Assessment APIs

GOFA assessment APIs create a client-scoped assessment record and return the relative URLs needed to run the user-facing flow. The assessment pages are designed to be opened in an iframe or a trusted application handoff.

The current assessment API routes use the client derived from the request host, an enabled product module, and GOFA's existing authenticated integration boundary. Start with User authentication for a signed-in user or Client tokens for an existing backend integration. Never put a Firebase token, client secret, or other credential in an assessment URL.

Assessment families

• Body alignment — posture capture, result retrieval, and iframe events.
• Cognitive assessment — create a screening flow, collect its steps, and update a result.
• Fall risk — create the five-step balance and mobility flow.
• Fall risk results — list, retrieve, and safely update results.
• Fall risk PDF report — download an authenticated report.
• MSK assessment — create shoulder, low-back, or knee assessments.

The postMessage pages describe the callback envelopes emitted by the embedded assessment flows. Validate the sender origin before accepting any health data.

Scope and availability

These pages document the implementation available in the production source reference used for this migration. A client's enabled module and credential permissions still determine whether a route is available. Confirm Commercial API publication, partner entitlements, and host/origin values with GOFA before shipping a new integration.