Castor Verification API

openapi: 3.2.0
info:
  version: 2026.1.6.1
  title: Castor EDC API Documentation Verification API
  description: '### Overview

    This document provides the specifications of the Castor EDC API, describing the currently available

    API endpoints and methods. We aim to provide a fully functional RESTful API to communicate with

    Castor EDC and these are endpoints currently available.


    The formal OpenAPI 2 specification by which this page is rendered is also available in the following formats:

    * YAML

    * JSON

    * JSON (pretty print)


    ### Authentication & Authorization with OAuth 2

    Authentication and authorization are arranged through OAuth2. We currently provide full support for the Client

    Credentials flow. The Authorization Code flow is supported, but we ask you to contact us if you want to use this flow.


    To use the Client Credentials flow go to your

    Castor EDC profile and generate

    a Client ID and Client Secret. Use the Client ID and Client Secret to retrieve an access token by making a request to

    the ''/oauth/token'' endpoint with your client_id and client_secret as parameters and grant_type=client_credentials.


    PHP Example:

    ```php

    include __DIR__.''/vendor/autoload.php'';

    use Guzzle\Http\Client;


    // Create the HTTP Client.

    $httpClient = new Client(

    ''https://data.castoredc.com'',

    [

    ''request.options'' => [

    ''exceptions'' => false,

    ]

    ]

    );


    // Build the request

    $request = $httpClient->post(

    ''/oauth/token'',

    null,

    [

    ''client_id'' => ''YourCastorClientId'',

    ''client_secret'' => ''YourCastorClientSecret'',

    ''grant_type'' => ''client_credentials'',

    ]

    );


    // Send the request

    $response = $request->send();

    $responseBody = $response->getBody(true);

    $responseArr = json_decode($responseBody, true);

    $accessToken = $responseArr[''access_token''];

    ```


    In your subsequent requests you can use the `$accessToken` as a Bearer token in the Authorization header, i.e:

    ```php

    $request = $httpClient->get(''/api/user'');

    $request->addHeader(''Authorization'', ''Bearer ''. $accessToken);

    $response = $request->send();

    echo $response->getBody();

    ```


    ### OAuth2 Scopes


    There are 3 scopes that endpoints may support.

    * **default**: allows access to all endpoints

    * **study_statistics**: allows access to study statistics

    * **record**: allows access to data for a single participant


    Due to a bug in the OpenAPI UI, all three scopes are listed for all endpoints.


    If the endpoint supports something other than the default scope, the summary will have a 🔭 emoji and the scope will be

    listed in the description as well as under the `security:` key in the specification.


    ### Rate Limits

    Unless specified in the resource, endpoints are rate-limited to 600 requests in 10 minutes.


    ### Legacy (Basic HTTP Authentication)

    **Please note: Basic HTTP Authentication has been removed on 2019 August 13**


    ### Changelog

    API changes can be viewed here'
  contact:
    name: support@castoredc.com
servers:
- url: https://data.castoredc.com/api/
security:
- OAuth2ClientCredentials:
  - default
  - study_statistics
  - record
tags:
- name: Verification
paths:
  /study/{study_id}/verification:
    get:
      tags:
      - Verification
      summary: Retrieve list of study verifications
      security:
      - OAuth2ClientCredentials:
        - default
      description: Gets `Verification` objects. Can be paged
      parameters:
      - name: study_id
        in: path
        description: The ID of the study for which this call should be made
        required: true
        schema:
          type: string
          format: UUID
      - name: record_id
        in: query
        description: Filter verifications based on record id
        required: false
        schema:
          type: string
      - name: date_from
        in: query
        description: Filter verifications with verification date higher or equal than provided
        required: false
        schema:
          type: string
      - name: date_to
        in: query
        description: Filter verifications with verification date lower or equal than provided
        required: false
        schema:
          type: string
      - name: verification_type
        in: query
        description: Filter verifications based on a comma separated list of verification type ids
        required: false
        schema:
          type: string
      - name: entity_type
        in: query
        description: Filter verifications based on a comma separated list of entity types. Valid values are 'report step', 'field', 'step'
        required: false
        schema:
          type: string
      - name: page
        in: query
        description: The page to retrieve
        required: false
        schema:
          type: integer
          default: 1
      responses:
        200:
          description: List of all Verifications of the Study
          content:
            application/hal+json:
              schema:
                title: Verifications HalJSON representation
                type: object
                properties:
                  _links:
                    $ref: '#/components/schemas/LinksCollection'
                  _embedded:
                    type: object
                    properties:
                      verifications:
                        type: array
                        items:
                          $ref: '#/components/schemas/Verification'
                  page_count:
                    type: integer
                  page_size:
                    type: integer
                  total_items:
                    type: integer
                  page:
                    type: integer
        403:
          description: Not allowed to view verifications for this study.
          content:
            application/hal+json:
              schema:
                $ref: '#/components/schemas/Error'
        422:
          description: Unprocessable entity - see error details for more information.
          content:
            application/hal+json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Unexpected error
          content:
            application/hal+json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getStudyByStudyIdVerification
      x-operation-id-source: derived
components:
  schemas:
    DateTime:
      type: object
      description: A serialized PHP DateTime object.
      properties:
        date:
          type: string
          description: Date and time in Y-m-d H:i:s.u format.
        timezone_type:
          type: integer
        timezone:
          type: string
    LinksCollection:
      type: object
      properties:
        self:
          type: object
          properties:
            href:
              type: string
        first:
          type: object
          properties:
            href:
              type: string
        last:
          type: object
          properties:
            href:
              type: string
        next:
          type: object
          properties:
            href:
              type: string
    Verification:
      type: object
      properties:
        id:
          type: integer
          minimum: 1
        record_id:
          type: string
        entity_type:
          type: string
        entity_id:
          type: string
          format: uuid
        parent_id:
          type: string
        verification_type:
          $ref: '#/components/schemas/VerificationType'
        status:
          type: string
          description: The status of the verification, can be 'active' or 'dropped'
        verified_on:
          $ref: '#/components/schemas/DateTime'
        verified_by:
          type: string
          format: uuid
        dropped_on:
          $ref: '#/components/schemas/DateTime'
        dropped_by:
          type: string
          format: uuid
        changed_field:
          type: string
        _links:
          $ref: '#/components/schemas/LinksSingle'
    LinksSingle:
      type: object
      properties:
        self:
          type: object
          properties:
            href:
              type: string
    Error:
      type: object
      properties:
        status:
          type: integer
          format: int32
          description: The HTTP return code.
        title:
          type: string
          description: The short error description belonging to the status code
        detail:
          type: string
          description: The detailed explanation of the failure
        type:
          type: string
          description: URL to RFC explaining this statuscode
        errors:
          type: object
          description: Optional list of all errors that occurred during the request
        validation_messages:
          type: object
          description: Optional list of validation failure message
    VerificationType:
      type: object
      properties:
        id:
          type: integer
          minimum: 1
        name:
          type: string
        is_sdv:
          type: boolean
  securitySchemes:
    OAuth2ClientCredentials:
      type: oauth2
      flows:
        clientCredentials:
          scopes:
            default: Grants access to everything
            study_statistics: Grants access to a study's statistics
            record: Grants access to the data for a single participant; intended for use by study subjects
          tokenUrl: https://data.castoredc.com/oauth/token
x-provenance:
  method: harvested
  publisher: Castor
  source: https://data.castoredc.com/api/swagger
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)