions	array	Health conditions
medications	array	Current medications

Messages

Endpoint: GET/POST /api/messages

Field	Type	Description
subject	string	Message subject
body	string	Message content (HTML)
from_user	ID	Sender user ID
to_user	ID	Recipient user ID
read	boolean	Read status

My CareList

Endpoint: GET/POST /api/my-care-list

Field	Type	Description
title	string	Care list name
owner	ID	Owner user ID
items	array	Care list items
spendingLimits	array	Budget limits

Payment Methods

Endpoint: GET/POST /api/payment-methods

Field	Type	Description
user	ID	User ID
type	string	credit_card, bank_account
last4	string	Last 4 digits
isDefault	boolean	Default payment method

Others

Groups - User grouping/teams
Media - File uploads and storage
Documents - File management
Overseers - Care supervision relationships
Fulfillment - Order shipping/tracking
Invites - User invitations
Members - Organization members
ProductCategories - Product categorization
ProductTags - Product tagging
ProductFavorites - Saved products
CheckoutSessions - Payment sessions
OrdersActivityFeed - Order history
TransactionLogs - Financial audit trail
UserPermissionsConfig - Permission settings
WalletBalance - Account balances
OrderAggregations - Analytics data

Globals (9)

SiteSettings

Endpoint: GET/POST /globals/site-settings

Global site configuration including brand name, contact information, and business hours.

OrganizationSettings

Endpoint: GET/POST /globals/organization-settings

Organization-wide settings including tier, max users, feature flags, and network summary.

MessageSettings

Endpoint: GET/POST /globals/message-settings

Messaging system configuration for email, SMS, and push notifications.

Wallet

Endpoint: GET/POST /globals/wallet

Wallet and payment system configuration including auto-charge settings and fees.

HCPCSFinder

Endpoint: GET /globals/hcpcs-finder

Index of medical procedure codes for product lookups.

SKUFinder

Endpoint: GET /globals/sku-finder

Index of SKUs for product lookups.

GlobalOrgDashboard

Endpoint: GET/POST /globals/organization

Organization dashboard configuration and summary metrics.

GlobalStorefrontHomepage

Endpoint: GET/POST /globals/storefront-homepage

Homepage configuration for the storefront.

GlobalFormularySettings

Endpoint: GET/POST /globals/formulary-settings

Formulary and product display settings.

HTTP Methods

Method	Purpose
GET	Retrieve documents
POST	Create new documents or update globals
PATCH	Update existing documents
DELETE	Delete documents

Query Parameters

Parameter	Type	Example
limit	number	?limit=50
page	number	?page=1
sort	string	?sort=-createdAt
where	JSON	?where={"status":{"equals":"published"}}
depth	number	?depth=2
locale	string	?locale=en

Status Codes

Code	Meaning
200	OK - Request successful
201	Created - Resource created
400	Bad Request - Invalid parameters
401	Unauthorized - Missing/invalid token
403	Forbidden - Insufficient permissions
404	Not Found - Resource doesn't exist
429	Too Many Requests - Rate limited
500	Internal Server Error

Rate Limiting

Limit: 100 requests per minute
Headers: Check X-RateLimit-Remaining header
Backoff: Use exponential backoff for retries

Webhooks

Webhooks are sent for collection events:

collection.create - New document created
collection.update - Document updated
collection.delete - Document deleted

Last Updated: June 22, 2026