# Create a medical condition record for a member

`POST /api/members/{memberId}/medical-details`

- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Create a medical condition record for a member](https://support.gladstonesoftware.cloud/reference/members/create-a-medical-condition-record-for-a-member)

## Overview

Adds one medical condition to a member's record: a condition type drawn from the tenant's
configured list, plus an optional free-text note. Use it when a member declares a condition on a
health questionnaire, at induction, or when staff record one during a conversation.

Each call adds a record. Nothing is de-duplicated, so posting the same `medicalConditionTypeId`
twice leaves the member with two records of the same type — check
[Retrieve a member's medical information](retrieve-a-members-medical-information.md)
first if you are syncing rather than appending.

On success you get `201 Created` with a `Location` header pointing at that same retrieval endpoint,
and a body of `"Created"`. **The new record's id is not returned.** You need it to change or remove
the record later, so read it back from the retrieval endpoint, where it appears as
`medicalConditions[].id`, and do not confuse it with `medicalConditionTypeId` — they are different
numbers. From there,
[Update a member's medical condition record](update-a-members-medical-condition-record.md)
and [Delete a member's medical condition record](delete-a-members-medical-condition-record.md)
both take that record id.

Reading and writing a member's medical information is restricted: when your token carries a member
id it must match `{memberId}`, or the request is rejected with `403` and `The given member ID of
{memberId} does not belong to the logged in member nor any linked members`. Linked members are
accepted here, so a token for a parent can write against a linked child's record. Tokens with no
member id in them — staff and integration tokens — are not subject to that check and can write
against any member in the tenant.

Treat what you send as special-category personal data. `medicalNote` is stored exactly as you send it
and returned in full to any caller who passes the check above; no redaction, consent flag or
retention period is applied, and the request carries no field
for any of those. Whatever consent and retention policy applies is yours to enforce before you
call, and via
[Delete a member's medical condition record](delete-a-members-medical-condition-record.md)
afterwards.

## Endpoint

`POST {base_url}/api/members/{memberId}/medical-details`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `memberId` | integer (int32) | Yes | The member the condition is recorded against. The member must already exist or the call returns `404` with an empty body. When your token carries a member id, this value must be that member or one linked to them. |

## Request body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `medicalConditionTypeId` | integer (int32) | Yes | Which condition is being recorded, as an `id` from [Returns all medical condition types](../configuration/returns-all-medical-condition-types.md) — the tenant's own configured list, so the values differ between tenants and you cannot hard-code them. The type must exist, or the call fails with `400` and `Medical condition type does not exist`. It decides the `medicalConditionType` description returned when the record is read back. Required. |
| `medicalNote` | string | No | Free-text detail about the condition — severity, medication, what staff should do — stored verbatim and returned in full by [Retrieve a member's medical information](retrieve-a-members-medical-information.md). There is no maximum length. Omit it to store the condition type with no note; there is no way to record a note without a condition type. |

## Sample request

```bash title="cURL"
curl -X POST '{base_url}/api/members/{memberId}/medical-details' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true' \
  -H 'Content-Type: application/json' \
  -d '{
  "medicalConditionTypeId": 12345,
  "medicalNote": "string"
}'
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | `medicalConditionTypeId` matches no configured medical condition type — `Medical condition type does not exist`. Also returned when the body fails validation, for example when `medicalConditionTypeId` is absent altogether. |
| `404` | Not found | No member has the id in the path. The response body is empty, so a `404` here always means the member, never the condition type — an unknown condition type comes back as `400`. |
| `500` | Internal server error | An unexpected server-side failure. The response has no body. |