hebrah 0.8.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- hebrah-0.8.1/.env.example +3 -0
- hebrah-0.8.1/.github/dependabot.yml +11 -0
- hebrah-0.8.1/.github/workflows/ci.yml +52 -0
- hebrah-0.8.1/.gitignore +9 -0
- hebrah-0.8.1/LICENSE +21 -0
- hebrah-0.8.1/PKG-INFO +147 -0
- hebrah-0.8.1/PUBLISHING.md +49 -0
- hebrah-0.8.1/README.md +120 -0
- hebrah-0.8.1/SECURITY.md +31 -0
- hebrah-0.8.1/pyproject.toml +54 -0
- hebrah-0.8.1/scripts/smoke.py +36 -0
- hebrah-0.8.1/src/hebrah/__init__.py +15 -0
- hebrah-0.8.1/src/hebrah/client.py +515 -0
- hebrah-0.8.1/src/hebrah/errors.py +7 -0
- hebrah-0.8.1/src/hebrah/harness.py +125 -0
- hebrah-0.8.1/src/hebrah/py.typed +0 -0
- hebrah-0.8.1/src/hebrah/types.py +121 -0
- hebrah-0.8.1/src/hebrah/webhooks.py +33 -0
- hebrah-0.8.1/tests/test_client.py +254 -0
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [main]
|
|
6
|
+
tags:
|
|
7
|
+
- 'sdk-python-v*'
|
|
8
|
+
pull_request:
|
|
9
|
+
branches: [main]
|
|
10
|
+
|
|
11
|
+
jobs:
|
|
12
|
+
test:
|
|
13
|
+
runs-on: ubuntu-latest
|
|
14
|
+
strategy:
|
|
15
|
+
matrix:
|
|
16
|
+
python-version: ['3.10', '3.12']
|
|
17
|
+
steps:
|
|
18
|
+
- uses: actions/checkout@v4
|
|
19
|
+
- uses: actions/setup-python@v5
|
|
20
|
+
with:
|
|
21
|
+
python-version: ${{ matrix.python-version }}
|
|
22
|
+
- run: pip install --upgrade "setuptools>=83" pip
|
|
23
|
+
- run: pip install pip-audit "httpx>=0.27.0"
|
|
24
|
+
- run: pip-audit --strict
|
|
25
|
+
- run: pip install -e ".[dev]"
|
|
26
|
+
- run: ruff check src tests
|
|
27
|
+
- run: pytest
|
|
28
|
+
|
|
29
|
+
publish:
|
|
30
|
+
if: startsWith(github.ref, 'refs/tags/sdk-python-v')
|
|
31
|
+
needs: test
|
|
32
|
+
runs-on: ubuntu-latest
|
|
33
|
+
environment: pypi
|
|
34
|
+
permissions:
|
|
35
|
+
contents: read
|
|
36
|
+
id-token: write
|
|
37
|
+
steps:
|
|
38
|
+
- uses: actions/checkout@v4
|
|
39
|
+
- uses: actions/setup-python@v5
|
|
40
|
+
with:
|
|
41
|
+
python-version: '3.12'
|
|
42
|
+
- run: pip install build twine
|
|
43
|
+
- run: python -m build
|
|
44
|
+
- name: Publish with PyPI token
|
|
45
|
+
if: ${{ vars.PUBLISH_WITH_PYPI_TOKEN == 'true' }}
|
|
46
|
+
env:
|
|
47
|
+
TWINE_USERNAME: __token__
|
|
48
|
+
TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
|
|
49
|
+
run: twine upload dist/*
|
|
50
|
+
- name: Publish with OIDC
|
|
51
|
+
if: ${{ vars.PUBLISH_WITH_PYPI_TOKEN != 'true' }}
|
|
52
|
+
uses: pypa/gh-action-pypi-publish@release/v1
|
hebrah-0.8.1/.gitignore
ADDED
hebrah-0.8.1/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Hebrah, Inc.
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
hebrah-0.8.1/PKG-INFO
ADDED
|
@@ -0,0 +1,147 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: hebrah
|
|
3
|
+
Version: 0.8.1
|
|
4
|
+
Summary: Official Python SDK for the hebrah control plane API
|
|
5
|
+
Project-URL: Homepage, https://hebrah.com
|
|
6
|
+
Project-URL: Documentation, https://app.hebrah.com/docs/sdk
|
|
7
|
+
Project-URL: Repository, https://github.com/Hebrah-inc/hebrah-sdk-python
|
|
8
|
+
Author: hebrah
|
|
9
|
+
License-Expression: MIT
|
|
10
|
+
License-File: LICENSE
|
|
11
|
+
Keywords: fhir,healthcare,hebrah,sdk,webhooks
|
|
12
|
+
Classifier: Development Status :: 4 - Beta
|
|
13
|
+
Classifier: Intended Audience :: Developers
|
|
14
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
19
|
+
Classifier: Typing :: Typed
|
|
20
|
+
Requires-Python: >=3.10
|
|
21
|
+
Requires-Dist: httpx>=0.27.0
|
|
22
|
+
Provides-Extra: dev
|
|
23
|
+
Requires-Dist: pytest>=8.0.0; extra == 'dev'
|
|
24
|
+
Requires-Dist: respx>=0.21.0; extra == 'dev'
|
|
25
|
+
Requires-Dist: ruff>=0.9.0; extra == 'dev'
|
|
26
|
+
Description-Content-Type: text/markdown
|
|
27
|
+
|
|
28
|
+
# hebrah
|
|
29
|
+
|
|
30
|
+
Official Python SDK for the [hebrah](https://hebrah.com) control plane API (hebrah-api).
|
|
31
|
+
|
|
32
|
+
## Install
|
|
33
|
+
|
|
34
|
+
```bash
|
|
35
|
+
pip install hebrah
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
Requires **Python 3.10+**.
|
|
39
|
+
|
|
40
|
+
## Quick start
|
|
41
|
+
|
|
42
|
+
```python
|
|
43
|
+
import os
|
|
44
|
+
from hebrah import HebrahClient, verify_webhook_signature
|
|
45
|
+
|
|
46
|
+
with HebrahClient(
|
|
47
|
+
api_key=os.environ["HEBRAH_API_KEY"],
|
|
48
|
+
default_connection_id=os.environ.get("HEBRAH_CONNECTION_ID"),
|
|
49
|
+
) as client:
|
|
50
|
+
catalog = client.sandbox.catalog()
|
|
51
|
+
patient_id = catalog["sample_patient_ids"][0]
|
|
52
|
+
patient = client.sandbox.resource("Patient", patient_id)
|
|
53
|
+
|
|
54
|
+
client.webhooks.trigger_mock_event(
|
|
55
|
+
event="patient.admitted",
|
|
56
|
+
patient_id=patient_id,
|
|
57
|
+
)
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
> **v0.8:** `default_connection_id` is applied when sandbox methods omit `connection_id`. `client.patients.list()` / `get()` emit `DeprecationWarning` — use `sandbox.list_synthetic_resources("Patient")` instead.
|
|
61
|
+
|
|
62
|
+
### Webhook verification
|
|
63
|
+
|
|
64
|
+
```python
|
|
65
|
+
from hebrah import verify_webhook_signature
|
|
66
|
+
|
|
67
|
+
payload = verify_webhook_signature(
|
|
68
|
+
request.get_data(),
|
|
69
|
+
request.headers.get("X-Hebrah-Signature"),
|
|
70
|
+
webhook_secret,
|
|
71
|
+
)
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
## Security
|
|
75
|
+
|
|
76
|
+
- Store `HEBRAH_API_KEY` and `HEBRAH_WEBHOOK_SECRET` in server-side environment variables or a secrets manager only — never expose them to browsers or commit `.env` files.
|
|
77
|
+
- The SDK does not persist credentials; they live in memory for the lifetime of each `HebrahClient` instance.
|
|
78
|
+
- `base_url` must be `https://` in production, or `http://localhost` / `http://127.0.0.1` for local dev — other `http://` hosts are rejected at construction to reduce API-key exfiltration risk.
|
|
79
|
+
- Treat `HebrahApiError.detail` as operator-only diagnostics. Do not log or return it to end users — it may contain internal paths or sensitive API error payloads. Set `include_error_detail=False` on `HebrahClient` to omit `detail` from errors.
|
|
80
|
+
|
|
81
|
+
See [SECURITY.md](./SECURITY.md) for supported versions and vulnerability reporting.
|
|
82
|
+
|
|
83
|
+
## API surface (v0.8)
|
|
84
|
+
|
|
85
|
+
### Sandbox & resources
|
|
86
|
+
|
|
87
|
+
| Method | Description |
|
|
88
|
+
|--------|-------------|
|
|
89
|
+
| `client.health()` | `GET /health` (no API key on separate httpx call) |
|
|
90
|
+
| `client.sandbox.catalog(connection_id=None)` | `GET /v1/sandbox/catalog` — uses `default_connection_id` when omitted |
|
|
91
|
+
| `client.sandbox.domains()` | `GET /v1/sandbox/domains` |
|
|
92
|
+
| `client.sandbox.domain(domain_id)` | `GET /v1/sandbox/domains/{id}` |
|
|
93
|
+
| `client.sandbox.list_synthetic_resources(resource_type, connection_id=None)` | `GET /v1/sandbox/resources/{type}` |
|
|
94
|
+
| `client.sandbox.resource(resource_type, resource_id, patient_id=None)` | `GET /v1/sandbox/resources/{type}/{id}` |
|
|
95
|
+
| `client.sandbox.run_scenario(scenario_id, ...)` | `POST /v1/sandbox/scenarios/{id}/run` |
|
|
96
|
+
| `client.sandbox.synthetic_ehr_profile(connection_id=...)` | `GET /v1/sandbox/synthetic-ehr/profile` |
|
|
97
|
+
| `client.sandbox.list_ehr_models()` | `GET /v1/sandbox/ehr-models` |
|
|
98
|
+
| `client.sandbox.reset_synthetic_ehr(connection_id=...)` | `POST /v1/sandbox/synthetic-ehr/reset` |
|
|
99
|
+
| `client.sandbox.payer_rules(payer_id)` | `GET /v1/sandbox/payer-rules/{id}` |
|
|
100
|
+
| `client.patients.list(connection_id=None)` | **Deprecated** — `GET /v1/patients` |
|
|
101
|
+
| `client.patients.get(id, connection_id=None)` | **Deprecated** — `GET /v1/patients/{id}` |
|
|
102
|
+
|
|
103
|
+
### HL7, webhooks, interop
|
|
104
|
+
|
|
105
|
+
| Method | Description |
|
|
106
|
+
|--------|-------------|
|
|
107
|
+
| `client.sandbox.hl7_templates()` | `GET /v1/sandbox/hl7/templates` |
|
|
108
|
+
| `client.sandbox.inject_hl7(...)` | `POST /v1/sandbox/hl7/inject` |
|
|
109
|
+
| `client.sandbox.configure_webhook_reliability(**profile)` | `PATCH /v1/sandbox/webhook-reliability` |
|
|
110
|
+
| `client.sandbox.run_webhook_reliability_scenario(scenario_id, ...)` | `POST /v1/sandbox/scenarios/{id}/run` (alias) |
|
|
111
|
+
| `client.sandbox.run_mpi_match(...)` | `POST /v1/sandbox/mpi/match` |
|
|
112
|
+
| `client.sandbox.run_aggregator_query(...)` | `POST /v1/sandbox/aggregator/query` |
|
|
113
|
+
| `client.sandbox.get_practitioner_credentialing(practitioner_id)` | `GET /v1/sandbox/credentialing/practitioners/{id}` |
|
|
114
|
+
| `client.webhooks.trigger_mock_event(...)` | `POST /v1/webhooks/trigger-mock-event` |
|
|
115
|
+
| `client.webhooks.list_deliveries(...)` | `GET /v1/webhooks/deliveries` |
|
|
116
|
+
| `client.webhooks.replay_delivery(delivery_id)` | `POST /v1/webhooks/deliveries/{id}/replay` |
|
|
117
|
+
| `verify_webhook_signature(raw_body, signature, secret)` | Local HMAC-SHA256 verify |
|
|
118
|
+
|
|
119
|
+
### SMART & FHIR
|
|
120
|
+
|
|
121
|
+
| Method | Description |
|
|
122
|
+
|--------|-------------|
|
|
123
|
+
| `client.smart.launch(...)` | `POST /v1/smart/launch` |
|
|
124
|
+
| `client.smart.register_client(...)` | `POST /v1/smart/clients` |
|
|
125
|
+
| `client.smart.exchange_token(...)` | `POST /oauth/token` (form-encoded; no API key) |
|
|
126
|
+
| `client.fhir.read_patient(patient_id, access_token)` | `GET /fhir/R4/Patient/{id}` (SMART access token) |
|
|
127
|
+
|
|
128
|
+
### Advanced: BYOM agent harness
|
|
129
|
+
|
|
130
|
+
`HebrahAgentHarness` is exported for bring-your-own-model EHR workflows (MCP + integration-agent). It is **not** part of the core integrator quick start — harness improvements are tracked separately from the core client.
|
|
131
|
+
|
|
132
|
+
## Configuration
|
|
133
|
+
|
|
134
|
+
| Variable | Description |
|
|
135
|
+
|----------|-------------|
|
|
136
|
+
| `HEBRAH_API_KEY` | Pass to `HebrahClient(api_key=...)` |
|
|
137
|
+
| `HEBRAH_API_BASE_URL` | Optional; default `https://api.hebrah.com` |
|
|
138
|
+
| `HEBRAH_CONNECTION_ID` | Optional; pass to `default_connection_id` for sandbox reads |
|
|
139
|
+
| `HEBRAH_WEBHOOK_SECRET` | For `verify_webhook_signature` |
|
|
140
|
+
|
|
141
|
+
## Docs
|
|
142
|
+
|
|
143
|
+
Full integrator reference: [hebrah-app `/docs/sdk`](https://app.hebrah.com/docs/sdk).
|
|
144
|
+
|
|
145
|
+
## License
|
|
146
|
+
|
|
147
|
+
MIT
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
# Publishing hebrah
|
|
2
|
+
|
|
3
|
+
## Prerequisites
|
|
4
|
+
|
|
5
|
+
1. PyPI account and project name `hebrah` registered (or use TestPyPI first).
|
|
6
|
+
2. **Preferred:** trusted publishing (OIDC) configured on PyPI for `Hebrah-inc/hebrah-sdk-python`, using the `pypi` GitHub Environment.
|
|
7
|
+
3. **Fallback:** set repository variable `PUBLISH_WITH_PYPI_TOKEN=true` and add `PYPI_API_TOKEN` as a secret on the `pypi` environment.
|
|
8
|
+
|
|
9
|
+
## Release
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
git tag sdk-python-v0.8.0
|
|
13
|
+
git push origin main
|
|
14
|
+
git push origin sdk-python-v0.8.0
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
GitHub Actions publishes on tags matching `sdk-python-v*`.
|
|
18
|
+
|
|
19
|
+
### Publish authentication
|
|
20
|
+
|
|
21
|
+
| Mode | Setup |
|
|
22
|
+
|------|--------|
|
|
23
|
+
| OIDC (default) | Configure PyPI trusted publishing; leave `PUBLISH_WITH_PYPI_TOKEN` unset or `false` |
|
|
24
|
+
| PyPI token fallback | Set repo variable `PUBLISH_WITH_PYPI_TOKEN=true` and `PYPI_API_TOKEN` secret on the `pypi` environment |
|
|
25
|
+
|
|
26
|
+
Do not set `TWINE_PASSWORD` unconditionally when using OIDC — it overrides the OIDC token and breaks publish.
|
|
27
|
+
|
|
28
|
+
## Local publish (optional)
|
|
29
|
+
|
|
30
|
+
```bash
|
|
31
|
+
pip install build twine
|
|
32
|
+
python -m build
|
|
33
|
+
twine upload dist/*
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## Smoke test after publish
|
|
37
|
+
|
|
38
|
+
```bash
|
|
39
|
+
pip install hebrah==0.8.0
|
|
40
|
+
HEBRAH_API_BASE_URL=http://localhost:8000 HEBRAH_API_KEY=hb_test_your_key python scripts/smoke.py
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
## First-time PyPI setup checklist
|
|
44
|
+
|
|
45
|
+
1. Register the `hebrah` project on [pypi.org](https://pypi.org) if it does not exist.
|
|
46
|
+
2. Create GitHub Environment `pypi` on `Hebrah-inc/hebrah-sdk-python`.
|
|
47
|
+
3. Add trusted publishing: PyPI project settings → link GitHub repo `Hebrah-inc/hebrah-sdk-python`, workflow `CI`, environment `pypi`.
|
|
48
|
+
4. Make the GitHub repo **public** (referenced in `pyproject.toml` `Repository`).
|
|
49
|
+
5. Push tag `sdk-python-v0.8.0` and verify the package appears at `https://pypi.org/project/hebrah/`.
|
hebrah-0.8.1/README.md
ADDED
|
@@ -0,0 +1,120 @@
|
|
|
1
|
+
# hebrah
|
|
2
|
+
|
|
3
|
+
Official Python SDK for the [hebrah](https://hebrah.com) control plane API (hebrah-api).
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
pip install hebrah
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Requires **Python 3.10+**.
|
|
12
|
+
|
|
13
|
+
## Quick start
|
|
14
|
+
|
|
15
|
+
```python
|
|
16
|
+
import os
|
|
17
|
+
from hebrah import HebrahClient, verify_webhook_signature
|
|
18
|
+
|
|
19
|
+
with HebrahClient(
|
|
20
|
+
api_key=os.environ["HEBRAH_API_KEY"],
|
|
21
|
+
default_connection_id=os.environ.get("HEBRAH_CONNECTION_ID"),
|
|
22
|
+
) as client:
|
|
23
|
+
catalog = client.sandbox.catalog()
|
|
24
|
+
patient_id = catalog["sample_patient_ids"][0]
|
|
25
|
+
patient = client.sandbox.resource("Patient", patient_id)
|
|
26
|
+
|
|
27
|
+
client.webhooks.trigger_mock_event(
|
|
28
|
+
event="patient.admitted",
|
|
29
|
+
patient_id=patient_id,
|
|
30
|
+
)
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
> **v0.8:** `default_connection_id` is applied when sandbox methods omit `connection_id`. `client.patients.list()` / `get()` emit `DeprecationWarning` — use `sandbox.list_synthetic_resources("Patient")` instead.
|
|
34
|
+
|
|
35
|
+
### Webhook verification
|
|
36
|
+
|
|
37
|
+
```python
|
|
38
|
+
from hebrah import verify_webhook_signature
|
|
39
|
+
|
|
40
|
+
payload = verify_webhook_signature(
|
|
41
|
+
request.get_data(),
|
|
42
|
+
request.headers.get("X-Hebrah-Signature"),
|
|
43
|
+
webhook_secret,
|
|
44
|
+
)
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## Security
|
|
48
|
+
|
|
49
|
+
- Store `HEBRAH_API_KEY` and `HEBRAH_WEBHOOK_SECRET` in server-side environment variables or a secrets manager only — never expose them to browsers or commit `.env` files.
|
|
50
|
+
- The SDK does not persist credentials; they live in memory for the lifetime of each `HebrahClient` instance.
|
|
51
|
+
- `base_url` must be `https://` in production, or `http://localhost` / `http://127.0.0.1` for local dev — other `http://` hosts are rejected at construction to reduce API-key exfiltration risk.
|
|
52
|
+
- Treat `HebrahApiError.detail` as operator-only diagnostics. Do not log or return it to end users — it may contain internal paths or sensitive API error payloads. Set `include_error_detail=False` on `HebrahClient` to omit `detail` from errors.
|
|
53
|
+
|
|
54
|
+
See [SECURITY.md](./SECURITY.md) for supported versions and vulnerability reporting.
|
|
55
|
+
|
|
56
|
+
## API surface (v0.8)
|
|
57
|
+
|
|
58
|
+
### Sandbox & resources
|
|
59
|
+
|
|
60
|
+
| Method | Description |
|
|
61
|
+
|--------|-------------|
|
|
62
|
+
| `client.health()` | `GET /health` (no API key on separate httpx call) |
|
|
63
|
+
| `client.sandbox.catalog(connection_id=None)` | `GET /v1/sandbox/catalog` — uses `default_connection_id` when omitted |
|
|
64
|
+
| `client.sandbox.domains()` | `GET /v1/sandbox/domains` |
|
|
65
|
+
| `client.sandbox.domain(domain_id)` | `GET /v1/sandbox/domains/{id}` |
|
|
66
|
+
| `client.sandbox.list_synthetic_resources(resource_type, connection_id=None)` | `GET /v1/sandbox/resources/{type}` |
|
|
67
|
+
| `client.sandbox.resource(resource_type, resource_id, patient_id=None)` | `GET /v1/sandbox/resources/{type}/{id}` |
|
|
68
|
+
| `client.sandbox.run_scenario(scenario_id, ...)` | `POST /v1/sandbox/scenarios/{id}/run` |
|
|
69
|
+
| `client.sandbox.synthetic_ehr_profile(connection_id=...)` | `GET /v1/sandbox/synthetic-ehr/profile` |
|
|
70
|
+
| `client.sandbox.list_ehr_models()` | `GET /v1/sandbox/ehr-models` |
|
|
71
|
+
| `client.sandbox.reset_synthetic_ehr(connection_id=...)` | `POST /v1/sandbox/synthetic-ehr/reset` |
|
|
72
|
+
| `client.sandbox.payer_rules(payer_id)` | `GET /v1/sandbox/payer-rules/{id}` |
|
|
73
|
+
| `client.patients.list(connection_id=None)` | **Deprecated** — `GET /v1/patients` |
|
|
74
|
+
| `client.patients.get(id, connection_id=None)` | **Deprecated** — `GET /v1/patients/{id}` |
|
|
75
|
+
|
|
76
|
+
### HL7, webhooks, interop
|
|
77
|
+
|
|
78
|
+
| Method | Description |
|
|
79
|
+
|--------|-------------|
|
|
80
|
+
| `client.sandbox.hl7_templates()` | `GET /v1/sandbox/hl7/templates` |
|
|
81
|
+
| `client.sandbox.inject_hl7(...)` | `POST /v1/sandbox/hl7/inject` |
|
|
82
|
+
| `client.sandbox.configure_webhook_reliability(**profile)` | `PATCH /v1/sandbox/webhook-reliability` |
|
|
83
|
+
| `client.sandbox.run_webhook_reliability_scenario(scenario_id, ...)` | `POST /v1/sandbox/scenarios/{id}/run` (alias) |
|
|
84
|
+
| `client.sandbox.run_mpi_match(...)` | `POST /v1/sandbox/mpi/match` |
|
|
85
|
+
| `client.sandbox.run_aggregator_query(...)` | `POST /v1/sandbox/aggregator/query` |
|
|
86
|
+
| `client.sandbox.get_practitioner_credentialing(practitioner_id)` | `GET /v1/sandbox/credentialing/practitioners/{id}` |
|
|
87
|
+
| `client.webhooks.trigger_mock_event(...)` | `POST /v1/webhooks/trigger-mock-event` |
|
|
88
|
+
| `client.webhooks.list_deliveries(...)` | `GET /v1/webhooks/deliveries` |
|
|
89
|
+
| `client.webhooks.replay_delivery(delivery_id)` | `POST /v1/webhooks/deliveries/{id}/replay` |
|
|
90
|
+
| `verify_webhook_signature(raw_body, signature, secret)` | Local HMAC-SHA256 verify |
|
|
91
|
+
|
|
92
|
+
### SMART & FHIR
|
|
93
|
+
|
|
94
|
+
| Method | Description |
|
|
95
|
+
|--------|-------------|
|
|
96
|
+
| `client.smart.launch(...)` | `POST /v1/smart/launch` |
|
|
97
|
+
| `client.smart.register_client(...)` | `POST /v1/smart/clients` |
|
|
98
|
+
| `client.smart.exchange_token(...)` | `POST /oauth/token` (form-encoded; no API key) |
|
|
99
|
+
| `client.fhir.read_patient(patient_id, access_token)` | `GET /fhir/R4/Patient/{id}` (SMART access token) |
|
|
100
|
+
|
|
101
|
+
### Advanced: BYOM agent harness
|
|
102
|
+
|
|
103
|
+
`HebrahAgentHarness` is exported for bring-your-own-model EHR workflows (MCP + integration-agent). It is **not** part of the core integrator quick start — harness improvements are tracked separately from the core client.
|
|
104
|
+
|
|
105
|
+
## Configuration
|
|
106
|
+
|
|
107
|
+
| Variable | Description |
|
|
108
|
+
|----------|-------------|
|
|
109
|
+
| `HEBRAH_API_KEY` | Pass to `HebrahClient(api_key=...)` |
|
|
110
|
+
| `HEBRAH_API_BASE_URL` | Optional; default `https://api.hebrah.com` |
|
|
111
|
+
| `HEBRAH_CONNECTION_ID` | Optional; pass to `default_connection_id` for sandbox reads |
|
|
112
|
+
| `HEBRAH_WEBHOOK_SECRET` | For `verify_webhook_signature` |
|
|
113
|
+
|
|
114
|
+
## Docs
|
|
115
|
+
|
|
116
|
+
Full integrator reference: [hebrah-app `/docs/sdk`](https://app.hebrah.com/docs/sdk).
|
|
117
|
+
|
|
118
|
+
## License
|
|
119
|
+
|
|
120
|
+
MIT
|
hebrah-0.8.1/SECURITY.md
ADDED
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported versions
|
|
4
|
+
|
|
5
|
+
| Version | Supported |
|
|
6
|
+
| ------- | --------- |
|
|
7
|
+
| 0.8.x | Yes |
|
|
8
|
+
|
|
9
|
+
## Reporting a vulnerability
|
|
10
|
+
|
|
11
|
+
Please report security issues privately to **security@hebrah.com**.
|
|
12
|
+
|
|
13
|
+
Include:
|
|
14
|
+
|
|
15
|
+
- A description of the issue and potential impact
|
|
16
|
+
- Steps to reproduce
|
|
17
|
+
- Affected SDK version(s)
|
|
18
|
+
|
|
19
|
+
We aim to acknowledge reports within 2 business days. Do not open public GitHub issues for undisclosed vulnerabilities.
|
|
20
|
+
|
|
21
|
+
## Scope
|
|
22
|
+
|
|
23
|
+
This SDK is a thin HTTP client for the hebrah control plane API. It does not store credentials; callers supply API keys and webhook secrets at runtime.
|
|
24
|
+
|
|
25
|
+
## Integrator guidance
|
|
26
|
+
|
|
27
|
+
- Keep `HEBRAH_API_KEY`, `HEBRAH_WEBHOOK_SECRET`, and MCP PATs in server-side environment variables or a secrets manager — never in client-side code, browser bundles, or committed `.env` files.
|
|
28
|
+
- Do not log API keys, webhook secrets, or raw webhook payloads containing PHI.
|
|
29
|
+
- `HebrahApiError.detail` contains the raw control-plane response body for operator diagnostics. Do not return or log `detail` to end users or untrusted clients. Pass `include_error_detail=False` to `HebrahClient` to omit `detail` from thrown errors.
|
|
30
|
+
- `base_url` must use `https://` or `http://localhost` / `http://127.0.0.1` for local development; other `http://` hosts are rejected at client construction.
|
|
31
|
+
- The SDK holds credentials only in memory for the lifetime of a `HebrahClient` instance; it does not write them to disk or cache them.
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["hatchling"]
|
|
3
|
+
build-backend = "hatchling.build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "hebrah"
|
|
7
|
+
version = "0.8.1"
|
|
8
|
+
description = "Official Python SDK for the hebrah control plane API"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = "MIT"
|
|
11
|
+
requires-python = ">=3.10"
|
|
12
|
+
keywords = ["hebrah", "healthcare", "fhir", "webhooks", "sdk"]
|
|
13
|
+
authors = [{ name = "hebrah" }]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 4 - Beta",
|
|
16
|
+
"Intended Audience :: Developers",
|
|
17
|
+
"License :: OSI Approved :: MIT License",
|
|
18
|
+
"Programming Language :: Python :: 3",
|
|
19
|
+
"Programming Language :: Python :: 3.10",
|
|
20
|
+
"Programming Language :: Python :: 3.11",
|
|
21
|
+
"Programming Language :: Python :: 3.12",
|
|
22
|
+
"Typing :: Typed",
|
|
23
|
+
]
|
|
24
|
+
dependencies = [
|
|
25
|
+
"httpx>=0.27.0",
|
|
26
|
+
]
|
|
27
|
+
|
|
28
|
+
[project.optional-dependencies]
|
|
29
|
+
dev = [
|
|
30
|
+
"pytest>=8.0.0",
|
|
31
|
+
"respx>=0.21.0",
|
|
32
|
+
"ruff>=0.9.0",
|
|
33
|
+
]
|
|
34
|
+
|
|
35
|
+
[project.urls]
|
|
36
|
+
Homepage = "https://hebrah.com"
|
|
37
|
+
Documentation = "https://app.hebrah.com/docs/sdk"
|
|
38
|
+
Repository = "https://github.com/Hebrah-inc/hebrah-sdk-python"
|
|
39
|
+
|
|
40
|
+
[tool.hatch.build.targets.wheel]
|
|
41
|
+
packages = ["src/hebrah"]
|
|
42
|
+
|
|
43
|
+
[tool.hatch.build.targets.wheel.force-include]
|
|
44
|
+
"SECURITY.md" = "SECURITY.md"
|
|
45
|
+
|
|
46
|
+
[tool.ruff]
|
|
47
|
+
line-length = 100
|
|
48
|
+
target-version = "py310"
|
|
49
|
+
|
|
50
|
+
[tool.ruff.lint]
|
|
51
|
+
select = ["E", "F", "I", "UP"]
|
|
52
|
+
|
|
53
|
+
[tool.pytest.ini_options]
|
|
54
|
+
testpaths = ["tests"]
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
#!/usr/bin/env python3
|
|
2
|
+
"""Smoke test against a local or staging hebrah-api instance."""
|
|
3
|
+
|
|
4
|
+
from __future__ import annotations
|
|
5
|
+
|
|
6
|
+
import os
|
|
7
|
+
import sys
|
|
8
|
+
|
|
9
|
+
from hebrah import HebrahClient
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
def main() -> None:
|
|
13
|
+
api_key = os.environ.get("HEBRAH_API_KEY")
|
|
14
|
+
if not api_key:
|
|
15
|
+
print(
|
|
16
|
+
"HEBRAH_API_KEY is required (use SEED_API_KEY from scripts/generate-local-secrets.sh)",
|
|
17
|
+
file=sys.stderr,
|
|
18
|
+
)
|
|
19
|
+
sys.exit(1)
|
|
20
|
+
|
|
21
|
+
base_url = os.environ.get("HEBRAH_API_BASE_URL", "http://localhost:8000")
|
|
22
|
+
|
|
23
|
+
with HebrahClient(api_key=api_key, base_url=base_url) as client:
|
|
24
|
+
health = client.health()
|
|
25
|
+
print("health:", health.get("status"))
|
|
26
|
+
|
|
27
|
+
catalog = client.sandbox.catalog()
|
|
28
|
+
patient_id = catalog["sample_patient_ids"][0]
|
|
29
|
+
patient = client.sandbox.resource("Patient", patient_id)
|
|
30
|
+
print("patient:", patient.get("resourceType"), patient.get("id"))
|
|
31
|
+
|
|
32
|
+
print("smoke ok")
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
if __name__ == "__main__":
|
|
36
|
+
main()
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
from hebrah.client import HebrahClient
|
|
2
|
+
from hebrah.errors import HebrahApiError
|
|
3
|
+
from hebrah.harness import HebrahAgentHarness
|
|
4
|
+
from hebrah.types import DEFAULT_BASE_URL
|
|
5
|
+
from hebrah.webhooks import verify_webhook_signature
|
|
6
|
+
|
|
7
|
+
__all__ = [
|
|
8
|
+
"DEFAULT_BASE_URL",
|
|
9
|
+
"HebrahAgentHarness",
|
|
10
|
+
"HebrahApiError",
|
|
11
|
+
"HebrahClient",
|
|
12
|
+
"verify_webhook_signature",
|
|
13
|
+
]
|
|
14
|
+
|
|
15
|
+
__version__ = "0.8.1"
|