Settings

Settings are user-scoped (not per clinic): they follow the signed-in user across clinics and devices. Only authentication is required — no role permission.

The preferences object

A flat map of preference keys to booleans or short strings — the frontend's Settings → Profile tab (notification toggles, clinic/contact fields) reads and writes it. Keys are free-form (max 64 chars, up to 100 keys; string values capped at 500 chars), so features can add settings without an API change.

{
  "preferences": {
    "notif.newLab": true,
    "notif.recordUpdated": false,
    "clinic": "Main Hospital",
    "contactEmail": "doc@example.org"
  }
}

Example

curl -b cookies.txt -X PUT http://localhost:4000/api/settings \
  -H "Content-Type: application/json" \
  -d '{ "preferences": { "notif.newLab": false } }'

PUT replaces the whole map (upsert) — send the full set of preferences, not a diff.

Email provider

A deployment-wide, admin-only config (gated by member:create) for how temetro sends verification, password-reset, and invitation emails. Email is sent while users are logged out, so this is one setting for the whole deployment, not per clinic. The API key is encrypted at rest and never returned.

provider is one of none · smtp · resend · postmark · sendgrid. The REST providers (Resend/Postmark/SendGrid) use the stored API key; smtp uses the server's SMTP_* environment variables.

curl -b cookies.txt -X PUT http://localhost:4000/api/settings/email \
  -H "Content-Type: application/json" \
  -d '{ "provider": "resend", "fromAddress": "temetro <no-reply@clinic.com>", "credentials": "re_..." }'

On PUT, omit credentials to keep the existing key, or send "" to clear it. When no provider is configured, a forgot-password request instead notifies the clinic admin(s) (see the settings guide).

Records import & export

Two clinic-wide, admin-only endpoints (gated by member:create, the owner/admin marker) move patient records in and out of temetro. Unlike the preference endpoints above, these require an active organization.

Export returns a JSON archive:

{
  "temetroExport": true,
  "version": 1,
  "exportedAt": "2026-06-20T12:00:00.000Z",
  "organizationId": "org_…",
  "patientCount": 42,
  "patients": [ /* full Patient objects */ ]
}

Import accepts { "patients": [ … ] } (the patients array from an export). Each record is validated; existing file numbers are skipped (idempotent re-imports) and cross-clinic provider links are dropped. It returns a summary:

{ "created": 40, "skipped": 2, "total": 42, "errors": [] }

# Export the clinic's records to a file
curl -b cookies.txt http://localhost:4000/api/settings/records/export > records.json

# Re-import them (new records only)
curl -b cookies.txt -X POST http://localhost:4000/api/settings/records/import \
  -H "Content-Type: application/json" -d @records.json

Account deletion

Deleting an account goes through Better Auth, not this endpoint: the frontend calls deleteUser with the user's password (POST /api/auth/delete-user). Stored settings are removed with the user (ON DELETE CASCADE).