The Pharmaceutical
Evidence API

Authentication

All API requests require an API key passed via the X-Evidara-Key header. Authenticated browser sessions may also use a Bearer JWT token in the Authorization header.

X-Evidara-Key: evd_live_••••••••••••••••

Authorization: Bearer <supabase_access_token>

API keys are scoped per organization. Manage keys at POST /keys (create) and DELETE /keys/{id} (revoke). Keys include a scopes array — ensure your key includes "write" for synthesis endpoints.

Evidence synthesis — streaming

Runs an agent chain and streams NDJSON events as each agent completes. This is the primary endpoint for building UIs and real-time pipelines. Each event line is a self-contained JSON object.

Evidence synthesis — synchronous

Synchronous variant. Waits for full chain completion and returns a single JSON result. Use for batch pipelines where streaming is inconvenient. Same parameters as the streaming endpoint.

{
  "run_id":             "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "status":             "PROVISIONAL" | "NEEDS_HUMAN_REVIEW",
  "chain_used":         "D",
  "agents_invoked":     ["AGENT_03_GENOMICS_TARGET_VALIDATOR", ...],
  "agent_count":        6,
  "llm_used":           true,
  "api_cost":           "$0.0157",     // string, not a number. May be absent.
  "residual_risk_summary": {"risk_level": "MODERATE"},
  "human_review_required": false,
  "conflict_events":    [],
  "safety_veto_events": [],
  "WALL_BREACH_LOG":    "NONE",
  "raw_inbox_ids":      ["uuid-a", "uuid-b", ...],
  "started_at":         "2026-04-27T12:00:00Z",
  "completed_at":       "2026-04-27T12:01:23Z"
}

Cost fields. api_cost is a string such as "$0.0157", not a number, and it may be absent — treat a missing value as unknown rather than zero. llm_used tells you whether the run actually invoked a model: several chains run deterministic pipelines that still make a small model call, so do not infer cost from the chain name.

This endpoint substitutes SLR-W for Chain SLR. Sending chain_override: "SLR" here runs the deterministic SLR-W scanner instead of the full systematic review, and the response says so: chain_used comes back as "SLR-W", never "SLR". Request the LLM-synthesized Chain SLR via /orchestrate/stream. Note SLR-W still makes a small model call — check llm_used rather than assuming a deterministic path is free.

Repeated SLR-W queries may be served from cache. An identical drug + indication query within 7 days can reuse the earlier run's result rather than re-querying the sources. This is disclosed, never hidden: the response carries from_cache: true and cache_age_h (age in hours) so you can tell a reused result from a fresh retrieval. The cache is in-memory and resets on deploy, so reuse is best-effort — do not depend on it for idempotency, and do not assume a repeated query was necessarily re-retrieved.

Detailed agent outputs (full reasoning text, evidence quality labels, source citations) are written to the audit trail (raw.inbox) and accessible via the Research Console. The raw_inbox_ids array links this run to its audit records.

Repurposing intelligence

Chain R runs AGENT_18_REPURPOSING_STRATEGIST against ChEMBL, OpenTargets, and ClinicalTrials.gov to identify candidate indications beyond the approved label. Returns associative signals — not clinical recommendations.

curl -X POST \
  https://evidence-os-production.up.railway.app/orchestrate \
  -H "X-Evidara-Key: evd_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "repurposing opportunities: metformin beyond type 2 diabetes",
    "chain_override": "R"
  }'

The repurposing engine pre-fetches compound profiles from ChEMBL and indication-association scores from OpenTargets before invoking AGENT_18. All findings are labeled with evidence quality and include residual risk assessment.

Dedicated routes also exist and are separate from the chain above: POST /repurposing/compound, POST /repurposing/indication, GET /repurposing/gaps and GET /repurposing/opportunities. All four require authentication.

Platform status

Returns platform operational status, compliance posture, and PHI scanner state. No authentication required. Use for health checks in your integration.

curl https://evidence-os-production.up.railway.app/health

{
  "status":  "ok",
  "system":  "EvidenceOS",
  "compliance": {
    "hipaa":       true,
    "gdpr":        true,
    "eu_ai_act":   "high_risk_mitigated",
    "phi_scanner": "active",
    "audit_trail": "append_only"
  }
}

Export — PDF / PowerPoint dossier

Generates a formatted PDF or PowerPoint dossier from a completed run. The format and the run id are both path segments — there is no request body. Three routes exist:

curl -X POST \
  https://evidence-os-production.up.railway.app/export/dossier/pdf/f47ac10b-... \
  -H "X-Evidara-Key: evd_live_your_key" \
  --output evidence_dossier.pdf

The two POST routes return a binary body; the GET route returns JSON. Pass the run_id from a prior /orchestrate response. Export is tier-gated — see Rate limits below.

Rate limits

Rate limits are applied per API key. Query quotas use a rolling 30-day window measured from each request backwards — they do not reset on a calendar boundary, so there is no monthly reset date to plan around. The per-minute limit uses a sliding window (resets on process restart for in-memory enforcement).

When a metered limit is reached, the API returns HTTP 429 with queries_used, monthly_limit, current_tier and an upgrade_url in the body. Upgrade at /login → Billing.