Castor Beta API

openapi: 3.2.0
info:
  version: 2026.1.6.1
  title: Castor EDC API Documentation Beta API
  description: '### Overview

    This document provides the specifications of the Castor EDC API, describing the currently available

    API endpoints and methods. We aim to provide a fully functional RESTful API to communicate with

    Castor EDC and these are endpoints currently available.


    The formal OpenAPI 2 specification by which this page is rendered is also available in the following formats:

    * YAML

    * JSON

    * JSON (pretty print)


    ### Authentication & Authorization with OAuth 2

    Authentication and authorization are arranged through OAuth2. We currently provide full support for the Client

    Credentials flow. The Authorization Code flow is supported, but we ask you to contact us if you want to use this flow.


    To use the Client Credentials flow go to your

    Castor EDC profile and generate

    a Client ID and Client Secret. Use the Client ID and Client Secret to retrieve an access token by making a request to

    the ''/oauth/token'' endpoint with your client_id and client_secret as parameters and grant_type=client_credentials.


    PHP Example:

    ```php

    include __DIR__.''/vendor/autoload.php'';

    use Guzzle\Http\Client;


    // Create the HTTP Client.

    $httpClient = new Client(

    ''https://data.castoredc.com'',

    [

    ''request.options'' => [

    ''exceptions'' => false,

    ]

    ]

    );


    // Build the request

    $request = $httpClient->post(

    ''/oauth/token'',

    null,

    [

    ''client_id'' => ''YourCastorClientId'',

    ''client_secret'' => ''YourCastorClientSecret'',

    ''grant_type'' => ''client_credentials'',

    ]

    );


    // Send the request

    $response = $request->send();

    $responseBody = $response->getBody(true);

    $responseArr = json_decode($responseBody, true);

    $accessToken = $responseArr[''access_token''];

    ```


    In your subsequent requests you can use the `$accessToken` as a Bearer token in the Authorization header, i.e:

    ```php

    $request = $httpClient->get(''/api/user'');

    $request->addHeader(''Authorization'', ''Bearer ''. $accessToken);

    $response = $request->send();

    echo $response->getBody();

    ```


    ### OAuth2 Scopes


    There are 3 scopes that endpoints may support.

    * **default**: allows access to all endpoints

    * **study_statistics**: allows access to study statistics

    * **record**: allows access to data for a single participant


    Due to a bug in the OpenAPI UI, all three scopes are listed for all endpoints.


    If the endpoint supports something other than the default scope, the summary will have a 🔭 emoji and the scope will be

    listed in the description as well as under the `security:` key in the specification.


    ### Rate Limits

    Unless specified in the resource, endpoints are rate-limited to 600 requests in 10 minutes.


    ### Legacy (Basic HTTP Authentication)

    **Please note: Basic HTTP Authentication has been removed on 2019 August 13**


    ### Changelog

    API changes can be viewed here'
  contact:
    name: support@castoredc.com
servers:
- url: https://data.castoredc.com/api/
security:
- OAuth2ClientCredentials:
  - default
  - study_statistics
  - record
tags:


# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/castoredc/refs/heads/main/openapi/castoredc-beta-api-openapi.yml