These read-only REST resources let a customer-built tool reconcile payments, chase signatures, reuse agency working data, and follow value-based purchasing without copying Braes screens. Each uses the same bearer token, contract-version header, data/meta envelope, and error envelope as the other external routes. The runtime catalog (GET /api/v1/ext/catalog) lists each route's required scope, whether a no_phi session can use it, and its documented query_parameters. Calls succeed only when the agency's extension policy allows the external REST read capability.
Remittances (scope external:remittances:read): GET /api/v1/ext/remittances lists ERA payments with payer, amount, payment date, status, and claim count. Filters: status, era_file_id. GET /api/v1/ext/remittances/{id}/allocations lists that payment's claim-level allocations: charged, allowed, paid, adjustment, patient responsibility, variance, CARC adjustment codes such as CO-45, and match status. Totals for the whole payment are in meta.summary. An unknown remittance, or one that carries only provider-level adjustments, returns an empty page. Check and trace numbers are masked to their last four characters. In no_phi sessions they are removed, patient and claim references are pseudonymized, and dates are reduced to the year.
Physician orders (scope external:physician-orders:read): GET /api/v1/ext/physician-orders lists orders newest first, with signature_status (signed, awaiting_signature, signature_not_required, rejected, superseded, cancelled), days_outstanding, aging_bucket, sla_breached, and days_to_sign. Aging is counted as of meta.as_of. Filters: status, order_type. The offset must be a multiple of limit. GET /api/v1/ext/physician-orders/{id} reads one order. Order content is never included. In a no_phi session both routes work: the list pseudonymizes patient and physician references and returns each order id as a stable OR- handle, and the single-order read takes that handle in place of the id.
Working collections (scope external:working-collections:read, phi sessions only): GET /api/v1/ext/working-collections lists the collections the extension's agency identity can read: collections shared agency-wide, and collections that name that identity as an editor. Personal collections stay private. GET /api/v1/ext/working-collections/{id}/rows pages through one collection's rows. Values are keyed by stable field id, and meta.collection carries the field definitions. If a collection is refused or not found, the error names who can share it. Working values are supplemental. They never establish clinical or financial facts.
Working collections are read-only from extensions. This is deliberate and not a gap you should work around. Only the collection's owner, its named editors, or an agency administrator signed in to Braes can change rows. There is no MCP proposal for row writes either: an approved proposal could not run under the extension's identity. Each collection's write block names the door. To request a change, create a task with POST /api/v1/ext/tasks that asks the collection's owner to make it, or make the change in Braes.
Quality (scope external:quality:read): GET /api/v1/ext/quality/hhvbp/summary returns the agency's HHVBP cycle summary. GET /api/v1/ext/quality/hhvbp/measures returns its measure scores. Both accept performance_year and payment_year. When you omit payment_year, it is performance_year + 2. Both resources are agency-level aggregates with no patient data, so no_phi sessions can use them. Fields prefixed official_cms_ hold CMS-published results, when CMS has published them. Fields prefixed modeled_ hold Braes' projection, which is a diagnostic and not a CMS determination. If CMS has not published a result, official_cms_unavailable_reason says why. If the measure set for a year has not been imported, the request returns 404 with the reason and the recovery step.
// Continues the J2 script above: token and base are already defined.
async function readAll(path) {
const rows = [];
let offset = 0;
for (;;) {
const url = new URL(path, base);
url.searchParams.set('limit', '100');
url.searchParams.set('offset', String(offset));
const body = await read(await fetch(url, {
headers: { Authorization: 'Bearer ' + token.access_token }
}));
rows.push(...body.data);
if (body.meta?.next_offset == null) return rows;
offset = body.meta.next_offset;
}
}
const payments = await readAll('/api/v1/ext/remittances');
const overdue = (await readAll('/api/v1/ext/physician-orders'))
.filter(order => order.aging_bucket === '31_plus_days');
console.log(payments.length, 'payments;', overdue.length, 'orders unsigned over 30 days');
