What the claim screen needs to render itself. PUBLIC and unauthenticated.

An unknown or expired token is a 200 with found: false, never a 404. Exactly the reasoning GET /api/asclepius/hs-referral/{token} states: a 404 makes this a membership oracle, feed it tokens and the status code tells you which ones are live, and on this route a live token additionally names a health system that is talking to us. The page renders its "this link has already been used" state either way, which is what it should do for a stale link regardless of why the link is stale.

Nothing here is new to the holder of the token. Their own address, the organization they are being added to and the first name of the colleague who added them were all in the email the link came in. Built by whitelist, as that endpoint is: no username, no approval status, no password state.