> ## Documentation Index > Fetch the complete documentation index at: https://docs.clinikehr.com/llms.txt > Use this file to discover all available pages before exploring further. # List dispensing flags > **Permission:** `dispensing:read` Refill/duplicate-dispensing flags for the caller's linked enrollees, in a date window. Each flag's rule, evidence, and the pharmacist's reason — never price, margin, staff identity beyond this, or any other customer of the pharmacy. Never references the "possibly the same person" mechanism — that is a prompt to look, never a finding, and never crosses the API boundary. ## OpenAPI ````yaml /openapi/ehr-api.v1.yaml get /v1/clinics/{clinic_id}/dispensing/flags openapi: 3.1.0 info: title: ClinikEHR API version: 1.0.0 description: >- Server-to-server REST API for a clinic's own data, reached with a key the clinic (or a developer workspace) creates in the developer portal. Authenticate every request with `Authorization: Bearer `. Test keys reach only your workspace's own synthetic sandbox; live keys reach the clinic that created them. Lists wrap their rows as `{ data, has_more, next_cursor }`; single resources are returned directly. Errors are `application/problem+json` (RFC 9457) with a stable `code`. Write requests accept an `Idempotency-Key` header so a retry never repeats a change. See the guides for authentication, permissions, pagination, rate limits and retries. servers: - url: https://api.clinikehr.com security: - ApiKey: [] paths: /v1/clinics/{clinic_id}/dispensing/flags: get: tags: - Dispensing summary: List dispensing flags description: >- **Permission:** `dispensing:read` Refill/duplicate-dispensing flags for the caller's linked enrollees, in a date window. Each flag's rule, evidence, and the pharmacist's reason — never price, margin, staff identity beyond this, or any other customer of the pharmacy. Never references the "possibly the same person" mechanism — that is a prompt to look, never a finding, and never crosses the API boundary. operationId: listDispensingFlags parameters: - name: clinic_id in: path required: true schema: type: string format: uuid - name: since in: query required: false schema: type: string format: date-time - name: until in: query required: false schema: type: string format: date-time - name: limit in: query required: false schema: type: integer minimum: 1 maximum: 100 default: 25 - name: starting_after in: query required: false schema: type: string responses: '200': description: OK. content: application/json: schema: type: object required: - data - has_more - next_cursor properties: data: type: array items: $ref: '#/components/schemas/DispensingFlag' has_more: type: boolean next_cursor: type: - string - 'null' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' security: - ApiKey: [] components: schemas: DispensingFlag: type: object required: - id - patient_id - medicine description: >- Never the pharmacy's other customers, never price, never staff identity beyond a role word (this row carries no staff column at all). check_state is never no_person/person_not_identified_skipped — those are excluded before this row is ever built (the ABSENCE of a check, not a finding). properties: id: type: string format: uuid patient_id: type: string format: uuid medicine: $ref: '#/components/schemas/DispensingMedicine' days_supply: type: - integer - 'null' date: type: - string - 'null' format: date-time check_state: type: - string - 'null' enum: - clear - shown_acknowledged - not_shown_pending - not_shown_offline - null flags: type: array items: type: string evidence: type: object reason: $ref: '#/components/schemas/DispensingFlagReason' DispensingMedicine: type: object properties: name: type: - string - 'null' generic_name: type: - string - 'null' brand_name: type: - string - 'null' identifiers: type: array items: $ref: '#/components/schemas/Identifier' DispensingFlagReason: type: object properties: code: type: - string - 'null' enum: - lost - damaged - dose_changed - travelling - prescriber_instruction - other - null text: type: - string - 'null' Problem: type: object description: RFC 9457 application/problem+json. required: - type - title - status - code - request_id properties: type: type: string format: uri title: type: string status: type: integer detail: type: string code: type: string request_id: type: string errors: type: array items: type: object required: - pointer - message properties: pointer: type: string message: type: string Identifier: type: object required: - system - value properties: system: type: string enum: - gtin - nafdac - ndc - rxcui - partner value: type: string responses: BadRequest: description: >- The request failed validation (unknown query parameter, limit out of range, malformed body). content: application/problem+json: schema: $ref: '#/components/schemas/Problem' Unauthorized: description: >- Missing, malformed, unknown, revoked or expired key, or the wrong secret. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' Forbidden: description: >- The key or connection lacks the required scope, the plan does not include this resource, the request came from an address this key's IP allow-list does not permit, a TEST-environment workspace key asked for a clinic_id other than its own workspace's sandbox (`sandbox_only`), or a LIVE workspace key asked for a real clinic while its workspace's verification has lapsed (`not_verified`) — the response never names which addresses ARE allowed, nor which clinic actually is the sandbox. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' TooManyRequests: description: Rate limited. See the Retry-After header. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: ehr_live__ or ehr_test__ ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.