Developers
Provider intelligence API
One request returns a provider's registry identity, Medicare enrollment and practice affiliations with street addresses, Care Compare profile, ordering and referring eligibility, historical QPP-reported ACO affiliations, exclusions, claims-derived activity, and Open Payments summaries.
Base URL
https://api.acoapi.com/v1
Authenticate with a bearer token created on your profile page. API access is included on paid and alpha plans.
curl -H "Authorization: Bearer aco_your_key_here" \ "https://api.acoapi.com/v1/providers/1679576722"
Endpoints
| Endpoint | Returns |
|---|---|
| GET /v1/providers | Search. q, and optional mode, city, state, zip, taxonomy, entity_type, include_inactive, per_page (25/50/100), page. |
| GET /v1/providers/{npi} | Full provider record. Use include to select sections: affiliations, care_compare, qpp, eligibility, compliance, activity, industry_payments, canon — all by default, include=none for registry fields only. |
| GET /v1/practices | Search Medicare practices by name, PAC ID, NPI, city, state, or ZIP. |
| GET /v1/practices/{pac_id} | Practice profile: organization NPIs, enrolled locations, street addresses, providers, and historical QPP-reported ACO affiliations. |
| GET /v1/facilities/{type}/{ccn} | Facility identity, address, telephone, ownership, certification, and source. |
| GET /v1/labs | Search CLIA laboratories. q matches name or CLIA number; optional state, city, zip, page. |
| GET /v1/labs/{clia} | One laboratory: identity, address, certificate and category codes, certification and termination dates, test volumes, and related CLIA numbers. A CLIA number is not a CCN, so labs are served here rather than from facilities, and CMS codes are passed through rather than relabelled. |
| GET /v1/me | Your account, plan, and current limits. |
| GET /health | Liveness only. No token required, and it reports nothing else. |
Rate limits
Metered per key, per minute, so one system saturating its budget never starves another. Exceeding the limit returns 429 with a Retry-After header.
- Pro — 60 requests/minute
- Team — 300 requests/minute
- Alpha (design partner) — 1,200 requests/minute
Errors
Every error is JSON with a stable error code — never an HTML page or a redirect.
{
"error": "invalid_token",
"message": "That token is unknown, expired, or revoked."
}
- 401 missing_token · invalid_token
- 403 api_not_included
- 404 not_found
- 422 empty_query · query_too_broad · query_too_long · unknown_parameter
- 426 https_required — the API refuses plaintext rather than redirecting
- 429 rate limit exceeded
Data sources and honesty
Every field comes from a public United States federal dataset, and each response carries a meta.release block naming the exact release loaded: NPPES, Medicare PECOS enrollment, CMS Care Compare (Doctors & Clinicians and facility identity), QPP/MIPS, Order & Referring, Opt-Out affidavits, OIG LEIE, SAM.gov exclusions, Medicare utilization and Part D prescribing, CMS Open Payments, and CLIA laboratory certification.
ACO affiliations are historical performance-year assertions. They require an exact same-year NPI-to-PAC-to-ACO path; MIPS APM scoring alone is not treated as ACO membership, and absence from public reporting is not reported as non-membership.
Exclusion flags are reported only where the federal record itself carries the NPI. Name-similarity matches are never exposed through the API: a false-positive exclusion is the most damaging claim this data could make about a person. Nothing here is verified for credentialing, and it must not be the sole basis for payment, employment, or exclusion decisions.
Versioned under /v1. Breaking changes ship as /v2 rather than reshaping a live response.