Connect your app to Pathway Biosciences

Pathway Biosciences is where pharma, research teams and patient organizations find patients and ask them to take part: surveys, interviews, data requests, education, events and clinical trials. Every request is paid or free as shown up front, and the patient decides on each one.

If your app serves patients, you can connect it. Your users then see requests that fit them and get paid for the ones they take part in. You don't build any of the request, consent or payment screens. Pathway Biosciences does that.

This page is for the engineers on your side. Version 1, October 2026.

How it works

1. The patient picks your app on Pathway Biosciences' Get started page. Each app is listed with its specialty and the kinds of data it can share.
2. They sign in to your app and approve. This is standard OAuth 2.0 (authorization code with PKCE). You show your own sign-in and approve screen.
3. You tell Pathway Biosciences who they are: your stable ID for this person, their verified email, and the data types you can share for them.
4. They choose on Pathway Biosciences what to share, what kinds of requests to hear about, from which kinds of organization, and for how long. That consent is recorded with the exact wording they saw.
5. Pathway Biosciences pulls the data types they allowed from your feed, as often as it needs. You never push data to Pathway Biosciences, and Pathway Biosciences never asks for a type the patient didn't allow.
6. Requests, answers and pay happen on Pathway Biosciences. We email the patient. They answer on their Pathway Biosciences page.

The same person on two apps is one Pathway Biosciences account. We match on the verified email, or your ID for them if they connected before.

Already have an MCP server? Nothing to build

If your members can add your app to Claude or ChatGPT, Pathway Biosciences connects the same way. Give your MCP address when you sign up (or on your partner page) and skip sections 1 to 5.

• Your server answers 401 to a request without a token and publishes OAuth protected resource metadata (/.well-known/oauth-protected-resource), as the MCP authorization spec says.
• Your authorization server publishes its metadata, supports PKCE with S256, and accepts dynamic client registration. Pathway Biosciences registers itself there; there are no keys to copy.
• Your member signs in to Pathway Biosciences, approves on your own screen, then chooses on Pathway's consent screen what to share.
• Pathway Biosciences reads through tools that need no input, matched by name: conditions, diagnoses, encounters and visits (medical record), labs and observations, medications and prescriptions, check-ins, symptoms and daily logs, sleep, activity and steps, meals and diet. A tool answers with structured content or JSON text, as a list of records or an object holding one. Only the fields in section 5 are kept; free text is dropped.
• The connection test finds your sign-in server and registers. Once it passes, put it live.

A member can also paste your MCP address on their Connections page before you sign up. Your app is then connected for that member only; when you sign up with the same address, you take it over and your share starts.

Your share

A partner earns a share of the fees Pathway Biosciences earns from paid research and requests taken up by members who joined through its app (the percentage is in the partner terms you agree to). Pay to members is not shared. It is paid once a month by Stripe, after the research team has paid, when at least the minimum in the terms is owed. Set up payouts on your partner page: Stripe asks for your bank and tax details on its own pages.

What you build

Endpoint	Method	What it does
Authorize	GET, in the browser	Your sign-in and approve screen
Token	POST	Swaps the code for tokens
Userinfo	GET	Says who the person is
Feed health	GET	Lets us check you're up
Feed, per data type	GET	Returns that person's data of one type
Events (optional)	You POST to us	Tells us someone disconnected in your app

Every URL must use https.

1. Register

Sign up at pathwaybio.health/developers/join with your app name, a one-line specialty for patients (for example "Women's health and fertility"), your website, the data types you can share and a technical contact. We email that contact a link to your partner page, where you get a client_id and a client_secret, enter your endpoint URLs, run the connection test and submit for review. Register this redirect URI on your side:

https://pathwaybio.health/connect/{your-app-slug}/callback

You start in the sandbox. Your app only appears to patients after it passes the connection test (section 7) and we have checked it.

2. Authorize

We send the patient's browser to your authorize URL with:

Parameter	Value
response_type	code
client_id	Yours
redirect_uri	The URI above
scope	pathwaybio
state	Send it back unchanged
code_challenge	Base64url SHA-256 of our verifier
code_challenge_method	S256

Show your normal sign-in, then an approve screen that says plainly: "Connect to Pathway Biosciences and share [your data types]. You choose on Pathway Biosciences what is used." On approve, redirect to the redirect_uri with code and state. If they say no, redirect with error=access_denied and state.

Codes should work once and expire within 10 minutes.

3. Token

We POST application/x-www-form-urlencoded:

grant_type=authorization_code
code=...
redirect_uri=https://pathwaybio.health/connect/{your-app-slug}/callback
client_id=...
client_secret=...
code_verifier=...

Respond:

{
  "access_token": "...",
  "refresh_token": "...",
  "token_type": "Bearer",
  "expires_in": 3600
}

The access token is for this one person and the pathwaybio scope only. We refresh with grant_type=refresh_token.

4. Userinfo

GET with Authorization: Bearer {access_token}. Respond:

{
  "sub": "your-stable-id-for-this-person",
  "email": "person@example.com",
  "email_verified": true,
  "data_types": ["checkins", "medications"]
}

• sub must never change for this person and must not contain their name.
• email_verified must be true. We refuse unverified emails and throwaway email services, so people can't create fake accounts to get paid.
• data_types lists what you can share for this person today. We ignore any type you aren't registered for.
• If you hold the consent yourself (manages_consent: true), also send "adult": true once the person has confirmed in your app that they are 18 or older. Our consent screen, which asks it, is skipped for you, so without it we refuse the connection.

Don't send names, birth dates, phone numbers or addresses. Pathway Biosciences doesn't want them.

5. The feed

Pathway Biosciences pulls each data type the patient allowed:

GET {feed_url}/patients/{sub}/{type}?since=2026-09-01T00:00:00Z&cursor=...
Authorization: Bearer {access_token}

Respond:

{
  "data": [ ... ],
  "next_cursor": null,
  "as_of": "2026-10-03T14:00:00Z"
}

• since asks for records added or changed after that time. Without it, send everything.
• Page with next_cursor (up to 500 records a page).
• If the person disconnected or the token is no longer valid, answer 401 or 403. We turn the connection off on our side right away.
• Answer 404 for a type you don't have for this person.

Data types

Every record has a source: verified (from a medical record), reported (the patient told you) or device (a wearable). Use codes where the format lists them. No free text anywhere, because it can carry names and details nobody agreed to share.

record, conditions and visits from a connected medical record. Use ICD-10 where you can; otherwise your own stable code with code_system set to your app's short name:

{ "kind": "condition", "code_system": "ICD-10", "code": "K50.90", "label": "Crohn's disease", "onset": "2015-06", "source": "verified" }
{ "kind": "visit", "date": "2026-08-14", "setting": "outpatient", "specialty": "gastroenterology", "source": "verified" }

labs. Send loinc when you have it, otherwise null:

{ "loinc": "1988-5", "label": "C-reactive protein", "value": 12.4, "unit": "mg/L", "low": 0, "high": 10, "date": "2026-08-14", "source": "verified" }

medications:

{ "rxnorm": "2196462", "label": "Upadacitinib", "status": "active", "started": "2025-11", "ended": null, "source": "verified" }

checkins, how the person feels between visits. Every score is a whole number from 0 to 10, where 10 is the most of that thing:

{ "date": "2026-10-01", "overall": 6, "symptoms": 5, "pain": 4, "energy": 3, "fatigue": 7, "sleep_quality": 5, "sleep_hours": 6.5, "activity": 4, "mood": 6, "source": "reported" }

sleep_hours is hours. Leave out anything you don't collect.

wearable, one row per day:

{ "date": "2026-10-01", "sleep_minutes": 402, "steps": 6120, "resting_hr": 64, "source": "device" }

diet, one row per day or per meal (we add them up by day). Never what was eaten in the person's own words:

{ "date": "2026-10-01", "meals": 3, "tags": ["low_fodmap", "dairy_free"], "source": "reported" }

We combine feeds from every app a person connected. Data that builds up over time is merged by day. For current facts, a medical record wins, then the most recent. Sponsors see data types by ID number, never which app it came from.

Feed health

GET {feed_url}/health
Authorization: Basic base64(client_id:client_secret)

{ "ok": true, "data_types": ["checkins", "medications"] }

6. Events (optional)

If someone disconnects Pathway Biosciences inside your app, tell us:

POST https://pathwaybio.health/api/partners/{your-app-slug}/events
X-PathwayBio-Signature: hex HMAC-SHA256 of the raw body, keyed with your client_secret
Content-Type: application/json

{ "type": "disconnected", "sub": "your-stable-id-for-this-person", "at": "2026-10-03T14:00:00Z" }

We answer 202. We turn the connection off immediately. We don't depend on this: a 401 from your feed does the same.

If your app holds the consent itself (you return manages_consent: true from userinfo), also tell us when a user changes what they share, pauses or resumes. Send the same body with type set to changed, paused or resumed. We don't take the event's word for what changed: we call your userinfo for their choices as they stand and match them at once. A kind of data they stopped sharing is removed from what organizations see, and a paused user drops out of sight until they resume. Without the event we still catch up within the hour.

7. Notices (optional)

If you give us a notices URL, we tell you when one of your users has something new on Pathway Biosciences, so you can show your own notification. For requests and money we always email the person ourselves as well, so those notices are a convenience and nothing depends on them. The daily research alert (new_match) is the exception: we send it only to you, and you deliver it.

POST {your notices URL}
X-PathwayBio-Signature: hex HMAC-SHA256 of the raw body, keyed with your client_secret
Content-Type: application/json

{ "type": "notice", "sub": "your-stable-id-for-this-person", "kind": "new_request",
  "url": "https://pathwaybio.health/me/requests/123", "id": "a-unique-id", "at": "2026-10-05T14:00:00Z" }

We also tell you when the person turns your app off on Pathway Biosciences, or leaves Pathway Biosciences, at the same address and with the same signature:

{ "type": "disconnected", "sub": "your-stable-id-for-this-person", "reason": "turned_off", "id": "a-unique-id", "at": "2026-10-14T14:00:00Z" }

reason is turned_off or left. We have already stopped taking your data in for them; show them as no longer connected, and stop serving their feed.

For a notice, kind is one of:

kind	What happened
new_request	An organization sent them a request
request_update	Something changed on a request they answered
payment_pending	A payment is waiting to be released to them
paid	A payment was added to their balance
payout_sent	Money was sent to the account they chose
new_match	New research on the Pathway Biosciences board fully matches them. At most one a day, only when something is new, and never twice for the same research. url is their research page, https://pathwaybio.health/me/research

Rules:

• Check the signature. Answer 202 whether or not you know the person.
• Write your own words for each kind. We send no text, no organization, no amount and nothing about health, and your notification must not add any.
• Link to url only if it is https on pathwaybio.health. It opens their Pathway Biosciences page, where they sign in with your app ("Continue with ...", the same authorize step as connecting) or with a one-time code by email. After sign-in they land on the page the link named. If your authorize page sees a user who already approved Pathway Biosciences, send them straight back with a code instead of asking again.
• new_match is yours to deliver: in your app, on the phone and by email if you send email, each with an off switch for the user. We send no email for it. Don't send it to a user who turned requests off or paused sharing with Pathway Biosciences. Never show research, organizations or amounts in your app: the board stays on Pathway Biosciences.
• The same id may arrive twice. Show it once.

8. Requests inside your app (optional)

By default your users read and answer requests on their Pathway Biosciences page, reached from our email or your notice. If you would rather show requests on your own screens, use these endpoints. Your user never has to leave your app, and Pathway Biosciences stays the record of what they agreed to.

Sign in with HTTP Basic, your client_id as the username and your client_secret as the password. {sub} is your stable ID for the person. You can only act for people who connected your app and whose connection is on; anyone else answers 404 not_connected.

GET  https://pathwaybio.health/api/partners/{your-app-slug}/patients/{sub}/requests
GET  https://pathwaybio.health/api/partners/{your-app-slug}/patients/{sub}/requests/{id}
POST https://pathwaybio.health/api/partners/{your-app-slug}/patients/{sub}/requests/{id}/{action}

The list returns waiting, active and past (short entries), money (ready, pending, sent, and a url to their Pathway Biosciences money page), and paused_until.

One request returns everything you need to draw the screen:

Field	What it is
state	open, countered, checking, candidate_pending, candidate_accepted, answer_questions, do_work, claimed, disputed, paid, not_a_fit, declined, closed
status_text	One plain sentence saying where it stands. Show it as written.
title, message, from, kind_label	What is asked. from is a kind of organization, never a name.
expect	What to know before deciding: a list of label and value (how long it takes, answer by, when you are paid, what happens next, and for a trial where it is and how many visits). Show every row, in order, before the yes.
reassure	Two short lines every patient is told. Show them as written.
shares, they_see, pay	What they share, what the organization sees, and what it pays.
actions	What the person can do now. Only offer these.
consent	text, version and notice. Present when a yes is possible.
questions	id, type (single, multi, scale, text), text, options. Present when they can answer.
needs_contact	A trial: ask for a name and a phone or email, with nothing filled in.
max_counter, counter_notice, decline_reasons	For asking for more, and for declining.
step_pay	A trial that pays along the way: one sentence saying what is paid at each step. Show it with the pay.
visit	For an accepted trial candidate: referral_code, site_name, site_address, pass_url.
messages	The thread: from is you, them or pathwaybio.
external_url	For a shared resource or an event: the organization's own page. After they accept, open it for them.
receipt	Once they have said yes: number and url. Their receipt for this piece of work, with each step and its date. Link to it.
url	The same request on their Pathway Biosciences page. Link to it for anything you don't show.

Actions and what to send:

Action	Body
accept	consent_version. For a trial, also contact_name and contact_phone or contact_email.
counter	consent_version, amount, optional note.
decline	Optional reason, one of decline_reasons.
answers	answers as {question id: answer} (a list for multi). For screening questions, also consent_version and the contact fields.
done	Nothing. They say the work is done.
withdraw	Nothing. They said yes and can't do it after all. Offered until the work is done.
messages	body.
step	step: contacted (they talked with the study team), screening (they went to their visit) or enrolled. Offered as step_contacted, step_screening, step_enrolled in actions.

Every action answers with the request as it now stands. 409 means it isn't allowed right now, with a message you can show. 422 means something is missing, with message and fields.

Rules:

• Show our consent text. Before a yes (accept, asking for more, or screening answers), show consent.text and consent.notice as written and send back consent.version. We refuse a yes without it, and we record the exact words with their answer.
• Never pre-fill. Not the yes, not the contact details, not an answer.
• Never name the organization or add health details to your own notifications about a request.
• Money stays with us. Show the balance if you like and link to money.url. Don't collect payout details.
• The visit pass and its QR code are on their Pathway Biosciences page: link to visit.pass_url.

9. Trials that may fit (optional)

A list of studies that are recruiting now, from the public registry at ClinicalTrials.gov, for the person's condition and with a site in the state they choose. Same sign-in as section 8.

GET  https://pathwaybio.health/api/partners/{your-app-slug}/patients/{sub}/trials?state=PA
POST https://pathwaybio.health/api/partners/{your-app-slug}/patients/{sub}/trials/{nct_id}/interest

The list returns:

Field	What it is
open	False when the person hasn't said they want to hear about trials. Show nothing and say why.
needs	state, and condition when we don't hold one for them. Ask for these with states and conditions, and call again with ?state= and ?condition=. Never guess either from what you know about them.
trials	Each has nct_id, title, summary, phase, study_type (Clinical trial or Observational study), sponsor, treatments, sites, why (two plain lines), url (the public listing), interested, and the person's own intro, share_ok, answers and questions (questions our staff set for that study, if any).
notice	Four lines every person is shown with the list. Show them as written.
unavailable	The registry couldn't be reached. Say so and offer to try again.

To record interest, post interested (true or false) with the same state and condition. We only accept a trial that is on that person's list. You may also post intro (a short note in the person's words, up to 400 characters) and share_ok (true only if the person agreed the study team may see the note, without their name, if the team works with Pathway Biosciences). Taking interest back removes the note and any answers.

Rules:

• Say "may fit". Never tell someone they qualify. Only the study team can.
• Show the list in the order given. Don't rank, score or highlight trials for a person.
• Interest is a count kept by Pathway Biosciences. Nothing about the person is sent to a sponsor or a site, and your app must not send it either.
• The sponsor's name comes from the public listing. Make clear they have not asked for the person.

10. Pathway Biosciences' own reports (optional)

Pathway Biosciences writes reports of its own from combined totals and sells them. A person can agree, in their Pathway Biosciences settings, to have details from their record and check-ins counted in those reports for 90 days or a year. They can stop at any time.

The totals are worked out inside your app, for the people who agreed, and only totals are sent on. To learn who agreed:

GET https://pathwaybio.health/api/partners/{your-app-slug}/report-members

Same sign-in as section 8. It returns wording_version and members, each with sub (your ID for the person) and until. Only your own members who are connected now and whose agreement is still running are listed.

The list in section 8 also carries reports for one person: counted (true or false) and until.

Rules:

• Count a person only while they are on this list. Ask again before each report.
• Send totals only. Nothing about one person, and no group smaller than the floor we agree with you.
• This is separate from requests. Being counted is not a yes to any request.

11. The connection test

Before going live, Pathway Biosciences runs a test against your registered endpoints:

• Every URL answers over https.
• The feed health check accepts your credentials and lists every data type you registered.
• A sandbox account goes through sign-in, approve, userinfo and one pull of each type, and every record matches the formats above.

When it passes, we switch you from sandbox to live.

What your users see

• The request, what's asked, what they share, and what it pays, before they decide.
• The kind of organization (for example "A pharmaceutical company"), never its name inside Pathway Biosciences.
• Their requests, answers, money and connected apps on their Pathway Biosciences page. If you show requests inside your app, the same things appear there, and their Pathway Biosciences page stays as the record.
• Emails from Pathway Biosciences with no health details in them.

What we promise you

• We never promote Ethia, our own patient app, to your users.
• Your users' data is never used to build Ethia.
• Every app is shown the same way in the app list.
• Pathway Biosciences' fee is ours, and your users' pay is theirs. There is no data licensing.

Contact

george@investigate.health