Staff

Endpoints

List providers

GET /api/staff/providers returns the clinic members who can act as a patient's primary provider — used to populate provider pickers. Any member can call it. Each row includes the provider's specialty (or null), so the patient sheet can show the treating clinician's specialty.

List staff

GET /api/staff returns all clinic members with their usernames, roles, and specialty (or null). Admin/owner only.

Set a member's specialty

PATCH /api/staff/{userId} upserts the member's clinical specialty for this clinic. Admin/owner only. Send { "specialty": "orthopedics" } (one of the curated specialty keys) or { "specialty": null } to clear it. The specialty is per-clinic (stored in staff_profile), not on the global user account.

Create a staff account

Provision an account directly (no email invitation round-trip). The new member signs in with username + password.

curl -b cookies.txt -X POST http://localhost:4000/api/staff \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Front Desk",
    "username": "frontdesk1",
    "password": "a-long-secure-password",
    "role": "reception"
  }'

Returns 201 with the created member. To add someone with their own existing account instead, use an organization invitation.

Set a member's password

PATCH /api/staff/{userId}/password lets an admin set a member's password directly — used when an employee forgot theirs and no email provider is configured (see the password-reset fallback). Admin/owner only; the target must be a member of the active clinic.

curl -b cookies.txt -X PATCH http://localhost:4000/api/staff/USER_ID/password \
  -H "Content-Type: application/json" \
  -d '{ "newPassword": "a-long-secure-password" }'

newPassword must be at least 12 characters. Returns { "ok": true }.