fhirsmith 0.16.1 → 0.18.0

package/shl/shl.js

@@ -808,16 +808,26 @@ class SHLModule {
       }
     });
 
-    // Helper function for the shared access logic
+    // Helper function for the shared access logic.
+    //
+    // POST is the manifest request. GET is only defined by the SHL spec for the
+    // U flag (direct file access): the client does GET {url}?recipient=... and
+    // expects the single encrypted file (JWE) back, not a manifest. The flag is
+    // not sent to or stored on the server, so a GET is taken to mean U. If the
+    // SHL has more than one file (U isn't valid for it), or it's a VHL, GET
+    // keeps returning the manifest / VHL bundle as before.
     const handleSHLAccess = (req, res) => {
       const start = Date.now();
       try {
         const {uuid} = req.params;
+        const isGet = req.method === 'GET';
 
         let recipient, embeddedLengthMax;
 
-        if (req.method === 'GET') {
-          recipient = 'anonymous';
+        if (isGet) {
+          recipient = typeof req.query.recipient === 'string' && req.query.recipient.length > 0
+            ? req.query.recipient.substring(0, 255)
+            : 'anonymous';
           embeddedLengthMax = undefined;
         } else {
           ({recipient, embeddedLengthMax} = req.body);
@@ -846,7 +856,7 @@ class SHLModule {
 
           const logAccessSql = 'INSERT INTO SHLViews (shl_uuid, recipient, ip_address) VALUES (?, ?, ?)';
 
-          this.db.run(logAccessSql, [uuid, recipient, clientIP], function (logErr) {
+          this.db.run(logAccessSql, [uuid, recipient, clientIP], (logErr) => {
             if (logErr) {
               shlLog.error('Failed to log SHL access:', logErr.message);
             }
@@ -858,24 +868,37 @@ class SHLModule {
                 return res.status(500).json({error: 'Failed to retrieve files'});
               }
 
+              // U flag: return the one file directly
+              if (isGet && !shlRow.vhl && fileRows.length === 1) {
+                try {
+                  res.set('Content-Type', 'application/jose');
+                  return res.send(Buffer.from(fileRows[0].cnt, 'base64'));
+                } catch (decodeErr) {
+                  return res.status(500).json({error: 'Failed to decode file content'});
+                }
+              }
+
+              // SHL links are always https; the server always sits behind an https proxy
               const host = req.get('host') || 'localhost:3000';
-              const protocol = req.secure ? 'https' : 'http';
               const maxLength = embeddedLengthMax ? parseInt(embeddedLengthMax) : undefined;
 
               const files = fileRows.map(file => {
                 const fileResponse = {
                   contentType: file.type,
-                  location: `${protocol}://${host}/shl/file/${file.id}`
+                  location: `https://${host}/shl/file/${file.id}`
                 };
 
-                if (maxLength === undefined || file.cnt.length <= maxLength) {
-                  fileResponse.embedded = file.cnt;
+                // cnt is stored base64-encoded; embedded must be the JWE compact serialization itself
+                const jwe = Buffer.from(file.cnt, 'base64').toString('utf8');
+                if (maxLength === undefined || jwe.length <= maxLength) {
+                  fileResponse.embedded = jwe;
                 }
 
                 return fileResponse;
               });
 
-              const standardResponse = {files};
+              // finalized: content is fixed for the life of the link (expired links 404 above)
+              const standardResponse = {status: 'finalized', files};
 
               if (shlRow.vhl && vhlProcessor) {
                 try {
@@ -1059,6 +1082,38 @@ class SHLModule {
     });
   }
 
+  /**
+   * The paragraph for the server's daily report: links (QR codes) created in
+   * the period, in either form, how often links were accessed, and the
+   * documents stored behind them.
+   */
+  async dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    if (!this.db) {
+      return 'The database is not open.';
+    }
+    const get = (sql, params) => new Promise((resolve, reject) =>
+      this.db.get(sql, params, (err, row) => err ? reject(err) : resolve(row)));
+    // created_at is CURRENT_TIMESTAMP: UTC, 'YYYY-MM-DD HH:MM:SS'
+    const utc = ms => new Date(ms).toISOString().replace('T', ' ').substring(0, 19);
+    try {
+      const created = await get(
+        'SELECT SUM(CASE WHEN vhl THEN 0 ELSE 1 END) AS shl, SUM(CASE WHEN vhl THEN 1 ELSE 0 END) AS vhl FROM SHL WHERE created_at > ? AND created_at <= ?',
+        [utc(since), utc(now)]);
+      const views = await get('SELECT COUNT(*) AS n FROM SHLViews WHERE created_at > ? AND created_at <= ?', [utc(since), utc(now)]);
+      const files = await get('SELECT COUNT(*) AS n, COUNT(DISTINCT shl_uuid) AS links FROM SHLFiles', []);
+      const shl = created.shl || 0;
+      const vhl = created.vhl || 0;
+      const total = shl + vhl;
+      const sentences = [];
+      sentences.push(`${plural(total, 'QR code')} ${total === 1 ? 'was' : 'were'} served (${shl} SMART Health ${shl === 1 ? 'Link' : 'Links'}, ${plural(vhl, 'Verifiable Health Link')}), and links were accessed ${plural(views.n, 'time')}.`);
+      sentences.push(`${plural(files.n, 'document')} ${files.n === 1 ? 'is' : 'are'} stored to serve ${plural(files.links, 'QR code')}.`);
+      return sentences.join(' ');
+    } catch (e) {
+      return `The database could not be read: ${e.message}.`;
+    }
+  }
+
   async shutdown() {
     shlLog.info('Shutting down SHL module...');
 

package/stats-db.js

@@ -77,6 +77,22 @@ class StatsDatabase {
     this.db.exec(`CREATE INDEX IF NOT EXISTS idx_request_counts_time ON request_counts(time)`);
     this.db.exec(`CREATE INDEX IF NOT EXISTS idx_request_counts_key ON request_counts(module, endpoint, operation, id)`);
 
+    // One row per run of the server: when it started serving, and the last
+    // time it was known to be alive. See ServerStats.overallUptime().
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS server_runs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        started INTEGER NOT NULL,
+        last_seen INTEGER NOT NULL,
+        version TEXT
+      )
+    `);
+    // version was added after the table first shipped
+    if (!this.db.prepare(`PRAGMA table_info(server_runs)`).all().some(c => c.name === 'version')) {
+      this.db.exec(`ALTER TABLE server_runs ADD COLUMN version TEXT`);
+    }
+    this.touchRunStatement = this.db.prepare(`UPDATE server_runs SET last_seen = ? WHERE id = ?`);
+
     this.insertStatement = this.db.prepare(`
       INSERT INTO request_counts
         (time, interval_ms, module, endpoint, operation, count_delta, count_total, time_delta, time_total)
@@ -106,6 +122,83 @@ class StatsDatabase {
     `).all();
   }
 
+  /**
+   * Record that a new run of the server has started serving, and return its
+   * row id for touchRun().
+   */
+  startRun(now, version = null) {
+    if (!this.db) {
+      return null;
+    }
+    return this.db.prepare(`INSERT INTO server_runs (started, last_seen, version) VALUES (?, ?, ?)`).run(now, now, version).lastInsertRowid;
+  }
+
+  /**
+   * The runs that were alive at any point since `since`, oldest first, plus
+   * the last run that ended before then (so a caller can tell whether the
+   * first run in the period was an upgrade). Each is {id, started, lastSeen,
+   * version}.
+   */
+  loadRuns(since) {
+    if (!this.db) {
+      return [];
+    }
+    const before = this.db.prepare(`
+      SELECT id, started, last_seen AS lastSeen, version FROM server_runs
+      WHERE last_seen < ? ORDER BY last_seen DESC LIMIT 1
+    `).get(since);
+    const during = this.db.prepare(`
+      SELECT id, started, last_seen AS lastSeen, version FROM server_runs
+      WHERE last_seen >= ? ORDER BY started
+    `).all(since);
+    return before ? [before, ...during] : during;
+  }
+
+  /**
+   * The server is still alive: move the run's last_seen forward.
+   */
+  touchRun(runId, now) {
+    if (this.db && runId != null) {
+      this.touchRunStatement.run(now, runId);
+    }
+  }
+
+  /**
+   * How long the server has been running over all the runs recorded before
+   * this one: the earliest start, and the total time between each run's start
+   * and the last time it was seen alive. {firstStart: null, runningMs: 0} if
+   * there are no earlier runs.
+   */
+  loadRunHistory(excludeRunId) {
+    if (!this.db) {
+      return {firstStart: null, runningMs: 0};
+    }
+    const row = this.db.prepare(`
+      SELECT MIN(started) AS firstStart, COALESCE(SUM(last_seen - started), 0) AS runningMs
+      FROM server_runs
+      WHERE id IS NOT ?
+    `).get(excludeRunId == null ? -1 : excludeRunId);
+    return {firstStart: row.firstStart, runningMs: row.runningMs};
+  }
+
+  /**
+   * The requests counted against a module in (since, now], by endpoint and
+   * operation: [{endpoint, operation, count}]. A row is attributed to the
+   * time it was written, so the edges of the period are as fine as the
+   * collection interval (and ServerStats.flushNow() sharpens the near edge).
+   */
+  countsSince(since, now, module) {
+    if (!this.db) {
+      return [];
+    }
+    return this.db.prepare(`
+      SELECT endpoint, operation, SUM(count_delta) AS count
+      FROM request_counts
+      WHERE module = ? AND time > ? AND time <= ?
+      GROUP BY endpoint, operation
+    `).all(module, since, now);
+  }
+
   /**
    * Write one interval's worth of rows. All or nothing - if the transaction
    * fails the caller keeps its deltas and tries again next interval.

package/stats.js

@@ -43,6 +43,15 @@ class ModuleStats {
   get staticRequestCount() { return this.parent.staticRequestCount; }
   get history() { return this.parent.history; }
   get startTime() { return this.parent.startTime; }
+
+  /**
+   * What this module served in (since, now]: {total, operations: {name: count},
+   * endpoints: {endpoint: {name: count}}} - see ServerStats.countsSince(). This
+   * is what a module's dailyReport() builds its numbers from.
+   */
+  countsSince(since, now = Date.now()) {
+    return this.parent.countsSince(since, now, this.module);
+  }
 }
 
 class ServerStats {
@@ -62,6 +71,13 @@ class ServerStats {
   // key (module/endpoint/operation) -> counter. See countRequest().
   counters = new Map();
   db = null;
+  // this run's row in server_runs, and what the earlier runs add up to - see overallUptime()
+  runId = null;
+  earlierRuns = {firstStart: null, runningMs: 0};
+  // how often this run says "still alive"; a crash loses at most this much
+  // from the overall uptime figure
+  heartbeatMs = 60 * 1000;
+  heartbeat = null;
 
   constructor(config, log) {
     this.config = config || {};
@@ -146,16 +162,94 @@ class ServerStats {
     }
   }
 
-  markStarted() {
+  markStarted(version = null) {
     this.started = true;
+    this.version = version;
     this.startMem = process.memoryUsage().heapUsed;
     this.startTime = Date.now();
     this.lastTime = this.startTime;
     this.eventLoopMonitor = monitorEventLoopDelay({ resolution: 20 });
     this.eventLoopMonitor.enable();
+    this.startRun();
     this.recordMetrics();
   }
 
+  /**
+   * Record this run in the database and start the heartbeat that keeps its
+   * last_seen current. As with everything else here, a failure is logged and
+   * the overall uptime just isn't available for this run.
+   */
+  startRun() {
+    if (!this.db) {
+      return;
+    }
+    try {
+      this.runId = this.db.startRun(this.startTime, this.version);
+      this.earlierRuns = this.db.loadRunHistory(this.runId);
+    } catch (e) {
+      this.log.error(`Unable to record the server run: ${e.message}. Overall uptime will not be available`);
+      this.runId = null;
+      return;
+    }
+    this.heartbeat = setInterval(() => this.touchRun(), this.heartbeatMs);
+    if (typeof this.heartbeat.unref === 'function') {
+      this.heartbeat.unref();
+    }
+  }
+
+  /**
+   * The server's runs since `since`, oldest first, each {started, lastSeen,
+   * version, current}, preceded by the run before that (if any) - see
+   * StatsDatabase.loadRuns(). The current run is reported as seen now, not as
+   * of its last heartbeat. null if the history isn't being kept.
+   */
+  runHistory(since, now = Date.now()) {
+    if (this.runId == null) {
+      return null;
+    }
+    let runs;
+    try {
+      runs = this.db.loadRuns(since);
+    } catch (e) {
+      this.log.error(`Unable to read the server run history: ${e.message}`);
+      return null;
+    }
+    return runs.map(r => r.id === this.runId
+      ? {started: r.started, lastSeen: now, version: r.version, current: true}
+      : {started: r.started, lastSeen: r.lastSeen, version: r.version, current: false});
+  }
+
+  touchRun() {
+    if (this.db && this.runId != null) {
+      try {
+        this.db.touchRun(this.runId, Date.now());
+      } catch (e) {
+        this.log.error(`Unable to record the server heartbeat: ${e.message}`);
+      }
+    }
+  }
+
+  /**
+   * The proportion of time the server has been up, over every run recorded
+   * in the statistics database: time it was known to be running (each run,
+   * from its start to the last heartbeat it wrote, plus this run up to now)
+   * as a percentage of the time since the first recorded run started.
+   *
+   * Returns {percent, since} or null if the history isn't being kept.
+   */
+  overallUptime(now = Date.now()) {
+    if (this.runId == null) {
+      return null;
+    }
+    const since = this.earlierRuns.firstStart == null ? this.startTime : Math.min(this.earlierRuns.firstStart, this.startTime);
+    const elapsed = now - since;
+    if (elapsed <= 0) {
+      return {percent: 100, since: since};
+    }
+    const running = this.earlierRuns.runningMs + (now - this.startTime);
+    return {percent: Math.min(100, (running * 100) / elapsed), since: since};
+  }
+
   /**
    * The counter for one (module, endpoint, operation), created on first use.
    *
@@ -215,6 +309,7 @@ class ServerStats {
       }
     }
     if (rows.length === 0) {
+      this.lastFlush = now;
       return 0;
     }
     try {
@@ -227,9 +322,53 @@ class ServerStats {
       counter.countDelta = 0;
       counter.timeDelta = 0;
     }
+    this.lastFlush = now;
     return rows.length;
   }
 
+  /**
+   * Write out whatever has been counted since the last flush, so that a
+   * countsSince() up to `now` sees everything. Used by the daily report.
+   */
+  flushNow(now = Date.now()) {
+    this.flushCounters(now, now - (this.lastFlush || this.lastTime || this.startTime));
+  }
+
+  /**
+   * The requests a module served in (since, now], from the persisted rows plus
+   * anything counted since the last flush. Without the database only the
+   * unflushed counts are known, so persisted is false to say the numbers are
+   * partial.
+   */
+  countsSince(since, now, module) {
+    const result = {total: 0, operations: {}, endpoints: {}, persisted: Boolean(this.db)};
+    const add = (endpoint, operation, count) => {
+      if (!count) {
+        return;
+      }
+      result.total += count;
+      result.operations[operation] = (result.operations[operation] || 0) + count;
+      const ep = result.endpoints[endpoint] || (result.endpoints[endpoint] = {});
+      ep[operation] = (ep[operation] || 0) + count;
+    };
+    if (this.db) {
+      try {
+        for (const row of this.db.countsSince(since, now, module)) {
+          add(row.endpoint, row.operation, row.count);
+        }
+      } catch (e) {
+        this.log.error(`Unable to read request counts: ${e.message}`);
+        result.persisted = false;
+      }
+    }
+    for (const counter of this.counters.values()) {
+      if (counter.module === module) {
+        add(counter.endpoint, counter.operation, counter.countDelta);
+      }
+    }
+    return result;
+  }
+
   addTask(name, frequency) {
     let info = {};
     this.taskMap.set(name, info);
@@ -265,6 +404,19 @@ class ServerStats {
     }
   }
 
+  /**
+   * The background tasks whose last run failed: [{name, state, frequency, date}]
+   */
+  failedTasks() {
+    const failed = [];
+    for (const [name, info] of this.taskMap) {
+      if (info.status === 'error') {
+        failed.push({name: name, state: info.state, frequency: info.frequency, date: info.date});
+      }
+    }
+    return failed;
+  }
+
   taskDetails() {
     if (this.taskMap.size == 0) {
       return "";
@@ -290,6 +442,11 @@ class ServerStats {
 
   finishStats() {
     clearInterval(this.timer);
+    if (this.heartbeat) {
+      clearInterval(this.heartbeat);
+      this.heartbeat = null;
+    }
+    this.touchRun();
     // Synchronous, so the last partial interval is on disk before server.js
     // calls process.exit().
     this.flushCounters(Date.now(), Date.now() - (this.lastTime || this.startTime));

package/testing/readme.md

@@ -31,7 +31,7 @@ shown on any page.
 
 FHIRsmith's own tx test run writes its results as `test-cases-report.json` in the
 FHIRsmith root; `node utilities/submit-test-report.js [-server url] [-token token]` sends it
-to a /testing server (by default https://testing.fhir.org/testing).
+to a /testing server (by default https://npm.fhir.org/testing).
 
 ## Reading and searching
 

package/testing/search.js

@@ -60,113 +60,7 @@ const MODIFIERS = {
 // parameters that control the search rather than filter it
 const CONTROL = new Set(['_sort', '_count', '_offset', '_summary', '_format', '_total', '_pretty']);
 
-const PREFIXES = ['eq', 'ne', 'gt', 'lt', 'ge', 'le', 'sa', 'eb', 'ap'];
-
-const DATE_RE = /^(\d{4})(?:-(\d{2})(?:-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?)?)?$/;
-
-/**
- * The range of instants a FHIR date, dateTime or instant covers, as [lo, hi) in epoch
- * milliseconds. "2026" covers the whole year; "2026-09-24T10:00:00.5Z" covers 100ms.
- * A time with no zone is taken as UTC (FHIR requires a zone, but search values often
- * leave it off).
- *
- * @param {string} value
- * @returns {{lo: number, hi: number}|null} null if the value isn't a date
- */
-function dateRange(value) {
-  if (typeof value !== 'string') {
-    return null;
-  }
-  const m = DATE_RE.exec(value.trim());
-  if (!m) {
-    return null;
-  }
-  const [, y, mo, d, h, mi, s, frac, tz] = m;
-  const year = parseInt(y, 10);
-  if (!mo) {
-    return { lo: Date.UTC(year, 0, 1), hi: Date.UTC(year + 1, 0, 1) };
-  }
-  const month = parseInt(mo, 10) - 1;
-  if (month < 0 || month > 11) {
-    return null;
-  }
-  if (!d) {
-    return { lo: Date.UTC(year, month, 1), hi: Date.UTC(year, month + 1, 1) };
-  }
-  const day = parseInt(d, 10);
-  if (day < 1 || day > new Date(Date.UTC(year, month + 1, 0)).getUTCDate()) {
-    return null;
-  }
-  if (!h) {
-    return { lo: Date.UTC(year, month, day), hi: Date.UTC(year, month, day + 1) };
-  }
-  const zone = tz || 'Z';
-  const text = `${y}-${mo}-${d}T${h}:${mi}:${s || '00'}${frac || ''}${zone}`;
-  const lo = Date.parse(text);
-  if (Number.isNaN(lo) || parseInt(h, 10) > 23 || parseInt(mi, 10) > 59 || (s && parseInt(s, 10) > 59)) {
-    return null;
-  }
-  let width;
-  if (!s) {
-    width = 60000;
-  } else if (!frac) {
-    width = 1000;
-  } else {
-    // .5 is 100ms wide, .50 10ms, .500 and beyond 1ms
-    width = Math.max(1, Math.pow(10, 3 - (frac.length - 1)));
-  }
-  return { lo, hi: lo + width };
-}
-
-function splitPrefix(value) {
-  const p = value.substring(0, 2);
-  if (PREFIXES.includes(p) && value.length > 2 && !/^[a-z]/.test(value.substring(2))) {
-    return { prefix: p, rest: value.substring(2) };
-  }
-  return { prefix: 'eq', rest: value };
-}
-
-function escapeLike(value) {
-  return value.replace(/[\\%_]/g, (c) => '\\' + c);
-}
-
-/**
- * Split a parameter value on commas, honouring \, as an escaped comma.
- */
-function splitValues(value) {
-  const out = [];
-  let cur = '';
-  for (let i = 0; i < value.length; i++) {
-    const c = value[i];
-    if (c === '\\' && i + 1 < value.length) {
-      cur += value[i + 1];
-      i++;
-    } else if (c === ',') {
-      out.push(cur);
-      cur = '';
-    } else {
-      cur += c;
-    }
-  }
-  out.push(cur);
-  return out.filter(v => v.length > 0);
-}
-
-function dateClause(def, prefix, range) {
-  const { lo, hi } = def;
-  switch (prefix) {
-    case 'eq': return { sql: `(${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
-    case 'ne': return { sql: `NOT (${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
-    case 'gt': return { sql: `${hi} > ?`, args: [range.hi] };
-    case 'lt': return { sql: `${lo} < ?`, args: [range.lo] };
-    case 'ge': return { sql: `${hi} > ?`, args: [range.lo] };
-    case 'le': return { sql: `${lo} < ?`, args: [range.hi] };
-    case 'sa': return { sql: `${lo} >= ?`, args: [range.hi] };
-    case 'eb': return { sql: `${hi} <= ?`, args: [range.lo] };
-    case 'ap': return { sql: `(${lo} < ? AND ${hi} > ?)`, args: [range.hi, range.lo] };
-  }
-  return null;
-}
+const { dateRange, splitPrefix, escapeLike, splitValues, dateClause: dateRangeClause } = require('../library/fhir-search-values');
 
 function numberClause(col, prefix, text) {
   if (!/^[+-]?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(text)) {
@@ -230,7 +124,7 @@ function valueClause(def, modifier, value) {
     case 'date': {
       const { prefix, rest } = splitPrefix(value);
       const range = dateRange(rest);
-      return range ? dateClause(def, prefix, range) : null;
+      return range ? dateRangeClause(def, prefix, range) : null;
     }
   }
   return null;

package/testing/store.js

@@ -256,6 +256,11 @@ class TestReportStore {
     return this.stmts.count.get().n;
   }
 
+  /** How many reports were received in (sinceMs, nowMs] */
+  countReceived(sinceMs, nowMs) {
+    return this.db.prepare('SELECT COUNT(*) AS n FROM reports WHERE received_ms > ? AND received_ms <= ?').get(sinceMs, nowMs).n;
+  }
+
   /**
    * Run a parsed search (see search.js).
    *

package/testing/testing.js

@@ -286,6 +286,26 @@ class TestingModule {
     this.retentionTimer.unref();
   }
 
+  /**
+   * The paragraph for the server's daily report: pages served, reports received
+   * in the period, and how many are held.
+   */
+  dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    const sentences = [];
+    if (this.stats) {
+      const counts = this.stats.countsSince(since, now);
+      sentences.push(`${plural(counts.total, 'page')} ${counts.total === 1 ? 'was' : 'were'} served.`);
+    }
+    if (this.store) {
+      const received = this.store.countReceived(since, now);
+      sentences.push(`${plural(received, 'test report')} ${received === 1 ? 'was' : 'were'} received; ${plural(this.store.count(), 'report')} ${this.store.count() === 1 ? 'is' : 'are'} held.`);
+    } else {
+      sentences.push('The report store is not open.');
+    }
+    return sentences.join(' ');
+  }
+
   async shutdown() {
     if (this.retentionTimer) {
       clearInterval(this.retentionTimer);

package/token/token-template.html

@@ -150,23 +150,24 @@
 
 <div class="api-docs">
   <h4>API Documentation</h4>
-  <p>Use these endpoints to validate and track API key usage:</p>
+  <p>Use these endpoints to validate and track API key usage. Send the key in a header:
+    <code>Authorization: Bearer {api_key}</code> (or <code>X-API-Key: {api_key}</code>).</p>
   
   <div class="mb-3">
     <strong>Validate API Key:</strong>
-    <div class="api-endpoint">GET /token/api/validate/{api_key}</div>
+    <div class="api-endpoint">GET /token/api/validate</div>
     <p>Returns user information and allowed request count.</p>
   </div>
   
   <div class="mb-3">
     <strong>Record Usage:</strong>
-    <div class="api-endpoint">POST /token/api/usage/{api_key}</div>
+    <div class="api-endpoint">POST /token/api/usage</div>
     <p>Records API usage. Send <code>{"count": 1}</code> in request body.</p>
   </div>
   
   <div class="mb-3">
     <strong>Get Usage Statistics:</strong>
-    <div class="api-endpoint">GET /token/api/stats/{api_key}?days=30</div>
+    <div class="api-endpoint">GET /token/api/stats?days=30</div>
     <p>Returns usage statistics for the specified number of days.</p>
   </div>
 </div>