GET /groups/{groupId}/account: funding, premium-equivalent totals, spend, and savings.GET /groups/{groupId}/members: the enrollment roster of who’s invited, active, and on COBRA.
Aggregate and de-identified by design. The account payload never contains named claims, diagnoses, or any individual’s health data, and spend categories are suppressed (k-anonymity) when a category could be traced to a small number of members. You can’t accidentally render PHI, because the API never returns it. See Compliance.
404 not_found until the group is enrolled. Pre-enrollment, use GET /census for roster display.
The account payload, in force
Acme Inc, two months after their 2026-09-01 start, activated toprod:
funding.monthlyFundingCents equals premiums.monthlyPremiumEquivalentCents, the breakdown sums to it exactly, and savings.savingsYtdCents is derived from the active baseline comparison.
Field-by-field UI mapping
All money is integer cents. Format with your standard currency utility, never floats.
The suppressed-spend case
For small groups (or early plan years), category-level spend could let an employer guess at an individual’s care. When the k-anonymity check trips, the API withholds categories rather than thin them:suppressionNote, and treat it as a normal state, not an error or an empty-data bug. Categories reappear automatically once the population supports them.
The roster
GET /groups/{groupId}/members powers the people table, with enrollment-admin data only:
dependents is a count and enrollment is two booleans on purpose: the roster tells the employer who is covered and onboarded, never anything about anyone’s health.
Freshness
asOf timestamps every account read. The data behind it updates as pulls settle and claims process. Cache for minutes, not days; on-load fetching with a short server-side cache is the pattern our own portal uses. Both endpoints fall under the standard 120 req/min rate limit.