Medicaid Waiver Register · DEVELOPER ACCESS

API and webhooks

Use your product’s URL in the examples below. Keep API keys on your server. Open interactive API documentation ↗

Read public records

curl 'https://medicaidwaivers.getregisters.com/api/v1/feeds/cms-waivers/records?limit=50&offset=0'

Public responses contain base fields as soon as records are published. Follow next_offset until it is null, including when a filtered page has no records. Cite each original source_url. Publication and observation dates represent different events.

Read PRO records

curl 'https://medicaidwaivers.getregisters.com/api/v1/feeds/cms-waivers/records?limit=50&offset=0' \
  -H 'Authorization: Bearer YOUR_SCOPED_KEY'

Create or rotate your key in your account. A key works only for this product and while paid access is active.

Export formats

PRO includes CSV, Excel (.xlsx), XML, RSS and Atom. Use your product’s API key and the same filters for every format. For example, download up to 100 records as an Excel workbook:

curl 'https://medicaidwaivers.getregisters.com/api/v1/feeds/cms-waivers/records/export.xlsx?limit=100&offset=0' \
  -H 'Authorization: Bearer YOUR_SCOPED_KEY' \
  -D export-headers.txt -o records.xlsx

Replace xlsx with csv, xml, rss or atom. Add filters such as document_type=adopted or facility_id=YOUR_FACILITY_ID. Follow the response's Link header with rel="next"until it is absent, keeping the Authorization header on each request. Each page is limited to 100 records; a filtered page can be empty while a later page still exists.

For RSS and Atom, configure a reader that supports the Authorization header. Reader URLs contain no key. Entries have stable record IDs, and readers that do not follow pagination receive the newest page. Use the paginated API when you need every record.

Read a record's history

curl 'https://medicaidwaivers.getregisters.com/api/v1/records/RECORD_ID/history?limit=50&offset=0' \
  -H 'Authorization: Bearer YOUR_SCOPED_KEY'

Replace RECORD_ID with a returned record ID. History returns an array in newest-first order. Continue with offset increased by the page length until a page is shorter than the requested limit. Versions may be source changes or extraction corrections.

Connect with MCP

curl 'https://medicaidwaivers.getregisters.com/api/v1/mcp' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"read_register","arguments":{"feed_id":"cms-waivers"}}}'

Add the same Authorization header for PRO fields. The endpoint also supports initialize, tools/list and notifications/initialized. Use the REST pagination above when reading a complete register.

Verify webhook signatures

The signature header is X-Register-Signature: t=TIMESTAMP,v1=HEX_DIGEST. Verify the raw body before parsing JSON. Keep a durable record of successfully handled X-Register-Event IDs so retries do not repeat side effects.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(rawBody, header, secret) {
  const fields = Object.fromEntries(header.split(',').map(x => x.split('=')));
  const timestamp = Number(fields.t);
  if (!Number.isFinite(timestamp) || Math.abs(Date.now()/1000 - timestamp) > 300) return false;
  if (!/^[a-f0-9]{64}$/.test(fields.v1 || '')) return false;
  const expected = createHmac('sha256', secret).update(fields.t + '.').update(rawBody).digest();
  const supplied = Buffer.from(fields.v1, 'hex');
  return supplied.length === expected.length && timingSafeEqual(supplied, expected);
}

Return a successful response only after recording the event durably. Delivery retries are bounded; your account shows the latest recorded outcome. A delivery acknowledgement does not confirm that your application finished processing the event.