API tokens are created and managed in Settings - API Settings. Each token is tied to a single portal user. Tokens can be rotated or revoked from that page at any time; revoked tokens stop working immediately.

Send the token in the Authorization header on every request:

Authorization: Bearer <token>

Tokens are scoped to your Clerk user account and start with lrx_live_. The full token is shown only once when you create or rotate it, so save it somewhere secure.

Returns leads collected for your partner account, ordered newest first. Paginated using a cursor; pass the nextCursor value from the previous response in the cursor query parameter to fetch the next page.

Envelope: { data: LeadRow[], page: { nextCursor, limit } }. If a lead has not consented to email or SMS, the matching email or phone field is returned as No Consent.

Returns DNA test intake links available for your account. Requires DNA access; otherwise returns 403.

Envelope: { data: DnaProductLink[] }.

Returns medical intake product links assigned to your account. Pass sub to rewrite each link's partner_id to attribute orders to the given sub-account (1-250).

Envelope: { data: PartnerProductLink[], sub: string | null }.

Returns Care Service links available to your account. Results are filtered by active subscription/manual override, yearly-plan bundle access, individual service access, and category feature flags. URLs in the response are generated from the admin-configured Care Services base URLs; the examples below use placeholder domains.

Each result includes a default url (no duration pre-selected), a redeemUrl for Bulk Code Redemption, and a tiers array. Each tier contains a tier-specific url that already includes the matching m= query parameter, so you can hand the link directly to a patient without rebuilding it yourself.

The URLs are the same patient-facing checkout links rendered in the partner portal under Partner Links - Care Services. Patient-facing URL parameters appended to each link are documented in the "URL parameters" table below.

Envelope: { data: CareServiceLink[], sub, service, duration }. Admin-only catalog fields and pricing caps are not returned.

**Patient-facing URL parameters** (already appended to every url/redeemUrl we return - documented so you understand how to interpret or, if needed, regenerate them): - partner_id (always present): your partner attribution code. Required for revenue and order attribution. - m (optional, present on tier urls and when duration is requested): term in months. One of 1, 3, 6, 12. Pre-selects the matching tier on the checkout page. - sub (optional, present when sub was passed): sub-account number 1-250 for downstream attribution. - redeem=true (only on redeemUrl): switches the destination from the Stripe-checkout flow to the Bulk Code Redemption screen. Patients enter a 12-character coupon code (no card collected) and we provision the membership directly.

Download Care Services bulk coupon codes owned by the authenticated partner. Each coupon is single-use, locked to a productSlug + months combination, and either redeemed by a patient via your Bulk Code Redemption URL or marked void/expired. Admin tokens may filter by any partner_id; non-admin tokens are automatically scoped to their own partner.

Use this endpoint to programmatically pull every code you have purchased (including ones still in active status that have not yet been redeemed) so you can distribute them, store them in your own system, or reconcile redemptions.

Returns JSON by default. Pass format=csv to download a spreadsheet (the same columns as the "Download all CSV" button in the partner portal Bulk Orders view) instead.

JSON envelope: { data: CareServiceCoupon[], total, limit, offset }. Each coupon includes code (the raw 12-character A-Z 0-9 string), productSlug, months, status, expiresAt, redeemedAt, redeemedEmail, and redeemedLyricPrimaryExternalId so you can reconcile who used what.

CSV columns (with format=csv): code, product_slug, months, status, partner_id, sub_account_id, unit_price_cents, bulk_order_id, purchaser_email, purchaser_source, created_at, expires_at, redeemed_at, redeemed_email, redeemed_lyric_primary_external_id, notes. Values are quoted; embedded quotes are escaped by doubling.

Returns orders attributed to your partner account, including commission and shipping status. Sensitive fields are filtered for non-admin tokens.

Envelope: { data: Order[] }. The order object matches the Orders UI fields: orderId, createdDate, subAccount, product, amount, commission, and status.

Returns payout records for the authenticated partner.

Envelope: { data: Payout[] }. Admin-only receipt and note fields are not included.

List, create, and delete sub-accounts. Sub-accounts let you attribute orders, leads, and links to a specific staffer or affiliate using the subId field.

GET envelope: { data: PortalSubAccount[] }. POST returns 201 with { data: PortalSubAccount }. DELETE returns { data: { ok: true } }.

Signature verification is optional, but strongly recommended. Every delivery includes an X-LegUpRx-Signature header in the form:

X-LegUpRx-Signature: t=<unix_timestamp>,v1=<sha256_hex>

The signed string is t + '.' + body, where body is the exact raw HTTP request body (do not re-serialize the JSON). Compute HMAC-SHA256 with your endpoint secret as the key and compare in constant time. Reject deliveries whose t is more than 5 minutes old to prevent replays.

We also send X-LegUpRx-Event (the event name) and X-LegUpRx-Delivery (a unique delivery id, useful for idempotent processing).

Active weight-loss products available for distribution.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/weight-loss?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Active men's health products.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/mens-health?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Active women's health products.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/womens-health?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Active hair-loss products.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/hair-loss?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Active wellness and longevity products.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/wellness?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Combined active medication link product catalog across all medication categories.

These endpoints are unauthenticated. To attribute traffic to your account, distribute intake links that already include your partner_id, for example:

https://www.telehealthintakeforms.com/api/all-products?partner_id=RFMLPVN1

Typical response headers include Content-Type: application/json; Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate with Cdn-Cache-Control: no-store; Access-Control-Allow-Methods: GET, OPTIONS; Access-Control-Allow-Headers: Content-Type.

Partners can embed their Care Services catalog on their own site with the iframe URL shown in their Care Services section. Treat that URL like a shareable tracking link, not a secret. The embedded view only renders services the partner can currently access and respects category feature flags.

Replace the placeholder src below with the Care Services embed URL copied from the partner portal. Do not build this from the API docs domain. The payment-link domain accepts a few query parameters:

• partner_id (required): your partner attribution code; auto-populated by the partner portal's "Copy URL" buttons.
• service: one of primary-care, urgent-care, mental-health, dermatology, veterinary-care. Filters the embedded catalog.
• m: term in months: 1, 3, 6, or 12. Pre-selects a duration on the intake.
• sub: optional sub-account number (1-250) to attribute the order to a downstream account.
• redeem=true: switches the page from the Stripe checkout flow to the Bulk Code Redemption screen. Patients enter a 12-character coupon code (no card collected) and we provision the care services membership directly. Use the "Copy Bulk Code Redemption URL" button on each Care Services row to generate this URL.

<iframe
  id="leguprx-care-services"
  src="PASTE_YOUR_CARE_SERVICES_EMBED_URL_HERE"
  style="width:100%;border:0;min-height:700px;border-radius:16px;"
  loading="lazy"
></iframe>
<script>
  window.addEventListener('message', (event) => {
    if (event.data?.type !== 'leguprx-api-docs-height') return;
    document.getElementById('leguprx-care-services').style.height = event.data.height + 'px';
  });
</script>