Resource Model

Learn how Memo accounts, organizations, users, medications, calendar entries, and ANABOX smart devices relate.

Memo is organization-scoped. Most useful API calls begin with an organization ID or a patient ID, and authorization is checked against those relationships.

Relationship overview

Account
  └─ has access to → Organization
                        ├─ contains → Users
                        │              └─ patient user
                        │                    ├─ has → Calendar entries
                        │                    └─ uses → Devices
                        └─ owns → Medications
                                      └─ referenced by → Calendar entries

An account is the authenticated identity. Use GET /accounts/current as a credential check and to inspect the current account. Account endpoints are not a substitute for organization or patient lookup.

Organizations

Organizations are the tenant boundary. Users and medication records belong to an organization, and many list or create calls require its ID.

Do not infer access from possession of an ID. The API checks that the authenticated identity belongs to the requested organization.

Users and patients

Patients are represented as user records. The category field can distinguish care roles such as patient, relative, doctor, nurse, or pharmacist, while role controls API permissions.

Use GET /users/?organization={organizationId} to find users within the correct tenant. Keep user IDs opaque; current IDs look like MongoDB ObjectIds, but clients should not derive meaning from their format.

Medications

A medication belongs to an organization. Its structured or provider-specific data can appear in meta, while commonly used fields such as name may also appear at the top level.

When querying medications, send organization={organizationId}. The implementation enforces this tenant filter even where a generated field is shown as optional.

Calendar entries

Calendar entries describe medication intake times for a patient. An entry can reference a medication and include a date, time category, amount, unit, instruction, and recurrence data.

The calendar API also exposes bake operations. Baking materializes or finalizes schedule entries for a time window. Treat bake and unbake as workflow operations, not ordinary list or update calls.

Devices

A device is visible through a patient or organization relationship. Read endpoints expose device metadata, events, alarms, and case state. Command endpoints can register, reset, reboot, or change an LED; those operations can affect a physical device and should be tightly controlled.

Dates and time zones

Send timestamps as ISO 8601 strings, preferably with Z or an explicit UTC offset.
Store a user's time zone as an IANA value such as Europe/Berlin.
Convert schedules deliberately at the patient boundary, especially across daylight-saving changes.
Do not send a local wall-clock value without an offset when the field represents an instant.