ODIN · API

Registry API — for developers

Machine access to the ODIN open registry: REST + DICOMweb (STOW-RS / QIDO-RS / WADO-RS). Pilot tokens are issued manually.

Authentication

REST: X-Registry-Token header on every request (pilot token).

DICOMweb: HTTP Basic (pilot credentials). Only /dicom-web/ is exposed — the Orthanc admin API is not public.

Get a token — apply for the pilot →

REST endpoints

`POST`	`/api/registry/case`	baseline-кейс caseFormV0 → { study_uuid }
`POST`	`/api/registry/upload`	resumable upload (tus-core: create → HEAD offset → PATCH append)
`POST`	`/api/registry/predict`	{ study_uuid } → CDSS percentile vs cohort (research prototype)
`POST`	`/api/registry/outcome`	{ study_uuid, outcome, marginal_bone_loss_mm?, outcome_date? }
`GET`	`/api/registry/chain`	hash-chain audit (data passport v0)
`GET`	`/api/registry/health`	liveness

DICOMweb (for PACS)

`POST`	`/dicom-web/studies`	STOW-RS: multipart/related; type="application/dicom"
`GET`	`/dicom-web/studies?PatientID={study_uuid}`	QIDO-RS: поиск по study_uuid
`GET`	`/dicom-web/studies/{study}/metadata`	WADO-RS metadata (application/dicom+json)

Contract: PatientID = the case study_uuid (created in the registry first). 2D radiography: IO / DX / PX / CR. CT/CBCT are accepted and defaced BEFORE anything hits disk: soft tissue (<150 HU) is replaced with air — no skin isosurface exists, bone/teeth/implants survive (soft-tissue diagnostics are lost — the honest price). Requirements: uncompressed transfer syntax, MONOCHROME2, calibrated HU; otherwise rejected.

curl -u "pilot-user:pilot-pass" \
  -X POST https://dentum.uz/dicom-web/studies \
  -H 'Content-Type: multipart/related; type="application/dicom"; boundary=B' \
  -H 'Accept: application/dicom+json' \
  --data-binary @stow-body.bin

Research access (T1)

Via OAuth2 + DUA click-through: de-identified FHIR R4 and OMOP CDM v5.4 export. T3 federation (FedAvg with signed updates) — with ≥2 clinics.

`POST`	`/api/registry/oauth/token`	OAuth2 client-credentials → Bearer (после DUA-accept)
`POST`	`/api/registry/dua/accept`	click-through DUA для скоупа T1
`GET`	`/api/registry/fhir/{Resource}`	FHIR R4 ndjson/Bundle (Patient/Observation/…) — Bearer T1
`GET`	`/api/registry/fhir/metadata`	FHIR CapabilityStatement (публично)
`GET`	`/api/registry/omop/{table}`	OMOP CDM v5.4 ndjson (person/condition_occurrence/…) — Bearer T1

De-identification (BEFORE anything hits disk)

PS3.15 Basic Profile subset: PII tags removed (names, addresses, institution, device serials, comments, etc.), AccessionNumber/StudyID blanked
All private tags, overlay (60xx) and curve (50xx) groups stripped
All UIDs deterministically remapped into the 2.25 space (SHA-256 + registry salt) — series stay consistent, no link back to the clinic PACS
StudyDate/StudyTime retained (6/12-month outcomes need them)
No pixel cleaning: instances with BurnedInAnnotation=YES are rejected
CBCT/CT: defacing by soft-tissue ablation (<150 HU → air) before disk; bone shape remains — residual risk declared in the T2 DUA

OpenAPI draft (YAML) → ·T0 stats → ·Data dictionary → ·Open tier T0 →