A CapitalRx API key consists of 2 parts, a public and a private access key. The public access key is used as part of your request to identify who is making the request, and is not necessarily secret. The private access key is secret and is used to generate the HMAC signature to authenticate requests.

API Keys expire 365 days from the date of creation, and any one identity can only have two (2) active API key pairs at any given moment, to allow for seamless key rotation.

Public Access Keys start with CRX and are always all caps.

Private Access Keys are random strings 58 characters long.

Example Public Access Key:

• CRXEXAMPLEAWJOBLF0WB

Example Private Access Key:

• d53mcLIawexample7nPv4example2nqP1c9SexampleRXLvexample35Ng

The following headers are required or your request will be rejected, even if it contains a valid signature.

• Content-Type (application/json)
• User-Agent
• Host
• X-CRX-ACCESS-KEY
• X-CRX-SIGNATURE
• X-CRX-TIMESTAMP

All requests should have a Content-Type of application/json and contain a request body with valid json. Even a request that supplies no information should send an empty object {}

Requests are signed with an HMAC-SHA256 signature using the private access key. The canonical request needs to be hashed using this algorithm, and the resulting HMAC placed into the X-CRX-SIGNATURE header of the request.

The canonical request is defined as these 4 elements concatenated together:

• The UNIX timestamp of the request (the same value as the X-CRX-TIMESTAMP header)
• The request method (all uppercase, i.e. "POST")
• The path of the request (without the base URL, i.e. "/claim/list")
• The content of the request body

An example of a canonical request would be:

POST https://adjudication-sts.staging-cap-rx.com/claim/list

1709242510POST/claim/list{}

Below is a Python3 example of an authenticated API call to list claims visible to the user calling the endpoint. Your user must have the appropriate permissions granted to call the endpoint, and if allowed to make the call, must have access to some data in order to not get an empty response.

Authenticated API Call

List Claims:

import hmac
import requests
import time
from requests.auth import AuthBase

class CapitalRxApiAuth(AuthBase):

   def __init__(self, access_key, secret_key):
       self.access_key = access_key
       self.secret_key = secret_key

   def __call__(self, request):
       timestamp = str(int(time.time()))
       canonical_request = timestamp + request.method + request.path_url + (request.body.decode("UTF-8") or '')
       signature = hmac.new(self.secret_key.encode("UTF-8"), canonical_request.encode("UTF-8"), 'sha256').hexdigest()

       request.headers.update({
           'X-CRX-TIMESTAMP': timestamp,
           'X-CRX-ACCESS-KEY': self.access_key,
           'X-CRX-SIGNATURE': signature,
       })

       return request

ACCESS_KEY = ""
SECRET_KEY = ""
auth = CapitalRxApiAuth(ACCESS_KEY, SECRET_KEY)

api_url = "https://adjudication-sts.staging-cap-rx.com/claim/list" # or any other endpoint you want to hit.
payload = {}

r = requests.post(
    url=api_url,
    auth=auth,
    json=payload,
    headers={
        "Content-Type": "application/json",
        "User-Agent": "apiexample/1.0",
    },
)

print(r.content)

Unauthenticated API Call (Advantage)

List Drug (search):

import requests
import json

r = requests.post(
    url="https://advantage-api.cap-rx.com/drug/list",
    json={
        "search": "ibuprofen",
        "page_number": 2,
    },
    headers={
        "Content-Type": "application/json",
        "User-Agent": "apiexample/1.0",
    },
)

print(json.dumps(r.json(), indent=2))

Timestamp has Expired

Requests are only valid within 5 minutes of the timestamp in the X-CRX-TIMESTAMP header. If more than 5 minutes has elapsed since the request was signed, it will be rejected as expired.

User-Agent header is missing

The User-Agent header is required. If not present in the request, it can appear as a failure to authenticate, despite a valid signature being included.