Partner API

Frontier HSA Partner API is a read-only REST API for approved company integrations. It does not submit, approve, deny, or change claims.

Base URL and OpenAPI

https://api.frontierhsa.ca/v1

The machine-readable contract is available at openapi.json.

Authentication

Frontier issues each integration a company-bound, read-only API key. Send the key as a Bearer token:

curl https://api.frontierhsa.ca/v1/members \
  -H "Authorization: Bearer $FRONTIER_API_KEY"

Store the key in a secret manager. Do not put it in browser code, source control, URLs, or logs. Plan administrators create keys under Settings → Advanced → API & webhooks. The full key is shown only once.

Every administrator-created key includes these read scopes:

• members:read
• benefits:read
• invoices:read

Endpoints

List endpoints accept limit from 1 to 100 and an optional cursor. Pass the returned next_cursor unchanged to request the next page. Monetary values are integer Canadian cents.

Responses include X-Request-Id and are never cached. Errors use application/problem+json with a stable code.

Webhooks

Frontier can send these events to an approved public HTTPS endpoint:

• claim.approved
• invoice.issued

Example payload:

{
  "id": "evt_22dd5b358d365ff6213669f1732f8156",
  "type": "claim.approved",
  "created_at": "2026-09-16T15:04:05.000Z",
  "data": {
    "claim_id": "c26-2cfgh",
    "member_id": "b2bc8633-4361-4d30-a1e2-029ec29ff56d",
    "member_name": "Alex Chen",
    "status": "approved",
    "approved_amount_cents": 12500
  }
}

Every delivery includes:

• Webhook-Id: stable event ID for deduplication
• Webhook-Timestamp: Unix timestamp in seconds
• Webhook-Signature: one or more space-separated v1, base64 HMAC-SHA256 signatures

Verify the signature over the exact raw body using:

{Webhook-Timestamp}.{raw request body}

Need access?

Plan administrators can create keys and manage webhook endpoints under Settings → Advanced → API & webhooks. Contact support@frontierhsa.ca if you need help.