API, webhooks and MCP
Connect your website and tools to the EHR.Scoped keys, signed events and an MCP server.
A partner API for lead intake and public booking reads, signed webhooks when leads, forms and appointments change, one-tag embeds for booking and intake, and an MCP server that lets an AI assistant read clinic data under each user's permissions.
API access and custom integrations are scoped on Enterprise · Pricing details
The platform at a glance
Small, documented surfaces that do one job each.
Most clinics need three connections: their website sending leads in, their marketing tools hearing about bookings, and an AI assistant that can read the clinic's own data. Moonshot covers those with a narrow partner API, outbound webhooks and an MCP server.
The developer reference and OpenAPI spec are public at api.moonshotehr.com/developers.
The connected workflow
From a key to a working connection.
See how a clinic connects a website or tool.
Issue a key
The owner creates a secret API key in Settings, Developers, chooses its permissions and expiry, and copies it once. Keys can be revoked, and two can overlap for rotation.
Send leads in
Create and update leads, and check a lead's status, through the API or the lead webhook. Attribution such as UTM and click ids comes along, and repeat submissions are de-duplicated.
Read the catalog
Read the clinic's public service catalog and availability to show real times on your own site.
Hear what happened
Point one https address with a signing secret at Moonshot. Send a test, then watch the delivery log as events arrive.
What changes for your team
Connections that do not need a middleman.
| The friction | In Moonshot | Why it matters |
|---|---|---|
| Website forms emailed to the desk | Lead API and lead webhook | Leads land in the CRM with their source and attribution. |
| Marketing tools blind to bookings | Signed outbound webhooks | lead.created, lead.converted, form.completed, appointment.booked, appointment.rescheduled and appointment.cancelled. |
| A booking widget that drifts from the schedule | One-tag embeds for booking, interest form and registration | Your site shows the EHR's real booking page and forms. |
| Exporting data to ask an AI a question | MCP server with per-user permissions | Claude and other assistants read clinic data under the signed-in user's permissions, and every call is audited. |
Limits, stated plainly
What the API does not do today.
- There is no third-party read or write API for patient records, charts or appointments.
- Booking is not available through the API; visitors book on the clinic's hosted booking page or an embed.
- There are no payment or membership webhook events yet.
- Appointment and form events need the clinic to confirm a BAA with the receiving system. Lead events do not.
- The partner API is a deliberately small surface. Talk to us before building against it.
- There is no Zapier app.
Questions buyers ask
The API, explained.
Does Moonshot EHR have an API?
Yes. Lead intake runs behind owner-issued keys, and the service catalog and availability are public reads. It is not a full clinical read-write API.
Which webhook events are there?
lead.created, lead.converted, form.completed, appointment.booked, appointment.rescheduled and appointment.cancelled, signed with the clinic's secret. lead.created fires for leads staff add by hand, not for website, chat or form leads.
Who can create API keys?
The clinic owner, in Settings, Developers. The owner picks the permissions and expiry; the key is shown once and can be revoked.
How does MCP fit in?
The MCP server lets Claude and other assistants read clinic data under the user's own permissions. Actions are proposed as drafts a named staff member signs.
Where is the documentation?
At api.moonshotehr.com/developers, with the OpenAPI spec.
See the complete workflow
Plan a connection with us.
Tell us what your website and tools need to send or hear, and we'll map it to keys, webhooks or MCP.
Book a Demo