# RCMS Developer Documentation

> The Recovery Capital Management System (RCMS) partner API: REST endpoints for
> organizations, staff, clients, assessments, and MOUD episodes; HMAC-signed
> webhooks; and embeddable iframe surfaces for recovery-support workflows.
> Base URLs: https://api.measurerecovery.com/v1 (production),
> https://api-sandbox.measurerecovery.com/v1 (partner sandbox).
> Authentication: API key via "Authorization: Bearer rcms_..._sk_..." header.
> Org context: "X-Organization-Id: <app_public_id UUID>" header on org-scoped calls.

## Machine-readable contract

- [OpenAPI 3.0 spec (YAML)](https://docs.measurerecovery.com/openapi/rcms-public-api-v1.yaml): the canonical API contract — endpoints, schemas, enums, error shapes
- [Full documentation dump](https://docs.measurerecovery.com/llms-full.txt): this index plus the complete OpenAPI spec inline, for single-fetch ingestion

## Guides

- [Getting Started](https://docs.measurerecovery.com/getting-started): authentication, base URLs, first calls, idempotency
- [API Reference](https://docs.measurerecovery.com/api-reference): interactive endpoint explorer (rendered from the OpenAPI spec)
- [Data Model](https://docs.measurerecovery.com/data-model): organizations → staff → clients → episodes → assessments, external_id mapping
- [Sync Patterns](https://docs.measurerecovery.com/sync-patterns): delta sync with updated_after, webhooks vs polling, backfills
- [Webhooks](https://docs.measurerecovery.com/webhooks): envelope shape, HMAC-SHA256 signature verification, retry semantics
- [Iframe Embeds](https://docs.measurerecovery.com/iframe-embeds): embed token minting, the 9 embed routes / 12 contexts, postMessage token refresh

## Notes for agents

- Every docs page has a "Copy as Markdown" button; the OpenAPI YAML is the
  source of truth when prose and spec disagree.
- Endpoints marked "Status: roadmap" in the spec are documented but not yet
  callable.