Introduction

Dentolize and Medicolize can notify your own system whenever something happens in the clinic. When an event you subscribed to occurs, such as a new patient or a new payment, the system sends an HTTP POST request with the event data to the URL you choose. Use webhooks to sync data with an ERP or accounting system, a data warehouse, or an automation tool such as Make, Zapier or n8n.

Set up webhooks

Open Settings → Integrations → API Config:

For each endpoint, fill in:

Field	Description
Base URL	The URL that will receive the `POST` requests.
Verify Token	Optional secret used to sign each request (see Verify requests).
APIs	The events to send to this URL.

Click New Item to add an endpoint, fill in the Base URL (1), the optional Verify Token (2) and the APIs to send (3), then click Save (4). You can add more than one endpoint, each with its own events.

1 Base URL, 2 Verify Token, 3 APIs, 4 Save in API Config

API Config is visible to users with full permissions only, and only when the API feature is enabled for your account. If you don’t see it, contact Dentolize support.

Events

Event	`type` value
New patient	`NEW_PATIENT`
New invoice	`NEW_INVOICE`
New balance invoice	`NEW_BALANCE_INVOICE`
New payment	`NEW_PAYMENT`
New balance payment	`NEW_BALANCE_PAYMENT`
New treasury	`NEW_TREASURY`
New procedure	`NEW_PROCEDURE`
New operation	`NEW_OPERATION`
New expense	`NEW_EXPENSE`
New expense payment	`NEW_EXPENSE_PAYMENT`

Request format

Every request is a POST with a JSON body. The body always includes the payload version and the event type, followed by the event fields described on each event page:

{
  "version": "v1.0",
  "type": "NEW_PATIENT",
  "id": "pat_123",
  "name": "Jane Doe"
}

Header	Value
`Content-Type`	`application/json`
`X-Hub-Signature-256`	`sha256=<signature>` — sent only when a Verify Token is set

Your endpoint should respond within 5 seconds. Failed or slow deliveries are not retried, so return a 2xx response quickly and process the data in the background.

Verify requests

If you set a Verify Token, each request is signed with an HMAC SHA-256 of the raw request body, using the token as the key. Compute the same signature on your side and compare it with the X-Hub-Signature-256 header before trusting the data.

import crypto from 'node:crypto'

function isValidSignature(rawBody, header, verifyToken) {
  const expected = 'sha256=' + crypto.createHmac('sha256', verifyToken).update(rawBody, 'utf8').digest('hex')
  if (!header || header.length !== expected.length) return false
  return crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected))
}

import hmac, hashlib

def is_valid_signature(raw_body: bytes, header: str, verify_token: str) -> bool:
    expected = "sha256=" + hmac.new(verify_token.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(header or "", expected)

Compute the signature on the raw body exactly as received. Parsing and re-serializing the JSON can change it and make the check fail.

API documentation

Webhooks

Set up webhooks

Events

Request format

Verify requests

​Set up webhooks

​Events

​Request format

​Verify requests

Set up webhooks

Events

Request format

Verify requests