Centaur Dental4Web API Platform

Overview

Centaur Software's Dental4Web platform lets third-party applications securely read and write practice data — patients, appointments, clinical records and finance — while an admin dashboard manages organisations, API partners, keys, access tiers and usage.

The system is split into two backends. A Django REST API powers the admin dashboard: user roles, tenants, integrator onboarding, AWS API keys, capability tiers, audit logs and Zoho CRM sync. A FastAPI service exposes the external Dental4Web API. Each practice keeps its own Sybase SQL Anywhere database, so every incoming request is authenticated at AWS API Gateway, mapped from an organisation ID to that practice's database, checked against the integrator's capabilities and rate limits, and served as a versioned REST response — including FHIR resources where required.

How it works

1. An integrator is onboarded in the dashboard and issued an AWS API key tied to one or more tenant organisations.
2. Access is controlled by tiers and capabilities (patient, appointment, clinical, financial, FHIR, imaging, consent, upload) plus per-minute and daily rate limits.
3. The partner calls the public API with the organisation ID. The API resolves that organisation to the correct practice database and returns only the data the key is allowed to access.
4. Dashboard and API data stay in sync across PostgreSQL (dashboard) and MySQL (API configuration, mappings and rate limits).
5. Services run in Docker locally and on AWS ECS Fargate (dev, UAT, production), with GitHub Actions building and deploying images and Datadog collecting traces and logs.

My contribution

• Designed and developed backend services that give third-party integrators access to patient, appointment, clinical and financial data.
• Built Django REST Framework APIs for integrator onboarding, tenant management, AWS API key lifecycle, role-based admin access, audit logs and Zoho CRM tenant sync.
• Developed the FastAPI integration layer for patients, appointments, treatments, clinical notes, finance, imaging, consent and FHIR resources, with request validation and a thin service layer.
• Implemented organisation-based request routing so each API call resolves to the correct per-practice Sybase SQL Anywhere database.
• Designed the data model for organisations, integrators, API keys, capability tiers and rate limits, including cross-database mappings between the PostgreSQL dashboard and the MySQL API configuration store.
• Enforced integrator authorisation with capability checks and configurable per-minute and daily rate limits tied to subscription tiers.
• Secured APIs with JWT authentication, AWS API Gateway keys and role-based access for super admin, organisation admin and admin users.
• Owned schema changes through Django migrations and Alembic, keeping dashboard and API configuration data consistent across services.
• Containerised services with Docker Compose and supported deployment on AWS ECS Fargate across development, UAT and production through GitHub Actions CI/CD.
• Added structured logging and Datadog APM tracing to correlate API requests across services, and wrote pytest coverage enforced by an 80% gate in CI.