Zocdoc API Integration: Access, Limits and Costs (2026)

Zocdoc runs a marketplace where patients find providers and book care. Its API lets a third party build online scheduling inside its own product. The API guides and the API reference are public at api-docs.zocdoc.com, and the reference shows version 1.183.

This guide is for a buyer or product lead who has to connect a product to Zocdoc, and for the engineer who will build it. It covers who gets access, every documented operation and the published limits. It also covers what Zocdoc leaves unpublished and what to ask before you commit. Last checked: Nov 14, 2026.

Zocdoc API at a glance

What can you build with the Zocdoc API?

Nine use cases follow, one or more for each Zocdoc program. Each points to a row in the table of what you can read and write. Zocdoc publishes no build times, so this guide gives no build estimate. Build complexity is our own rating.

The nine Zocdoc use cases compared

How do you get access to the Zocdoc API?

You apply through a contact form and wait for Zocdoc to reply. There is no self-serve sign-up, and the form you use depends on what you build.

The three programs and the agent route

The steps for a Developer Partner

1. Send the form. The developer page asks you to fill out the form, and Zocdoc gets in touch.
2. Wait for the follow-up. The only stated next step is that a Zocdoc representative follows up.
3. Agree the terms. The documents name a Developer Licensing agreement in the rules for handling credentials. Its text is not public.
4. Agree the directory. Each developer has a designated provider directory, defined and onboarded jointly with Zocdoc. The glossary calls it a curated subset of Zocdoc providers.
5. Receive credentials. You receive one client ID and secret for sandbox and another for production.

Every API guide opens by saying you need a developer account and an access token first.

What an Integration Partner should expect

A March 2024 press release says the program places scheduling software partners into tiers on technical and commercial criteria. The release describes three levels. The lowest needs an acceptable format of calendar integration. The middle one needs the standard technical requirements to be maintained. The highest needs the full integration requirements and continuing upgrades. Zocdoc names DrChrono by EverHealth as an Advanced Integration Partner, the highest tier. The criteria themselves are not listed.

Access that is switched on per partner

Three parts of the API are not open to every approved developer.

• Insurance. The Insurance API is for select partners.
• Reviews. The reviews endpoints need a scope that Zocdoc enables for your API client.
• Deep link booking. Sending users to zocdoc.com to finish a booking suits only certain use cases and partnership arrangements.

What happens on the practice side

For a calendar connection, the practice sets it up inside its own Zocdoc account, with instructions specific to its scheduling software. One possible step is that the practice enters its scheduling software login.

Named partners describe their own steps. These are partner statements about their own products.

• Elation Health documents that at least one provider-level user at the practice needs a Zocdoc account before its integration starts. It documents that Zocdoc makes contact once the practice completes a form. The page footer shows 2023.
• Healthie documents that its integration requires a separate Zocdoc account and agreement alongside Healthie. Its help article documents that Healthie generates an API key, which the practice shares with Zocdoc to turn the integration on.
• DrChrono by EverHealth documents that the practice activates its integration from a Zocdoc page.
• Practice Fusion documents that the practice starts in the Zocdoc provider dashboard, selects Practice Fusion and logs in with its Practice Fusion credentials.

What Zocdoc does not publish about access

Zocdoc does not publish who is accepted or refused. It does not publish the text of the Developer Licensing agreement or the tier criteria. It does not publish who at a practice must sign before a third party acts for it. The reference lists scopes for "partner-connect consent grants", and no guide explains who gives that consent or how.

Ask Zocdoc:

• Which program fits our product, and can one company hold more than one?
• What are the approval criteria, and what does the Developer Licensing agreement require?
• Who at a practice has to consent before we act for it, and what is a partner-connect consent grant?
• Which providers will be in our directory, and how do we change it?

What does Zocdoc API access give you?

Access gives you credentials for a sandbox and for production, a provider directory, and the scopes Zocdoc enables for your client.

Credentials and environments

What the sandbox holds

The sandbox includes predefined provider test data and special inputs that simulate edge cases. One test value returns a provider with multiple locations. Another returns an appointment that is already confirmed. Reference data in the sandbox, such as specialties and visit reasons, is sample data. In the sandbox any valid base64 string works as a webhook key.

Two test endpoints send a signed sample webhook to your own address. Both return 404 outside the sandbox.

The directory

A Zocdoc directory is a developer-managed list of Zocdoc providers. Each developer account has at least one, and more can be created. You tell Zocdoc which providers are live and bookable in your app by sending "enabled" or "disabled" for each.

Scopes

The reference lists 13 scopes for server-to-server clients. The documented user sign-in request asks for the appointment read and write scopes and offline access.

Support

Zocdoc lists implementation and ongoing developer support among the benefits for Developer Partners. In production, you can ask for maps of specialties and visit reasons to their Zocdoc IDs by email at partner-devsupport@zocdoc.com. Zocdoc describes onboarding as easy, with minimal setup, and publishes no checklist.

Zocdoc does not publish whether sandbox credentials come before or after a contract, or how production credentials are released.

What are the ways to integrate with Zocdoc?

Zocdoc offers a REST API in two directions, plus webhooks, a file feed, a deep link, an MCP server and a calendar sync that it builds itself. The words FHIR and HL7 appear nowhere in the API documents, so Zocdoc publishes no FHIR or HL7 route.

Three notes on the table.

The count of connected systems differs by page. Zocdoc's integrations page says over 175 EHR and practice management systems. Its developer page says 150+ EHRs. Zocdoc does not publish the list of names.

For a system that is not connected, Zocdoc's integrations page says it supports other systems and flexible ways to connect, including API-based options. Some scheduling software cannot be connected at all, and Zocdoc shows that to the practice as a "Not eligible" status.

The file feed can also go to a cloud storage bucket, which you arrange through your account manager.

Zocdoc's agent page names a machine-readable guide for agents at zocdoc.com/llms.txt. That file returned an error to us on Nov 14, 2026, so nothing in this guide comes from it.

Want a second opinion on the route before you apply? See our EHR integration service.

What can you read and write with the Zocdoc API?

The API reference at version 1.183 documents 32 operations. Reads are GET calls and writes are POST or PUT calls. The reference has no DELETE or PATCH operation. Paths sit under /v1, and the facilities endpoints sit under /v1-beta.

Rows P1 to P19 cover all 32 operations. Rows P20 to P26 cover what Zocdoc documents outside the reference.

Each appointment also shows the channel where it was booked, such as the Zocdoc marketplace or your website.

Scopes and data shapes with no documented path

Three things appear in the reference with no endpoint and no guide.

• Booking intents. The reference lists scopes to create, modify and read booking intents. No path for them is published.
• Patient payment method. A scope exists to read the patient payment method for an appointment. The data shape mentions a Stripe customer ID on a Stripe Connect account. No path is published.
• Patient consent records. A data shape holds consent types such as financial responsibility, terms of service and the HIPAA notice of privacy practices. It stores the consent text shown to the patient. No path is published.

Ask Zocdoc whether these are live for any partner, and under which program.

What is not possible with the Zocdoc API?

Zocdoc publishes no list of what is closed to partners. The limits below come from single statements in its documents and from what the reference leaves out.

What the reference does not expose

The reference has no endpoint to search or read patients outside an appointment, and no clinical data. It has no endpoint to create or edit a provider, practice or location. It has no review text, and no payment or eligibility-check endpoint.

What the documents rule out

• No providers outside your directory. Provider calls return providers within the developer's directory.
• No review text. Only counts and averages come back.
• No change of provider or visit reason on a reschedule. A reschedule changes the appointment time.
• No booking result on a hand-off. If the user books through the deep link, you do not see the result.
• No view of other users' appointments. A request with a user credential returns only the appointments that user created.
• No webhook for your own actions in patient booking. Webhooks there fire only for provider-initiated changes. The "created" value exists only in the provider scheduling use case.
• No webhook registration by API. You submit your address to the Zocdoc API team.
• No insurance mappings at other levels. A provider that keeps mappings at another entity level returns a 409 conflict.
• No late attachments. You cannot upload to a failed appointment, or more than 7 days after the appointment.
• No late no-show. The start time must be in the past but no older than 2 days.
• No server tokens in browsers or mobile apps. Tokens from client credentials must stay on the server.
• No phone number for some API products. The location phone field returns null for certain API products, and Zocdoc does not say which.

Rules for AI agents

Zocdoc's agent page sets rules for registered agents. Do not copy, resell or republish Zocdoc provider, review, insurance, availability or appointment data. If you use information found on Zocdoc, complete the booking on Zocdoc. Do not train on patient information. Agents that break the rules may receive lower limits or lose access.

Rules for the public website

The partner routes exist beside strict rules for the website itself. Zocdoc's Terms of Use, effective Mar 4, 2026, bar accumulating or indexing content, including appointment availability. Its Acceptable Use Policy, dated Jan 27, 2022, bars web scraping. The same policy bars booking appointments by automated means. Both pages were read as archive copies, dated Sep 25, 2026 and Aug 12, 2025.

Limits of the calendar sync that Zocdoc builds

• For certain practices the sync reads availability but does not write appointments back into the scheduling software.
• Once the sync is on, the practice cannot add or edit availability in the Zocdoc Calendar. It can still add busy blocks.
• Some scheduling software is not eligible.

The usual workarounds

• Need more providers? The directory is defined with Zocdoc, so ask Zocdoc to change it.
• Need to know about your own bookings? Update your system from the API response, and do not wait for a webhook.
• No connection for the practice's system? The practice keeps availability up to date in the Zocdoc Calendar.
• System not on Zocdoc's list? Zocdoc points to API-based options.

What are the Zocdoc API limits?

Zocdoc publishes many per-call limits, and it does not publish the rate limit number. A request over the limit fails with HTTP 429, and Zocdoc tells developers to back off exponentially. Zocdoc can reduce the limit without notice, or raise it for high-traffic applications, case by case. Its agent page promises registered agents higher rate limits and gives no number.

Published numbers

Two more points shape a design. Timeslots sit in an eventually consistent data store, so a read straight after a write can miss the change. Zocdoc suggests pulling the NPI and provider location lists once a week, or after a known directory change.

What Zocdoc does not publish about limits

Zocdoc does not publish the rate limit number, how far back appointment history goes, data retention, or an uptime commitment. On the marketplace, patients can book only times at least 2 hours ahead. The API documents do not say whether that rule applies to API bookings.

Ask Zocdoc:

• What is our rate limit, per endpoint and per client?
• How far back can we read appointments?
• Does the 2-hour lead time apply to bookings made through the API?
• Is there an uptime commitment or a status page for the API?

How much does Zocdoc API integration cost?

Zocdoc publishes no fee for API access, for the Developer Partner program or for any Integration Partner tier. It does publish how practices are charged, without amounts.

What Zocdoc states about practice fees

• There are no upfront fees or subscription costs to join. A September 2026 press release says any provider can join the network free.
• The practice pays a one-time fee for a discovery booking. That is a booking where Zocdoc helps a patient discover and book the provider, on Zocdoc or on partner sites.
• Reputation bookings are free.
• The fee varies by specialty and location.
• The fee is charged at the time of booking, whether or not the patient attends.
• Zocdoc judges "existing patient" by the patient's relationship to the provider, not to the practice.
• In some cases the practice is not charged when the patient cancels within 24 hours of booking.
• Confirming a booking has no bearing on the fee.
• Certain partners, such as insurance directories, have arranged for all bookings to be free to providers.
• On consumer sites and AI platforms the practice is charged only for discovery bookings.
• Practice Solutions carries a monthly service fee per provider. Sponsored Results carry a sponsored fee on top of the booking fee.
• Invoices are generated monthly.

Zocdoc calls the calendar integration a free tool for the practice. It also describes the DrChrono by EverHealth integration as free.

What Zocdoc states about partners

Zocdoc's agent page says eligible partners can monetize integrations, and gives no terms. It states that providers pay Zocdoc when it helps patients discover them and book care. One API search option limits results to Zocdoc-active providers with budget, and applies to syndication clients.

What named partners state

These are partner statements about their own products. None is a Zocdoc price.

• Healthie documents that its integration requires a separate Zocdoc account and agreement.
• Curve Dental describes its Zocdoc calendar integration as free.
• Practice Fusion discloses on its Zocdoc help article that it is financially compensated by the service provider.
• AdvancedMD discloses on its Zocdoc marketplace page that it may receive compensation from the company its form goes to.

What Zocdoc does not publish about cost

Zocdoc does not publish a fee or revenue share for partners, or the discovery booking fee amounts. It does not publish who pays for a booking that comes through a partner's own app. It does not publish the terms on which a partner can earn.

Ask Zocdoc:

• Is there a fee for API access, for sandbox or for production?
• Is there a fee or a revenue share for our Integration Partner tier?
• When a patient books through our app, is that a discovery booking for the practice, and what is the fee?
• On what terms can a partner earn from an integration?

How long does a Zocdoc API integration take?

Zocdoc publishes no time for developer approval, contract, certification or production go-live. After the form, the only stated next step is a follow-up from a Zocdoc representative.

The nearest statements from Zocdoc

• Practice-side calendar connection. Most integrations take one 30-minute phone call. Zocdoc scopes what each EHR supports during onboarding and gives no duration.
• Booking confirmation. After an API booking, confirmation should be expected within 24 hours.
• Insurance updates. Processing time varies with the volume of changes, and most complete at once.
• Notice of changes. Zocdoc's agent page says rate limits, terms and changes are announced ahead of time. It gives no notice period.

What named partners state

These are partner statements about switching on an existing connection for a practice. They do not cover developer approval or a new build.

Ask Zocdoc:

• How long after the form do you reply, and how long does approval take?
• When do we get sandbox credentials, before or after the contract?
• Is there a review or certification before production, and how long does it take?
• How long does a practice's calendar connection stay pending?

How do you build a Zocdoc API integration, step by step?

The build has two documented orders, one for patient booking and one for calendar integration. Both start with a token. Zocdoc does not publish whether it reviews or certifies an integration before production.

Sign-in for both flows

Zocdoc's API uses OAuth 2.0. A server gets a token with the client credentials grant. Every call then carries the token in a bearer authorization header. Zocdoc advises caching the token, to avoid generating too many.

This is the token request, copied from Zocdoc's authentication guide.

curl --request POST \
  --url 'https://auth.zocdoc.com/oauth/token' \
  --header 'content-type: application/json' \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "https://api-developer.zocdoc.com/"
  }'

For the sandbox, the token address is https://auth-api-developer-sandbox.zocdoc.com/oauth/token.

This is the token response example, copied from the same guide. The guide prints it under the sign-in flow for users, where the token carries the user scopes.

{
  "access_token": "ACCESS_TOKEN",
  "refresh_token": "REFRESH_TOKEN",  // only if `offline_access was requested
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "external.appointment.read external.appointment.write"
}

Apps with signed-in users use the authorization code grant. Zocdoc requires PKCE with it. PKCE is a one-time proof that stops a stolen code being used. Only the S256 method is accepted. The documented sign-in request uses the audience value DeveloperApiPatient. A refresh token comes only if you request the offline access scope. Users who have not signed in each get their own anonymous token for search calls.

(a) Patient booking

1. Get a token. Use the client credentials request above.
2. Get the NPIs in your directory. Call GET /v1/reference/npi.
3. Get provider information. There are three ways: by NPI with GET /v1/providers, by ZIP code and specialty or visit reason with GET /v1/provider_locations, or by provider location ID.
4. Get availability. Call GET /v1/provider_locations/availability with a provider location ID, a visit reason ID and a patient type. A visit reason is required.
5. Check what the provider requires. Each provider sets booking requirements and mandatory fields.
6. Book. Call POST /v1/appointments with a start time from step 4. The response carries an appointment ID that you use to confirm, cancel or reschedule.
7. Update your system from the response. Do not wait for a webhook.
8. Track the status. Read the appointment with GET /v1/appointments/{appointment_id}. Confirmation should be expected within 24 hours.
9. Listen for provider changes. Give Zocdoc an HTTPS address for webhooks.
10. Cancel or reschedule when the patient asks. Use POST /v1/appointments/cancel or POST /v1/appointments/reschedule.

(b) Calendar integration

1. Get a token. Use the client credentials request above.
2. Get the NPIs and the provider information. The calendar guide opens with the same two look-up steps as the booking guide.
3. Push the open slots. Call PUT /v1/providers/{provider_id}/calendar/timeslots with the location ID and provider ID. Each call sets all slots for that provider and date and replaces the existing ones.
4. Receive the booking. A new booking has the status pending_booking. The webhook update type "created" is supported only in this use case.
5. Confirm it. Call POST /v1/appointments/confirm.
6. Read the patient. Call GET /v1/appointments/{appointment_id}/participants.
7. Close the visit. After the appointment time, call PUT /v1/appointments/update-status with "arrived" or "no_show".
8. Keep pushing. Send the full slot list again whenever the calendar changes, because each push replaces the day.

Webhook handling for both flows

Build an HTTPS endpoint and submit its address to the Zocdoc API team. Check the signature, which is an HMAC SHA256 hash that arrives in the webhook-signature header. Check that the timestamp is within a few minutes of the current time. The default is 5 minutes. Return a 2xx status within 5 seconds. Make processing idempotent, meaning safe to repeat, because a retry can deliver a notification you already processed.

Compression is optional. To send a compressed request, add the Content-Encoding: gzip header.

The appointment event is appointment_updated, and its update type is updated, cancelled or created.

Insurance updates

Read the current mappings, send the change, then read the mappings again once the update has had time to process.

Which Zocdoc API quirks should you know?

Fifteen details from the documents can change a design or a test plan. Each one below carries its source.

What should you check before you sign with Zocdoc?

Check four things before you sign: consent, security, testing and support. Then put the ten questions at the end of this section to Zocdoc in writing.

Consent

Zocdoc's agent page says an agent should obtain explicit patient consent before booking, changing or canceling anything. It says to use patient information only for the patient's requested task. Zocdoc sends booking confirmations directly to patients. Agents must also preserve ranking and sponsored labels.

For website users, the Terms of Use, effective Mar 4, 2026, say that what an AI agent does counts as actions performed by the user.

Zocdoc does not publish the consent wording a partner must show the patient.

Security and compliance

• Production secrets belong only on secure backend services. Do not distribute secrets to browsers or mobile apps.
• Webhooks support HTTPS only, except for testing in the sandbox.
• Zocdoc's integrations page carries the labels "HIPAA-compliant" and "SOC 2 certified", with no detail.
• Zocdoc's help center says it undergoes annual security audits such as SOC 2 and HITRUST.
• Zocdoc's privacy policy describes cases where Zocdoc acts as a Business Associate, the HIPAA term for a company that handles patient data for a provider. It says the policy does not apply to PHI, which HIPAA regulates. PHI is protected health information.
• The Care Access Network page says HIPAA compliance is handled by Zocdoc, and gives no detail.

No page says whether a developer or partner signs a Business Associate Agreement, or with whom. Settle that before any patient data moves.

Testing

Test in the sandbox with the predefined providers and special inputs. Use the two mock webhook endpoints to check your signature code. They do not exist in production. Zocdoc does not publish whether there is a test practice in production.

Support

Developer Partners are promised implementation and ongoing developer support. Zocdoc does not publish a deprecation policy, a list of error messages or a status page for the API.

For the calendar sync, named partners point their customers to Zocdoc. Elation Health documents that issues with its integration go to Zocdoc. DrChrono by EverHealth documents the hours of Zocdoc's service team as it states them to its customers. Practice Fusion documents that a practice contacts Zocdoc to cancel its integration.

What partners document about their own sync

These statements show what one live integration does. None is a Zocdoc specification.

• Elation Health documents that the Zocdoc calendar pulls real-time availability from provider calendars in Elation. It documents that its sync covers appointments, insurance and basic patient demographics. It documents that a status change made in Elation shows in Zocdoc. It documents that the integration can be set up for some providers in a practice and not others. It documents that a new chart is created when no exact patient match is found. It documents that appointment edits must be made in Elation. It documents that working hours must also be set in Zocdoc before the integration is turned on.
• Healthie documents that its integration syncs availability to Zocdoc and creates the appointment, and the patient record if needed, in Healthie. It labels the integration "Built by Partner". It documents a buffer setting that aligns odd appointment durations with clean start times.
• Practice Fusion documents that Zocdoc can create, update and cancel appointments in its schedule, and cannot delete them or create blocks.
• AdvancedMD documents that every Zocdoc booking is reflected in AdvancedMD and the reverse.

Questions to ask Zocdoc before you sign

1. Which program are we in, and which API products and scopes come with it?
2. Which providers are in our directory, and how is it changed?
3. What does the Developer Licensing agreement require of us?
4. Do we sign a Business Associate Agreement, and with whom?
5. What is our rate limit, and how much notice do we get before it changes?
6. What are the fees, and who is billed for a booking that starts in our product?
7. How long do approval, sandbox access and production access take?
8. Is there a review before production, and what is on the checklist?
9. How are the webhook key and the client secret issued and rotated?
10. What is the deprecation policy, and where do you announce breaking changes?

Next step

Planning a Zocdoc API integration? We scope the route, the access steps and the build with you. Start at our EHR integration service.