Skip to main content
Once a group is enrolled, two read-only endpoints return employer account and roster data:
  • GET /groups/{groupId}/account: funding, premium-equivalent totals, spend, and savings.
  • GET /groups/{groupId}/members: the enrollment roster of who’s invited, active, and on COBRA.
Aggregate and de-identified by design. The account payload never contains named claims, diagnoses, or any individual’s health data, and spend categories are suppressed (k-anonymity) when a category could be traced to a small number of members. You can’t accidentally render PHI, because the API never returns it. See Compliance.
Both endpoints return 404 not_found until the group is enrolled. Pre-enrollment, use GET /census for roster display.

The account payload, in force

Acme Inc, two months after their 2026-09-01 start, activated to prod:
Note the internal consistency you can assert on: funding.monthlyFundingCents equals premiums.monthlyPremiumEquivalentCents, the breakdown sums to it exactly, and savings.savingsYtdCents is derived from the active baseline comparison.

Field-by-field UI mapping

All money is integer cents. Format with your standard currency utility, never floats.

The suppressed-spend case

For small groups (or early plan years), category-level spend could let an employer guess at an individual’s care. When the k-anonymity check trips, the API withholds categories rather than thin them:
Render the totals (always safe), replace the category chart with the suppressionNote, and treat it as a normal state, not an error or an empty-data bug. Categories reappear automatically once the population supports them.

The roster

GET /groups/{groupId}/members powers the people table, with enrollment-admin data only:
(Array truncated here; the API returns all members.) dependents is a count and enrollment is two booleans on purpose: the roster tells the employer who is covered and onboarded, never anything about anyone’s health.

Freshness

asOf timestamps every account read. The data behind it updates as pulls settle and claims process. Cache for minutes, not days; on-load fetching with a short server-side cache is the pattern our own portal uses. Both endpoints fall under the standard 120 req/min rate limit.