• A signed pilot or production agreement with Curably Nigeria Ltd (RC 8801984)
• An organization admin email with MFA enabled (required for webhook and API key management)
• HTTPS callback endpoint if you plan to receive webhooks
• For EHR integrations: FHIR R4 base URL and OAuth endpoints (see EHR integration)

1. Submit the Request access form with your organization type (HMO, hospital, pharmacy, NGO, regulator).
2. Curably provisions a sandbox org, service credentials, and a dedicated integration contact within 2–5 business days.
3. You receive: organization ID, admin invite link, sandbox API base URL, and optional HMAC secret for pharmacy rails.

Organization admins complete onboarding in the provider or HMO workspace. Under the hood, org bootstrap creates isolated data partitions, default RBAC roles, and audit logging.

1. Accept the admin invitation and enable MFA on first sign-in.
2. Complete org profile: legal name, registration number, primary facility locations, and payer relationships.
3. Invite team members with least-privilege roles (see RBAC & organizations).
4. Register a webhook URL under Admin → Integrations (optional).

Server-to-server integrations use organization API keys. Staff workspace calls (consent capture at intake, records, verifications) use the signed-in team member's session JWT in the Authorization header.

curl -X GET "https://api.letscura.com/api/consents?org_id=ORG_ID&subject_cura_id=CURA-XXXX" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

Pharmacy network integrations that push e-prescriptions use HMAC signing with X-Cura-Signature: sha256=<hex> — see Pharmacy API.

Record a patient verification event after identity check at intake. This anchors downstream encounter validation and claims pre-checks.

{
  "org_id": "your-org-uuid",
  "subject_cura_id": "CURA-XXXX",
  "outcome": "verified",
  "reason": "Biometric match + scheme ID confirmed",
  "flags": []
}

List recent verifications with GET /api/verifications?org_id=...&limit=50. Every verification is org-scoped and appears in audit logs.

• Configure consent scopes for record access at intake
• Subscribe to webhooks for consent and visit lifecycle events
• Connect your EHR via FHIR R4 / SMART on FHIR
• Enable billing rails for HMO pre-check and claims export