FAQ
Direct Messaging
What happens if we don't provide a Direct domain when setting up an Account?
If no Direct address is provided, direct.updoxqa.com will be used as the default Direct domain for the practice. For example, a user setup with the Direct address johnsmith<code> will have the full Direct address <code>johnsmith@direct.updoxqa.com.
What happens if we don't provide a Direct address when setting up a Account?
If no Direct address is provided, the practice will be unable to send practice-level Direct messages, as there is no default value. Note that many partners do not enable sending Direct messages from the practice, and sending from the practice requires authorizing with the practice user.
What happens if we don't provide a Direct address when setting up a User?
If no Direct address is provided, the user will be unable to send Direct messages as there is no default value.
Do Direct addresses need to be unique within the domain?
Yes. There is no way to distinguish different users with identical direct addresses, even if they belong to different Accounts or Vendors. For example, for a Direct message sent to johnsmith@direct.updoxqa.com, there will just be one unique johnsmith@direct.updoxqa.com. This necessarily implies that Direct addresses setup using the default direct.updoxqa.com domain will collide with all vendors testing with that default domain.
Why am I getting a Bad Request response when calling DirectMessageSend with an attached file?
This happens when the attachment fileData is null or has not been base-64 encoded, the fileName is null, or the mimeType is null.
Can patients send Direct messages?
Yes, using the PatientDirectMessageSend API call.
How often can I call MessageCountSince?
We ask that you not make the MessageCountSince API call more frequently than once every 1-3 minutes.
Does DirectMessageSend always return a messageId?
Upon successful send, yes.
For what reasons would our Vendor credentials (applicationId and applicationPassword) ever change?
These credentials would only change when moving from QA to Production or if the credentials are ever compromised by an attacker. Regardless of the reason for a change, it will always be done with advance warning and in coordination with affected parties.
Why don't I get an MDN back for a failed Direct message send?
We only get an MDN back on successes. In fact, during testing, the test scripts explicitly state that a passing requirement of a failure is that no MDN is received. The reason we don't get an MDN back on failure is because in almost every case the failure is because the receiving system either does not have or does not trust the sender's certificate. Since the MDN needs to be encrypted with the sender's certificate to send back, there is no way for the receiving system to properly encrypt a message to send back an MDN on failure. In the rare case that the MDN could be encrypted and sent back, there is no reason or requirement for the receiving system to send back that failure notice.
Vetting
What is "vetting" and how does it work?
See our Vetting write-up.
Will all Users be marked as vetted once one User is?
Yes, unless your strategy uses address-level certs (as opposed to domain-level certs).
Where does "phone on file" come from?
The NPI database maintained by CMS.
What happens during the vetting process if the call doesn't get to the User?
Regardless of the reason (straight to voicemail, answering service, out of service, wrong number), the vetting process fails if the user is not contacted directly.
How do I...
How do I know if a Direct address is already in use?
During the UserCreate call, if the Direct address is already taken, the error code and message of 4610 - direct address error: direct address is taken will be returned, indicating that the call has not been successful.
How do I hide/delete/remove a User or Account?
Calling the respective update method for updating the user or account and settin active to false will accomplish this.
Authentication/Authorization
Why am I getting a 4011 or 4012 failure response?
These error messages are returned when the active flag for either the supplied Account (4011) or User (4012) is not set to true. See documentation and code examples for Account Management and User Management.
Testing
How can we set up test accounts?
Follow this Quickstart guide.
What is the URL to access the Webapp outside the API?
https://updoxqa.com/app/html/login.html
Miscellaneous
What HTTP Methods are supported?
All API calls should be done using the POST HTTP method.
Can one practice have multiple accountIds?
AccountId is unique for a practice. If the same practice wants multiple accounts, you must create unique accounts with unique accountIds and duplicate all of the users and settings across both accounts.
What is an "account level message"?
Account level messages are messages sent to and from a practice. They differ from user level messages in that all of the users of a practice can view account-level messages.
Why are certain fields not marked "Required" that sure seem like they should be required (like PatientId in PatientMessageRetrieve, or any boolean field)?
For PatientId, this is a data type nuance. Since Java primitive type long cannot be null, when we convert the JSON to an Object, it will automatically assign a value of 0 to the field. Thus, we have no way to require it to be passed without pattern-matching the JSON string, which may be unreliable. This nuance also applies to boolean fields.
Is it possible to have a user assigned to more than one practice?
Yes. Additionally, userIds need only be unique within the account/practice they are created in.
Is it possible to have a patient to more than one practice?
Yes. Additionally, patientIds need only be unique within the account/practice they are created in.
What is HMAC and how do I use it?
Documentation for HMAC authentication
Why are the subject, filename and content are getting processed/changed when I send CC*.xml and/or PDF files?
Processing of submitted CC*.xml and PDF files is an option that can be turned on or off.
