Hi-Doctor Docs — online medical care, connected to your AI assistant

A chat interface can take someone from “no account” to “signed in” without ever leaving the conversation. It takes three calls, with one step that requires the person to read a code from their inbox.

Hi-Doctor is a medical service, not an emergency one. If someone using your interface reports severe or sudden symptoms — chest pain, difficulty breathing, a severe allergic reaction, suicidal thoughts — direct them to their local emergency number rather than continuing a signup or consultation.See Safety for the rules that apply to anything built on this API.

The three calls, annotated:

curl -X POST https://api.hi-doctor.ai/v1/users/register/ \
  -H 'Content-Type: application/json' \
  -H 'X-Brand-Slug: hi-doctor' \
  -d '{
    "email": "patient@example.com",
    "password": "a-strong-password",
    "first_name": "Alex",
    "last_name": "Moreno",
    "locale": "en"
  }'

{ "message": "Please verify your email with OTP" }

Only email and password are required. locale accepts any live language (en, es, de, nl, it, fr, pt) and sets the language of the account’s emails; it defaults to en.The password is checked against Hi-Doctor’s strength rules and is rejected with 400 if it is too weak.

This returns 200, not 201 — no account exists yet. The registration is held pending until the emailed code is verified.

Response	Meaning
`400`	Weak password, or the address belongs to an active account
`429` `REGISTRATION_RATE_LIMITED`	Too many attempts — back off
`406` `REGISTRATION_EMAIL_UNDELIVERABLE`	Address permanently undeliverable

Registering over an active, privileged, or Google-backed account is refused by design: accepting an OTP for it would be an account-takeover path. Only an inactive, unverified password signup can be resumed, and that reissues a code rather than creating a duplicate.

A 406 is permanent for that address — a hard bounce or spam complaint. Retrying can never succeed. Ask for a different email address rather than looping.

Verify the emailed code

A one-time code is emailed to the address. The account cannot sign in until it is verified — attempting to do so returns 401.

curl -X POST https://api.hi-doctor.ai/v1/users/verify-email/ \
  -H 'Content-Type: application/json' \
  -H 'X-Brand-Slug: hi-doctor' \
  -d '{ "email": "patient@example.com", "otp": "123456" }'

Ask the person for the code and pass it straight through. Both fields are required; omitting either returns error_name: "VERIFY_EMAIL_INVALID_REQUEST".

Incorrect codes are rate limited. After too many attempts the API responds “Too many incorrect codes. Please request a new one shortly.” and further attempts are refused for a period. Do not retry in a loop — surface the message and wait.

curl -X POST https://api.hi-doctor.ai/v1/users/token/ \
  -H 'Content-Type: application/json' \
  -H 'X-Brand-Slug: hi-doctor' \
  -d '{ "email": "patient@example.com", "password": "a-strong-password" }'

Returns an access and refresh token pair. From here, follow Authentication.

Complete the profile

Checkout requires a complete profile. If anything is missing it refuses with:

{ "error_name": "PROFILE_INCOMPLETE", "missing_fields": ["date_of_birth", "country_of_residence"] }

Fill the gaps and retry:

curl -X PATCH https://api.hi-doctor.ai/v1/users/profile/me/ \
  -H 'Authorization: Bearer <access token>' \
  -H 'Content-Type: application/json' \
  -d '{ "date_of_birth": "1990-04-12", "country_of_residence": "ESP" }'

The patient must be 18 or over and resident in a supported country.

Google accounts

POST /v1/users/google-login/ signs in or signs up with a Google credential.

An account created through Google has no password. It cannot sign in via /v1/users/token/, and it cannot currently complete MCP connector sign-in, which is password-based.

Forgotten passwords

POST /v1/users/forgot-password/ emails a reset link; POST /v1/users/reset-password/ sets the new password from the token in that email. Both are unauthenticated.

What a chat interface should know

You cannot skip verification. There is no way to activate an account without the emailed code.
There is no resend-code endpoint. If a code is lost or expires, the person registers again with the same address, which resumes the pending signup and reissues a code — subject to an email cooldown. A throttled retry deliberately does not invalidate the code already in their inbox, so tell them to check for the earlier email rather than promising a new one.
Some failures are permanent. A 406 (REGISTRATION_EMAIL_UNDELIVERABLE) means that address can never receive mail from Hi-Doctor. Ask for a different one instead of retrying.
Never store the password. Exchange it for tokens once and keep the tokens; refresh with /v1/users/token/refresh/.
For an AI assistant, prefer the MCP connector. It now handles signup too — a patient with no account can create one, verify the emailed code and approve without ever leaving the connector, and your application never handles their password. Use this API directly only when you are not going through MCP.

​Complete the profile

​Google accounts

​Forgotten passwords

​What a chat interface should know

Complete the profile

Google accounts

Forgotten passwords

What a chat interface should know