> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pinnacle.sh/v-2/documentation/hipaa/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pinnacle.sh/_mcp/server.

# HIPAA & BAAs

> Arrange HIPAA onboarding with Pinnacle and check which API endpoints are supported or unavailable.

## Onboarding required

> **Note**
>
> **HIPAA access requires onboarding with Pinnacle and a signed Business Associate Agreement (BAA).** Creating an account does not complete onboarding or authorize sending protected health information (PHI).

Contact [founders@pinnacle.sh](mailto:founders@pinnacle.sh) to get started. Before sending PHI:

1. Complete a BAA with Pinnacle.
2. Work with Pinnacle to configure your team, phone numbers, credentials, and webhook destinations.
3. Receive confirmation that your integration is ready for HIPAA use.

Pinnacle provides connection details during onboarding. An existing integration does not move into the HIPAA environment automatically.

## Endpoint availability

Expand a group to explore supported endpoints, or select Not supported to browse endpoints in beta. Each operation links to its API reference.

> **Warning**
>
> When adapting API examples, use the connection details and credentials provided during HIPAA onboarding. Use synthetic data in the documentation's API playground.

#### Supported (67)

#### Fax ✓ HIPAA only

Fax is a HIPAA-only service that Pinnacle enables during onboarding, including setup for your fax phone numbers. It is not available through the standard API.

Sent and received faxes cost **\$0.025 per page**, regardless of quality. Higher quality settings may take longer to process and send. Before sending a fax, Pinnacle temporarily sets aside enough credits for the prepared document. Afterward, the amount is adjusted to match the pages actually sent. Automatic retries and splitting a large fax into smaller parts do not add extra holds or charges.

Documents must use public HTTPS URLs without credentials. Redirects and private-network URLs are blocked. Files can be up to 50 MB, and a fax can contain 1–3,500 pages. Faxes over 350 pages are automatically split into parts of up to 350 pages each, and every part must be 50 MB or smaller. The parts still appear as one fax in the API.

For readable, reliable faxes:

* Use high-contrast black text on white Letter or A4 pages. Avoid small print, shading, and color-only meaning; fax transmission can change their appearance.
* Preview each source page before sending. Pinnacle fits TIFF pages to US Letter while preserving their aspect ratio, but fax transmission can still blur fine detail.
* Confirm the final status and transmitted page count. For important information, review the received pages with the recipient; neither an accepted request nor a page count proves legibility.

Pinnacle checks each document before sending it and rejects unsafe, damaged, encrypted, or oversized files. Rejected files fail before any credits are set aside. See [Send Fax](/api-reference/fax-hipaa-only/send) for all document and duplicate-request requirements.

Fax webhooks do not include document URLs. When you receive a `FAX.RECEIVED` event, call [Get Fax](/api-reference/fax-hipaa-only/get) with `fax.id`. The authenticated response includes a signed `mediaUrl` that expires after one hour. Treat this URL as sensitive: do not log or store it, and request a new one after it expires.

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/fax`</td>

      <td>[Send Fax](/api-reference/fax-hipaa-only/send)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/fax`</td>

      <td>[List Faxes](/api-reference/fax-hipaa-only/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/fax/{id}`</td>

      <td>[Get Fax](/api-reference/fax-hipaa-only/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/fax/{id}/cancel`</td>

      <td>[Cancel Fax](/api-reference/fax-hipaa-only/cancel)</td>
    </tr>
  </tbody>
</table>

#### Messages 12 of 17 supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/messages/list`</td>

      <td>[List Messages](/api-reference/messages/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/messages/{id}`</td>

      <td>[Get Message by ID](/api-reference/messages/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/send/sms`</td>

      <td>[Send SMS Message](/api-reference/messages/send-sms)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/send/mms`</td>

      <td>[Send MMS Message](/api-reference/messages/send-mms)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/react`</td>

      <td>[React to a Message](/api-reference/messages/react)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/blast/sms`</td>

      <td>[Blast SMS to Audience](/api-reference/messages/blast-sms)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/blast/mms`</td>

      <td>[Blast MMS to Audience](/api-reference/messages/blast-mms)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/validate/sms`</td>

      <td>[Validate SMS Message](/api-reference/messages/validate-sms)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/validate/mms`</td>

      <td>[Validate MMS Message](/api-reference/messages/validate-mms)</td>
    </tr>

    <tr>
      <td>`DELETE`</td>

      <td>`/messages/schedule/{id}`</td>

      <td>[Cancel Scheduled Message](/api-reference/messages/cancel-scheduled-message)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/schedules/list`</td>

      <td>[List Scheduled Messages](/api-reference/messages/list-scheduled-messages)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/messages/blasts/list`</td>

      <td>[List Blasts](/api-reference/messages/list-blasts)</td>
    </tr>
  </tbody>
</table>

#### Conversations ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/conversations/list`</td>

      <td>[List Conversations](/api-reference/conversations/list)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/conversations/get`</td>

      <td>[Get Conversation](/api-reference/conversations/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/conversations/update`</td>

      <td>[Update Conversation](/api-reference/conversations/update)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/conversations/{id}/messages`</td>

      <td>[List Conversation Messages](/api-reference/conversations/list-messages)</td>
    </tr>
  </tbody>
</table>

#### Contacts ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/contacts/list`</td>

      <td>[List Contacts](/api-reference/contacts/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/contacts`</td>

      <td>[Get Contact](/api-reference/contacts/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/contacts`</td>

      <td>[Create New Contact](/api-reference/contacts/create)</td>
    </tr>

    <tr>
      <td>`PUT`</td>

      <td>`/contacts`</td>

      <td>[Update Contact](/api-reference/contacts/update)</td>
    </tr>
  </tbody>
</table>

#### Audiences ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/audiences/list`</td>

      <td>[List Audiences](/api-reference/audiences/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/audiences`</td>

      <td>[Get Audience](/api-reference/audiences/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/audiences`</td>

      <td>[Create Audience](/api-reference/audiences/create)</td>
    </tr>

    <tr>
      <td>`PATCH`</td>

      <td>`/audiences`</td>

      <td>[Update Audience](/api-reference/audiences/update)</td>
    </tr>

    <tr>
      <td>`DELETE`</td>

      <td>`/audiences`</td>

      <td>[Delete Audience](/api-reference/audiences/delete)</td>
    </tr>

    <tr>
      <td>`PATCH`</td>

      <td>`/audiences/contacts`</td>

      <td>[Add Contacts to Audience](/api-reference/audiences/add-contacts)</td>
    </tr>

    <tr>
      <td>`DELETE`</td>

      <td>`/audiences/contacts`</td>

      <td>[Remove Contacts from Audience](/api-reference/audiences/remove-contacts)</td>
    </tr>
  </tbody>
</table>

#### Files and contact cards ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/tools/files/upload`</td>

      <td>[Upload File](/api-reference/tools/upload-file)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/tools/files/refresh`</td>

      <td>[Refresh File URLs](/api-reference/tools/refresh-file)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/tools/contact-card`</td>

      <td>[Get Contact Card](/api-reference/tools/get-contact-card)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/tools/contact-card/upsert`</td>

      <td>[Upsert Contact Card](/api-reference/tools/upsert-contact-card)</td>
    </tr>
  </tbody>
</table>

#### Webhooks ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/webhooks/list`</td>

      <td>[List Webhooks](/api-reference/webhooks/list)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/webhooks`</td>

      <td>[Retrieve Webhooks](/api-reference/webhooks/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/webhooks/attach`</td>

      <td>[Attach Webhook](/api-reference/webhooks/attach-webhook)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/webhooks/detach`</td>

      <td>[Detach Webhook](/api-reference/webhooks/detach-webhook)</td>
    </tr>
  </tbody>
</table>

#### Phone Numbers 5 of 6 supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/phone-numbers/list`</td>

      <td>[List Phone Numbers](/api-reference/phone-numbers/list)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/phone-numbers/search`</td>

      <td>[Search for Available Phone Numbers](/api-reference/phone-numbers/search)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/phone-numbers/buy`</td>

      <td>[Buy Phone Numbers](/api-reference/phone-numbers/buy)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/phone-numbers/attach-campaign`</td>

      <td>[Attach Campaign](/api-reference/phone-numbers/attach-campaign)</td>
    </tr>

    <tr>
      <td>`DELETE`</td>

      <td>`/phone-numbers/detach-campaign`</td>

      <td>[Detach Campaign](/api-reference/phone-numbers/detach-campaign)</td>
    </tr>
  </tbody>
</table>

#### Brands ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/brands/list`</td>

      <td>[List Brands](/api-reference/brands/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/brands/{id}`</td>

      <td>[Get Brand by ID](/api-reference/brands/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/brands`</td>

      <td>[Create or Update a Brand](/api-reference/brands/upsert)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/brands/{brandId}/submit`</td>

      <td>[Submit Brand](/api-reference/brands/submit)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/brands/{brandId}/vet`</td>

      <td>[Vet Brand](/api-reference/brands/vet)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/brands/autofill`</td>

      <td>[Autofill Brand Information](/api-reference/brands/autofill)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/brands/validate`</td>

      <td>[Validate Brand Information](/api-reference/brands/validate)</td>
    </tr>
  </tbody>
</table>

#### Campaigns / 10DLC ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/campaigns/dlc/list`</td>

      <td>[List 10DLC Campaigns](/api-reference/campaigns/10-dlc/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/campaigns/dlc/{campaignId}`</td>

      <td>[Get 10DLC Campaign by ID](/api-reference/campaigns/10-dlc/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/dlc`</td>

      <td>[Create or Update 10DLC Campaign](/api-reference/campaigns/10-dlc/upsert)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/dlc/submit/{campaignId}`</td>

      <td>[Submit 10DLC Campaign](/api-reference/campaigns/10-dlc/submit)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/dlc/autofill`</td>

      <td>[Autofill 10DLC Campaign Information](/api-reference/campaigns/10-dlc/autofill)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/dlc/validate`</td>

      <td>[Validate 10DLC Campaign Information](/api-reference/campaigns/10-dlc/validate)</td>
    </tr>
  </tbody>
</table>

#### Campaigns / Toll-Free ✓ All supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`POST`</td>

      <td>`/campaigns/toll-free/list`</td>

      <td>[List Toll-Free Campaigns](/api-reference/campaigns/toll-free/list)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/campaigns/toll-free/{campaignId}`</td>

      <td>[Get Toll-Free Campaign by ID](/api-reference/campaigns/toll-free/get)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/toll-free`</td>

      <td>[Create or Update Toll-Free Campaign](/api-reference/campaigns/toll-free/upsert)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/toll-free/submit/{campaignId}`</td>

      <td>[Submit Toll-Free Campaign](/api-reference/campaigns/toll-free/submit)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/toll-free/autofill`</td>

      <td>[Autofill Toll-Free Campaign Information](/api-reference/campaigns/toll-free/autofill)</td>
    </tr>

    <tr>
      <td>`POST`</td>

      <td>`/campaigns/toll-free/validate`</td>

      <td>[Validate Toll-Free Campaign Information](/api-reference/campaigns/toll-free/validate)</td>
    </tr>
  </tbody>
</table>

#### Status 4 of 5 supported

<table>
  <thead>
    <tr>
      <th>Method</th>

      <th>Endpoint</th>

      <th>API reference</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`GET`</td>

      <td>`/status/brand/{brandId}`</td>

      <td>[Get Brand Status](/api-reference/status/brand)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/status/dlc-campaign/{campaignId}`</td>

      <td>[Get 10DLC Campaign Status](/api-reference/status/dlc-campaign)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/status/toll-free-campaign/{campaignId}`</td>

      <td>[Get Toll-Free Campaign Status](/api-reference/status/toll-free-campaign)</td>
    </tr>

    <tr>
      <td>`GET`</td>

      <td>`/status/phone-number/{phoneNumber}`</td>

      <td>[Get Phone Number Status](/api-reference/status/phone-number)</td>
    </tr>
  </tbody>
</table>

#### Not supported (32)

HIPAA support for these endpoints is in beta and requires separate approval. If your integration needs any of them, [contact Pinnacle](mailto:founders@pinnacle.sh) to discuss access.

Do not send PHI through these endpoints until Pinnacle confirms support for your integration.

#### RCS messages and simulated events (5)

| Method | Endpoint                  | API reference                                                        |
| ------ | ------------------------- | -------------------------------------------------------------------- |
| `POST` | `/messages/send/rcs`      | [Send RCS Message](/api-reference/messages/send-rcs)                 |
| `POST` | `/messages/send/typing`   | [Send Typing Indicator](/api-reference/messages/send-typing)         |
| `POST` | `/messages/blast/rcs`     | [Blast RCS to Audience](/api-reference/messages/blast-rcs)           |
| `POST` | `/messages/validate/rcs`  | [Validate RCS Message](/api-reference/messages/validate-rcs)         |
| `POST` | `/messages/simulate/user` | [Simulate Inbound User Event](/api-reference/messages/simulate-user) |

#### RCS agents and testing (9)

| Method  | Endpoint                               | API reference                                                                      |
| ------- | -------------------------------------- | ---------------------------------------------------------------------------------- |
| `GET`   | `/rcs/{agentId}`                       | [Get Agent](/api-reference/rcs-agents/get-agent)                                   |
| `POST`  | `/rcs/agents/list`                     | [List RCS Agents](/api-reference/rcs-agents/list)                                  |
| `POST`  | `/rcs/test/numbers/list`               | [List Whitelisted Numbers](/api-reference/rcs-agents/list-whitelisted-numbers)     |
| `POST`  | `/rcs/capabilities`                    | [Get RCS Capabilities](/api-reference/rcs-agents/get-capabilities)                 |
| `POST`  | `/rcs/link`                            | [Generate RCS Link](/api-reference/rcs-agents/get-link)                            |
| `POST`  | `/rcs/test/agents`                     | [Create Test Agent](/api-reference/rcs-agents/test/create-agent)                   |
| `PATCH` | `/rcs/test/agents/{agentId}`           | [Update Test Agent](/api-reference/rcs-agents/test/update-agent)                   |
| `POST`  | `/rcs/test/agents/{agentId}/whitelist` | [Whitelist Number for Test Agent](/api-reference/rcs-agents/test/whitelist-number) |
| `GET`   | `/rcs/test/agents/{agentId}/numbers`   | [Get Whitelist Status](/api-reference/rcs-agents/test/get-whitelist-status)        |

#### RCS campaigns (7)

| Method | Endpoint                             | API reference                                                              |
| ------ | ------------------------------------ | -------------------------------------------------------------------------- |
| `POST` | `/campaigns/rcs/list`                | [List RCS Campaigns](/api-reference/campaigns/rcs/list)                    |
| `GET`  | `/campaigns/rcs/{campaignId}`        | [Get RCS Campaign by ID](/api-reference/campaigns/rcs/get)                 |
| `POST` | `/campaigns/rcs`                     | [Create or Update RCS Campaign](/api-reference/campaigns/rcs/upsert)       |
| `POST` | `/campaigns/rcs/submit/{campaignId}` | [Submit RCS Campaign](/api-reference/campaigns/rcs/submit)                 |
| `POST` | `/campaigns/rcs/autofill`            | [Autofill RCS Campaign Information](/api-reference/campaigns/rcs/autofill) |
| `POST` | `/campaigns/rcs/validate`            | [Validate RCS Campaign Information](/api-reference/campaigns/rcs/validate) |
| `GET`  | `/status/rcs-campaign/{campaignId}`  | [Get RCS Campaign Status](/api-reference/status/rcs-campaign)              |

#### Short links and phone-number enrichment (5)

| Method | Endpoint                 | API reference                                                               |
| ------ | ------------------------ | --------------------------------------------------------------------------- |
| `POST` | `/phone-numbers/details` | [Number Intelligence - Get Phone Details](/api-reference/phone-numbers/get) |
| `POST` | `/tools/url/list`        | [List Shortened URLs](/api-reference/tools/list)                            |
| `GET`  | `/tools/url/{linkId}`    | [Get Shortened URL](/api-reference/tools/get-url)                           |
| `POST` | `/tools/url`             | [Create Shortened URL](/api-reference/tools/create-url)                     |
| `PUT`  | `/tools/url/{linkId}`    | [Update Shortened URL](/api-reference/tools/update-url)                     |

#### Forms (6)

| Method  | Endpoint                       | API reference                                                       |
| ------- | ------------------------------ | ------------------------------------------------------------------- |
| `GET`   | `/forms/{id}`                  | [Get Form](/api-reference/forms/get-form)                           |
| `POST`  | `/forms/list`                  | [List Forms](/api-reference/forms/list-forms)                       |
| `POST`  | `/forms/{id}/submissions/list` | [List Form Submissions](/api-reference/forms/list-form-submissions) |
| `POST`  | `/forms`                       | [Create Form](/api-reference/forms/create-form)                     |
| `PATCH` | `/forms/{id}`                  | [Update Form](/api-reference/forms/update-form)                     |
| `POST`  | `/forms/send`                  | [Send Form](/api-reference/forms/send-form)                         |

## Handling patient information

Keep patient information out of support requests, documentation tools, brand and campaign registration, and autofill inputs. Limit access to webhook payloads, message responses, and media links to authorized people and systems.

> One API for RCS, iMessage, MMS, and SMS. Build, test, and scale every channel — send your first message in minutes, not weeks.