Payer enrollment status, pushed into your platform

curl -X POST https://www.licium.ai/v1/payer-follow-ups \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6f1c2e8a-3b5d-4c7e-9a1f-0d2b4c6e8a10" \
  -d '{
    "email": "owner@brighttherapy.com",
    "company": "Bright Therapy Group",
    "plan": "per_application",
    "access": ["call_only"],
    "applications": [
      { "npi": "1234567893", "payer": "Aetna", "state": "TX",
        "submitted_on": "2026-09-14", "payer_reference": "APP-55102" },
      { "npi": "1234567893", "payer": "Cigna", "state": "TX",
        "submitted_on": "2026-09-10", "check_every_days": 1 }
    ],
    "check_every_days": 2,
    "notify": "platform_only",
    "notify_email": "credentialing@yourplatform.com",
    "webhook_url": "https://hooks.yourplatform.com/licium"
  }'

// Node 18 or later (fetch is built in).
import { randomUUID } from "node:crypto";
const BASE = "https://www.licium.ai";

// One key per follow-up: store it with the practice before sending, and send the same key on a retry.
const idempotencyKey = randomUUID();
const res = await fetch(`${BASE}/v1/payer-follow-ups`, {
  method: "POST",
  headers: { "Content-Type": "application/json", "Idempotency-Key": idempotencyKey },
  body: JSON.stringify({
    email: "owner@brighttherapy.com",
    company: "Bright Therapy Group",
    plan: "per_application",
    access: ["call_only"],
    applications: [
      { npi: "1234567893", payer: "Aetna", state: "TX", submitted_on: "2026-09-14", payer_reference: "APP-55102" },
    ],
    check_every_days: 2,
    notify: "platform_only",
    notify_email: "credentialing@yourplatform.com",
    webhook_url: "https://hooks.yourplatform.com/licium",
  }),
});
const reply = await res.json();
if (!reply.success) {
  // 400: reply.error says what to fix; reply.invalid_entries lists each entry that cannot be used.
  throw new Error(`${res.status}: ${reply.error} ${JSON.stringify(reply.invalid_entries ?? [])}`);
}
// Store these three now: access_token and webhook.secret are never shown again.
const { account_id, access_token, checkout_url, webhook } = reply.data;
// Pay at checkout_url (or send whoever pays there). Nothing is checked until the payment settles.

{
  "success": true,
  "data": {
    "account_id": "8f2d4c1a-6b3e-4f7a-9c21-5d0e8b7a3f10",
    "access_token": "Qm9yZWQ_eW91IGRlY29kZWQgdGhpcyBleGFtcGxlIQ0",
    "status_url": "/payer-follow-up/8f2d4c1a-6b3e-4f7a-9c21-5d0e8b7a3f10",
    "checkout_url": "https://checkout.stripe.com/c/pay/cs_live_...",
    "plan": "per_application",
    "monitoring": false,
    "roster_count": 1,
    "pending_clinician_count": 1,
    "application_count": 2,
    "price": {
      "plan": "per_application", "monitoring": false,
      "lines": [ { "key": "application", "label": "One payer application, checked until decided", "unit_cents": 7900,
                   "quantity": 2, "amount_cents": 15800, "recurring": false } ],
      "first_payment_cents": 15800, "monthly_cents": 0, "one_time_cents": 15800,
      "checkout_mode": "payment"
    },
    "payment_status": "awaiting_payment",
    "next": "Pay at checkout_url. Keep access_token: ...",
    "webhook": { "url": "https://hooks.yourplatform.com/licium", "secret": "lws_9a4e1c0b7d3f2a6e8c5b1d0f4a7e3c9b2d6f8a1c5e0b3d7f9a2c4e6b8d0f1a3c" },
    "notify": "platform_only"
  }
}

HTTP/1.1 200 OK
Idempotent-Replayed: true

{
  "success": true,
  "data": {
    "account_id": "8f2d4c1a-6b3e-4f7a-9c21-5d0e8b7a3f10",
    "access_token": null,
    "checkout_url": "https://checkout.stripe.com/c/pay/cs_live_...",
    ...
    "webhook": { "url": "https://hooks.yourplatform.com/licium", "secret": null },
    "replayed": true,
    "note": "This repeats the reply to the first request sent with this Idempotency-Key. ..."
  }
}

curl -X POST https://www.licium.ai/v1/payer-follow-ups/$ACCOUNT_ID/checkout \
  -H "X-Payer-Follow-Up-Token: $ACCESS_TOKEN"

curl -X PUT https://www.licium.ai/v1/payer-follow-ups/$ACCOUNT_ID/webhook \
  -H "X-Payer-Follow-Up-Token: $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://hooks.yourplatform.com/licium" }'

curl -X POST https://www.licium.ai/v1/payer-follow-ups/$ACCOUNT_ID/webhook/test \
  -H "X-Payer-Follow-Up-Token: $ACCESS_TOKEN"

{ "success": true,
  "data": { "event_id": "5e1f...", "delivered": true, "status_code": 200, "error": null, "duration_ms": 184 } }

POST /licium HTTP/1.1
Host: hooks.yourplatform.com
Content-Type: application/json
User-Agent: Licium-Webhooks/1.0
Licium-Event-Id: 0b6f3a9e-7c2d-4e51-8a4f-1d9c6b2e7f05
Licium-Event-Type: application.status_changed
Licium-Signature: t=1792674251,v1=5f0c8b1e...e2a1

{
  "id": "0b6f3a9e-7c2d-4e51-8a4f-1d9c6b2e7f05",
  "type": "application.status_changed",
  "created_at": "2026-10-21T13:04:11.000Z",
  "account_id": "8f2d4c1a-6b3e-4f7a-9c21-5d0e8b7a3f10",
  "data": {
    "application_id": "3c9a7e52-1f4b-4d8e-a6c0-2b7f9d1e4a83",
    "npi": "1234567893",
    "payer": "Aetna",
    "state": "TX",
    "status": "approved",
    "previous_status": "in_review",
    "effective_date": "2026-11-01",
    "missing_documents": null,
    "decided": true,
    "checked_at": "2026-10-21T13:04:10.512Z",
    "next_check_at": null,
    "payer_said": "Approved, effective November 1, 2026.",
    "source": { "method": "phone", "automated": false, "reference": "Ref 55102, rep Dana", "note": null },
    "stopped": null
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody: the request body exactly as received (a Buffer or string), before any JSON parsing.
// signatureHeader: the Licium-Signature header. secret: webhook.secret (lws_...).
export function isFromLicium(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const parts = String(signatureHeader ?? "").split(",").map((p) => p.trim());
  const t = Number(parts.find((p) => p.startsWith("t="))?.slice(2));
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest();
  return parts.filter((p) => p.startsWith("v1=")).some((p) => {
    const given = Buffer.from(p.slice(3), "hex");
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

import hashlib, hmac, time

def is_from_licium(raw_body: bytes, signature_header: str, secret: str, tolerance: int = 300) -> bool:
    parts = [p.strip() for p in (signature_header or "").split(",")]
    t = next((p[2:] for p in parts if p.startswith("t=")), "")
    if not t.isdigit() or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(p[3:], expected) for p in parts if p.startswith("v1="))

import { createServer } from "node:http";
import { isFromLicium } from "./licium-signature.mjs";

createServer((req, res) => {
  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const raw = Buffer.concat(chunks);
    if (!isFromLicium(raw, req.headers["licium-signature"], process.env.LICIUM_WEBHOOK_SECRET)) {
      res.writeHead(401).end();
      return;
    }
    res.writeHead(204).end(); // within 5 seconds; do the work after answering
    const event = JSON.parse(raw);
    // Skip an event.id you already stored; keep the status with the latest data.checked_at.
    queueForProcessing(event);
  });
}).listen(3000);

curl https://www.licium.ai/v1/payer-follow-ups/$ACCOUNT_ID \
  -H "X-Payer-Follow-Up-Token: $ACCESS_TOKEN"

const res = await fetch(`${BASE}/v1/payer-follow-ups/${account_id}`, {
  headers: { "X-Payer-Follow-Up-Token": access_token },
});
const { data: followUp } = await res.json();
// followUp.standing: awaiting_payment until the payment settles, then active.
for (const app of followUp.applications) {
  console.log(app.payer, app.state, app.status, app.effective_date ?? "", app.next_check_at ?? "");
}

{
  "success": true,
  "data": {
    "account_id": "8f2d4c1a-6b3e-4f7a-9c21-5d0e8b7a3f10",
    "standing": "active",
    "payment": { "status": "paid", "paid_at": "2026-10-21T13:02:44.000Z", ... },
    "summary": { "not_checked": 0, "received": 0, "in_review": 1, "needs_documents": 0,
                 "approved": 1, "denied": 0, "no_record": 0, "no_decision": 0 },
    "applications": [
      {
        "id": "3c9a7e52-1f4b-4d8e-a6c0-2b7f9d1e4a83",
        "npi": "1234567893", "clinician_name": "ADA LOVELACE",
        "payer": "Aetna", "state": "TX", "submitted_on": "2026-09-14",
        "status": "approved", "effective_date": "2026-11-01", "missing_documents": null,
        "reference_or_rep": "Ref 55102, rep Dana",
        "last_checked_at": "2026-10-21T14:31:07.000Z", "next_check_at": null,
        "check_every_days": 2, "coverage": "decided", "stopped": null,
        "checks": [
          { "checked_at": "2026-10-21T14:31:07.000Z", "method": "phone", "status": "approved",
            "payer_said": "Approved, effective November 1, 2026.", "effective_date": "2026-11-01", ... }
        ]
      },
      { "id": "...", "payer": "Cigna", "status": "in_review", "check_every_days": 1,
        "next_check_at": "2026-10-22T13:00:00.000Z", ... }
    ],
    "notify": "platform_only", "notify_email": "credentialing@yourplatform.com",
    "webhook": { "url": "https://hooks.yourplatform.com/licium", "updated_at": "2026-10-21T13:00:12.000Z" },
    "next": "Each open application is checked until it is decided: ...",
    "authorized_by": "token"
  }
}

curl -X POST https://www.licium.ai/v1/payer-follow-ups/$ACCOUNT_ID/applications/$APPLICATION_ID/reopen \
  -H "X-Payer-Follow-Up-Token: $ACCESS_TOKEN"

HTTP/1.1 400 Bad Request

{
  "success": false,
  "error": "One entry could not be used. Each one is listed with its reason; fix them and send again.",
  "invalid_entries": [
    {
      "entry": "Application 2: 1234567890, Cigna",
      "reason": "NPI: The last digit does not match the NPI check digit. Check for a typo."
    }
  ]
}

claude mcp add --transport http licium https://www.licium.ai/mcp