Developers

API

Read your treatment history and log doses from Shortcuts, scripts, and other apps

Anyone with a Hemolog account can use the REST API to work with their own treatment logs. Copy your API key from the Profile page, then send it as an Authorization: Bearer header on each request.

The API is intentionally small: fetch your full history, fetch the last three logs (the same slice shown on your emergency page), or post a new treatment. Deleted treatments are never returned.

Authentication

Send your API key in an Authorization: Bearer header:

Authorization header

curl -H "Authorization: Bearer YOUR_API_KEY" https://hemolog.com/api/treatments

The apikey query parameter (?apikey=YOUR_API_KEY) is no longer accepted. Send the key in the Authorization header instead.

GET /api/recent-treatments also accepts alertid — the public ID printed on your emergency card — instead of an API key. The other endpoints require the key.

Keep your key private

Treat the API key like a password. Anyone who has it can read your treatments and log new ones. You can create several keys, each with its own name — for example one per app — and revoke them individually on your profile page; a revoked key stops working immediately.

GET

/api/treatments

Returns every non-deleted treatment for the key holder, newest date first. API key: Authorization header (required).

Response

[
  {
    "id": "abc123",
    "uid": "abc123",
    "cause": "",
    "createdAt": "2026-10-15T14:30:00.000Z",
    "date": "2026-10-15",
    "deletedAt": null,
    "medication": {
      "brand": "Advate",
      "units": 3000,
      "lot": "LOT1234"
    },
    "sites": "Left arm",
    "type": "PROPHY",
    "user": {
      "uid": "firebase-uid",
      "email": "you@example.com",
      "name": "Jane Doe",
      "photoUrl": "https://example.com/photo.jpg"
    }
  }
]

Each item includes an extra id field that matches uid.

GET

/api/recent-treatments

Returns the three most recent treatments, the same slice shown on the public emergency page. Sorted by createdAt, newest first.

API key: Authorization header, or alertid (at least one required).

cURL

curl -X GET \
  'https://hemolog.com/api/recent-treatments' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json'

With an alert ID: /api/recent-treatments?alertid=your-alert-id

POST

/api/log-treatment

Creates a new treatment. Send a JSON body with any subset of treatment fields. Missing fields are copied from your most recent log, so a Shortcut can post { "type": "PROPHY" } and reuse the last medication, dose, and sites. If you have never logged a treatment, omitted fields fall back to empty values and PROPHY. API key: Authorization header (required).

Body: JSON object (partial treatment). createdAt, deletedAt, and uid are set by the server.

Request body

{
  "type": "PROPHY",
  "date": "2026-10-18",
  "sites": "Left arm",
  "medication": {
    "brand": "Advate",
    "units": 3000,
    "lot": "LOT5555"
  }
}

Success

{
  "message": "Success"
}

The response is a success message, not the created record.

Minimal cURL

curl -X POST \
  'https://hemolog.com/api/log-treatment' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"type":"PROPHY"}'

Errors

Failed requests return HTTP 500 with an error string:

Missing key

{
  "error": "Access denied. Missing api key."
}

Invalid key

{
  "error": "Invalid API key. Reset your key on your profile page at Hemolog.com"
}

Posting without a JSON body returns { "error": "Missing treatment data." }

Treatment object

Fields you can send when logging, and that you will see on reads:

type: PROPHY, BLEED, PREVENTATIVE, or ANTIBODY
date: Treatment date as YYYY-MM-DD
cause: Bleed cause or notes. Empty string for a typical prophylaxis log.
sites: Infusion site, for example Left arm
medication.brand: Product name
medication.units: Dose as a number
medication.lot: Optional lot number
createdAt: ISO timestamp set by the server when the log is created
deletedAt: null on active treatments. Soft-deleted logs are omitted from API responses.
user: Attached account snapshot: uid, email, name, photoUrl

Examples

A few ways people actually use this API — from a one-off curl to a home-screen Shortcut.

cURL

Confirm your key works by fetching the last three treatments:

cURL

curl -X GET \
  'https://hemolog.com/api/recent-treatments' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json'

JavaScript

Export your full history from the browser console, a Node script, or a personal dashboard:

JavaScript

const response = await fetch(
  'https://hemolog.com/api/treatments',
  { headers: { Authorization: 'Bearer YOUR_API_KEY' } }
)
const treatments = await response.json()

if (!response.ok) {
  throw new Error(treatments.error || 'Request failed')
}

console.log(treatments)

Apple Shortcut

Log prophylaxis from your home screen. Because the API fills in missing fields from your last treatment, the Shortcut only needs to send a type.

Open Shortcuts and create a new shortcut.
Add Get Contents of URL. Set the URL to https://hemolog.com/api/log-treatmentand add a header: Authorization with value Bearer YOUR_API_KEY.
Method: POST. Request body: JSON with type set to PROPHY.
Add the shortcut to your Home Screen. Repeat for BLEED if you want a second button.

JSON body

{
  "type": "PROPHY"
}

Python CSV export

Pull your history into a spreadsheet before a clinic visit:

Python

import csv
import json
import urllib.request

API_KEY = 'YOUR_API_KEY'
request = urllib.request.Request(
    'https://hemolog.com/api/treatments',
    headers={'Authorization': f'Bearer {API_KEY}'},
)

with urllib.request.urlopen(request) as response:
    treatments = json.load(response)

with open('treatments.csv', 'w', newline='') as file:
    writer = csv.writer(file)
    writer.writerow(['date', 'type', 'brand', 'units', 'sites', 'cause'])
    for treatment in treatments:
        medication = treatment.get('medication') or {}
        writer.writerow([
            treatment.get('date'),
            treatment.get('type'),
            medication.get('brand'),
            medication.get('units'),
            treatment.get('sites'),
            treatment.get('cause'),
        ])

Your API keys

Create, name, and revoke keys on your Profile page. If a request fails with an invalid key, create a new one there and update your scripts.

For AI agents

If you are an AI assistant (or you are building with one), you can use this page as your instructions for the Hemolog API. Create a key on your Profile page, then send it as Authorization: Bearer YOUR_API_KEY on every request.

Quick reference:

Base URL: https://hemolog.com (JSON in and out)
GET /api/treatments — every non-deleted treatment, newest first
GET /api/recent-treatments — the three most recent treatments (also works with ?alertid= instead of a key)
POST /api/log-treatment — log a new treatment; missing fields are copied from the last log, so { "type": "PROPHY" } is enough
Errors return HTTP 500 with an error string — show it to the user rather than retrying

A revoked key stops working immediately. If you get Invalid API key, ask the user for a new one from their Profile page. Treat the key like a password: never print or log it, and prefer the header over URL parameters.

The full skill as a single markdown file, suitable for pasting into an agent's instructions:

hemolog-api-skill.md

# Hemolog API — agent skill

Use this skill to read a Hemolog user's treatment history or log new treatments through the Hemolog REST API. Hemolog is a personal hemophilia treatment log.

## Authentication

1. Every request needs the user's API key. The user creates keys on their Hemolog profile page (`https://hemolog.com/app/profile`) and can have several, each with a name.
2. Send the key as an HTTP header on every request:

   ```
   Authorization: Bearer YOUR_API_KEY
   ```

   API keys start with `hml_`. Treat the key like a password: anyone who has it can read the user's treatments and log new ones. Never print it, log it, or include it in URLs when a header works.
3. The key stops working immediately if the user revokes it. If a request returns "Invalid API key", ask the user to create a new key on their profile page and use that.

## Base URL

```
https://hemolog.com
```

All endpoints accept and return JSON.

## Endpoints

### GET /api/treatments

Returns every non-deleted treatment, newest `date` first.

### GET /api/recent-treatments

Returns the three most recent treatments (same slice as the user's public emergency page), sorted by `createdAt`, newest first.

This endpoint also accepts `?alertid=YOUR_ALERT_ID` — the public ID printed on the user's emergency card — instead of an API key. The other endpoints require the key.

### POST /api/log-treatment

Logs a new treatment. Send a JSON body with any subset of treatment fields:

```json
{
  "type": "PROPHY",
  "date": "2026-10-18",
  "sites": "Left arm",
  "medication": {
    "brand": "Advate",
    "units": 3000,
    "lot": "LOT5555"
  }
}
```

Missing fields are copied from the user's most recent treatment, so `{ "type": "PROPHY" }` is enough for a routine log. `createdAt`, `deletedAt`, and `uid` are set by the server. Returns `{ "message": "Success" }`.

## Treatment fields

- `type`: `PROPHY`, `BLEED`, `PREVENTATIVE`, or `ANTIBODY`
- `date`: `YYYY-MM-DD`
- `cause`: bleed cause or notes (empty string for a typical prophylaxis log)
- `sites`: infusion site, e.g. `Left arm`
- `medication.brand`: product name
- `medication.units`: dose as a number
- `medication.lot`: optional lot number

## Errors

Failed requests return HTTP 500 with a JSON body containing an `error` string:

- `"Access denied. Missing api key."` — no key was sent; add the Authorization header.
- `"Invalid API key. Reset your key on your profile page at Hemolog.com"` — the key was revoked or never existed; ask the user for a new key.
- `"Missing treatment data."` — a POST without a JSON body.

## Rules

- Never modify or delete anything except by these endpoints; the API cannot delete treatments.
- Deleted treatments are never returned by the API.
- If a request fails, show the user the error message instead of retrying repeatedly.

Also available as a download at hemolog.com/hemolog-api-skill.md.