Scope Reference
Complete catalog of OAuth 2.0, SMART on FHIR, and API key scopes — what each grants access to, which products use it, and example endpoints.
40
Total Scopes
10
Categories
12
SMART Scopes
11
Partner Self-Service
Least-privilege principle
Request only the scopes your integration needs. FHIR read scopes do not grant write access. SMART patient scopes are limited to the authorized patient context. Rotate credentials on schedule from My Tokens & Keys.
FHIR Platform
cms.fhir.r4.readRead FHIR R4 resources — Patient, Observation, Condition, Encounter, and related clinical types.
GET /fhir/R4/{ResourceType}GET /fhir/R4/{ResourceType}/{id}cms.fhir.r5.readRead FHIR R5 resources where supported on the gateway.
GET /fhir/R5/{ResourceType}cms.fhir.bundle.pushSubmit FHIR transaction or batch Bundles for ingest and upsert.
POST /fhir/R4cms.fhir.rest.writeCreate, update, and delete individual FHIR resources via REST.
POST /fhir/R4/{ResourceType}PUT /fhir/R4/{ResourceType}/{id}cms.shc.verifyVerify SMART Health Card JWS payloads and immunization credentials.
POST /beacon/shc/verifycms.shl.createGenerate SMART Health Links for credential sharing.
POST /beacon/shl/createcms.shl.resolveResolve SMART Health Links to underlying FHIR payloads.
GET /beacon/shl/{id}SMART on FHIR
patient/Patient.readRead Patient resources in patient-facing SMART apps.
GET /fhir/R4/Patient/{id}patient/Observation.readRead Observation resources (vitals, labs) for the authorized patient.
GET /fhir/R4/Observationpatient/*.readRead all patient-scoped FHIR resource types for the authorized patient context.
user/Patient.readRead Patient resources on behalf of an authenticated clinician user.
user/*.writeWrite FHIR resources on behalf of an authenticated clinician user.
launch/patientSMART EHR launch with patient context.
launch-ehrSMART App Launch from within the EHR workflow.
fhirUserOpenID Connect identity of the FHIR user (Practitioner).
offline_accessRefresh token for long-lived SMART sessions.
Identity & GPID
cms.identity.matchMatch patient demographics against the GPID registry (read-only, no create).
POST /api/identity/matchcms.identity.resolveResolve or create GPID records from verified demographics.
POST /api/identity/resolveidentity.mergeMerge duplicate GPID records (requires approval workflow).
POST /api/identity/mergeidentity.splitSplit an incorrectly merged GPID record.
POST /api/identity/splitPlexus IAM
plexus.gpid.adminAdministrative GPID lifecycle operations via Plexus IAM.
POST /plexus/gpid/*Prime Wearables
prime.ingest.writeIngest wearable vendor telemetry events.
POST /prime/v1/wearables/eventsprime.ingest.readRead ingest status and pipeline health for Prime events.
GET /prime/v1/healthprime.fhir.observation.writeWrite normalized FHIR Observations from wearable data.
prime.fhir.device.writeRegister wearable Device resources linked to patient GPID.
prime.alerts.readRead readiness and biometric alert notifications.
Horizon Analytics
horizon.queryExecute semantic / natural-language queries against the federated data layer.
POST /horizon/v1/query/nlPOST /horizon/v1/query/executehorizon.scoreCompute Horizon risk stratification scores for a GPID.
POST /horizon/v1/horizon-score/computeTEFCA Exchange
tefca.xcpd.readOutbound XCPD patient discovery at external QHIN partners.
POST /tefca/xcpd/searchtefca.xcpd.writeInbound XCPD patient discovery from external QHIN participants.
POST /tefca/xcpd/discovertefca.xca.readOutbound XCA document/resource query at external QHIN partners.
POST /tefca/xca/searchtefca.xca.writeInbound XCA resource query from external QHIN participants.
POST /tefca/xca/queryVelocity RCM
velocity.clearinghouse.eligibilityReal-time 270/271 eligibility checks via Stedi clearinghouse.
POST /velocity/v1/clearinghouse/eligibilityvelocity.clearinghouse.claims.read276/277 claim status inquiries via Stedi.
POST /velocity/v1/clearinghouse/claims/statusvelocity.clearinghouse.claims.write837P professional claim submission via Stedi.
POST /velocity/v1/clearinghouse/claims/submitCMS & Partners
cms.pipeline.readRead partner pipeline health, sync rates, and webhook delivery metrics.
GET /cms/partners/pipelinecms.sdk.readRead SDK catalog metadata and integration documentation.
System & Bulk
system/*.readBackend Services bulk read — required for FHIR $export jobs.
GET /fhir/R4/$exportsystem/Patient.readBackend Services read access to Patient resources for bulk export.
GET /fhir/R4/$export?_type=Patientsystem/*.writeBackend Services write for system-level FHIR Bundle submission.
POST /fhir/R4