> ## Documentation Index > Fetch the complete documentation index at: https://docs.teamcaredental.com/llms.txt > Use this file to discover all available pages before exploring further. # List locations > This endpoint retrieves locations with optional organization_id query parameter. #### Request - Query Parameters - organization_id (optional) - with_attribution_script_install(optional): Pass this param (as shown in example below) to fetch those practices that has installed the TC attribution script on their websites. ```json { "q": { "with_attribution_script_install": true } } ``` The response is in JSON format and follows the schema below: ```json { "data": [ { "id": "string", "type": "string", "attributes": { "title": "string", "email": "string", "website": "string", "pms_type": "string", "last_sync": "string", "data_provider": "string", "business_hours_weekly_summary": [ { "day": "string", "open": "string", "hours": 0 } ], "name": "string", "phone_number": "string", "country": "string", "data_provider_id": "string", "third_party_identifier": { "data": [ { "id": "number", "type": "string", "attributes": { "individual_id": "number", "individual_type": "string", "external_id": "string" } } ] } } } ] } ``` `organization_id` is optional. If provided, the request returns locations under the specified organization within the consulting firm. If omitted, it returns all locations across all organizations under the consulting firm. ## OpenAPI ````yaml https://app.teamcaredental.com/openapi-vendors-v2.json get /locations openapi: 3.1.0 info: title: TeamCare Vendor API (v2) version: 2.0.0 description: >- Version 2 of the TeamCare Vendor API. HIPAA-compliant and opt-in. ## What changed from v1 The data endpoints and response shapes are identical to v1 — **only how you address a location changes.** In v1 the location lived in every URL (`/locations/{location_id}/patients`). In v2 you request a **slot** for a location once, then send the returned `request_key` in the `X-Vendor-Request-Key` header; `location_id` is gone from the data routes. ## Request cycle 1. `POST /auth/token` → JWT (unchanged from v1). 2. `GET /organizations`, `GET /locations` → pick a `location_id`. 3. `POST /locations/{location_id}/slots` → `{ request_key, expires_at }`. 4. Call any data endpoint with header `X-Vendor-Request-Key: ` (no `location_id` in the path). ## Minimal changes to migrate - Point your base URL at `https://api.teamcaredental.com/api/v2/vendors` (v2 is served from `api.teamcaredental.com`, not `app.teamcaredental.com`). - Call the slot endpoint **once per location**. - Drop `/locations/{location_id}` from your data paths and add the `X-Vendor-Request-Key` header. - Everything else — authentication, Ransack `q` filters, pagination, response shapes — is unchanged. ## Slot validity, cooldown & quota - **Validity:** a `request_key` is valid for **6 hours** — the same lifetime as the access token. After that it stops authorizing and you must request a new slot. - **Cooldown:** you can only re-request the **same** location's slot once every **2 minutes**. Within the cooldown the slot endpoint returns `429` with a `retry_after` (seconds). - **Quota:** each firm may hold up to its `concurrent_slots` quota (default **10**) active request keys at once, so data for at most 10 locations can be pulled concurrently. Requesting an 11th slot trims the oldest key, so its `request_key` stops authorizing immediately and any in-flight requests using it fail with `401`. To raise the quota above 10, contact TeamCare support. - **Rate limit:** the slot endpoint accepts at most 10 requests per 10 seconds per token. ## Recommended usage Request a slot for a location and pull **all** of that location's data in one pass before moving on — don't re-request slots per call or churn between locations. If you fan out across locations in parallel, keep the fan-out at or below your quota: once an 11th slot is requested, the oldest `request_key` is invalidated even if a sync is still running on it. See the [changelog](https://docs.teamcaredental.com/changelog) for the full list of changes from v1. servers: - url: https://api.teamcaredental.com/api/v2/vendors security: - bearerAuth: [] paths: /locations: get: tags: - Locations summary: List locations description: >- This endpoint retrieves locations with optional organization_id query parameter. #### Request - Query Parameters - organization_id (optional) - with_attribution_script_install(optional): Pass this param (as shown in example below) to fetch those practices that has installed the TC attribution script on their websites. ```json { "q": { "with_attribution_script_install": true } } ``` The response is in JSON format and follows the schema below: ```json { "data": [ { "id": "string", "type": "string", "attributes": { "title": "string", "email": "string", "website": "string", "pms_type": "string", "last_sync": "string", "data_provider": "string", "business_hours_weekly_summary": [ { "day": "string", "open": "string", "hours": 0 } ], "name": "string", "phone_number": "string", "country": "string", "data_provider_id": "string", "third_party_identifier": { "data": [ { "id": "number", "type": "string", "attributes": { "individual_id": "number", "individual_type": "string", "external_id": "string" } } ] } } } ] } ``` `organization_id` is optional. If provided, the request returns locations under the specified organization within the consulting firm. If omitted, it returns all locations across all organizations under the consulting firm. operationId: locations_list parameters: - name: organization_id in: query required: false description: >- If provided, the request returns locations under the specified organization within the consulting firm. If omitted, it returns all locations across all organizations under the consulting firm. schema: type: integer example: 525 - name: q in: query required: false style: deepObject explode: true schema: type: object properties: with_attribution_script_install: type: boolean example: true description: >- Pass this param to fetch those practices that has installed the TC attribution script on their websites. example: with_attribution_script_install: true - name: page in: query required: false description: Page number (page-based pagination). schema: type: integer example: 1 - name: items in: query required: false description: Items per page. schema: type: integer example: 10 responses: '200': description: Successful response content: application/json: schema: type: object example: data: - id: string type: string attributes: title: string email: string website: string pms_type: string last_sync: string data_provider: string business_hours_weekly_summary: - day: string open: string hours: 0 name: string phone_number: string country: string data_provider_id: string third_party_identifier: data: - id: 0 type: string attributes: individual_id: 0 individual_type: string external_id: string '401': description: Missing, invalid or expired token. content: application/json: schema: type: object properties: errors: type: string example: errors: not authorized '403': description: The credential may not access this resource. content: application/json: schema: type: object properties: errors: type: string example: errors: access Denied '404': description: Resource not found. content: application/json: schema: type: object properties: errors: type: string example: errors: resource not found '422': description: The request could not be processed. content: application/json: schema: type: object properties: errors: type: string example: errors: ... components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT returned by POST /auth/token. Valid for six hours. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.