CMS — Centers for Medicare & Medicaid Services Auth API

openapi: 3.2.0
info:
  title: Cms Gov Auth API
  version: '1.0'
  description: 'Operations tagged Auth across 3 of this provider''s published API definitions: cms-auth-api-openapi.yml, cms-gov-blue-button-2-openapi.yml, cms-gov-dpc-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.bluebutton.cms.gov/v2/fhir
  description: Production FHIR R4 endpoint
- url: https://sandbox.bluebutton.cms.gov/v2/fhir
  description: Sandbox FHIR R4 endpoint
- url: https://api.dpc.cms.gov/api/v1
  description: Production
- url: https://sandbox.dpc.cms.gov/api/v1
  description: Sandbox
tags:
- name: Auth
paths:
  /_auth:
    get:
      tags:
      - Auth
      summary: Get details about auth
      description: Returns the auth provider that is currently being used. Note that this endpoint is **not** prefixed with the base path (e.g. /api/v1).
      operationId: getAuthInfo
      responses:
        '200':
          description: JSON object containing an auth_provider field
          content:
            application/json:
              schema:
                required:
                - auth_provider
                type: object
                properties:
                  auth_provider:
                    type: string
                    x-go-name: Version
  /auth/token:
    post:
      tags:
      - Auth
      summary: Get access token
      description: Verifies Basic authentication credentials, and returns a JWT bearer token that can be presented to the other API endpoints.
      operationId: GetAuthToken
      responses:
        '200':
          description: JSON with a valid JWT
          content:
            application/json:
              schema:
                required:
                - access_token
                type: object
                properties:
                  access_token:
                    type: string
                    x-go-name: AccessToken
                  expires_in:
                    type: string
                    x-go-name: ExpiresIn
                  token_type:
                    type: string
                    x-go-name: TokenType
        '400':
          description: Missing credentials
          content: {}
        '401':
          description: Unauthorized. The provided credentials are invalid for the requested resource.
          content: {}
        '500':
          description: Server error
          content: {}
      security:
      - basic_auth: []
  /auth/welcome:
    get:
      tags:
      - Auth
      summary: Test authentication
      description: If a valid token is presented, show a welcome message.
      operationId: welcome
      responses:
        '200':
          description: Welcome message
          content: {}
        '401':
          description: Unauthorized. The provided credentials are invalid for the requested resource.
          content: {}
      security:
      - bearer_token: []
  /userinfo:
    get:
      summary: Get Beneficiary User Info
      operationId: getUserinfo
      description: OpenID Connect userinfo endpoint returning beneficiary identity claims.
      tags:
      - Auth
      responses:
        '200':
          description: User info claims
          content:
            application/json:
              schema:
                type: object
                properties:
                  sub:
                    type: string
                  patient:
                    type: string
                  name:
                    type: string
                  given_name:
                    type: string
                  family_name:
                    type: string
      security:
      - OAuth2:
        - read
    servers:
    - url: https://api.bluebutton.cms.gov/v2/fhir
      description: Production FHIR R4 endpoint
    - url: https://sandbox.bluebutton.cms.gov/v2/fhir
      description: Sandbox FHIR R4 endpoint
  /Token:
    post:
      summary: Create Client Token
      operationId: createToken
      description: Create a long-lived client token for the registered organization.
      tags:
      - Auth
      responses:
        '200':
          description: Token created
      security:
      - BearerAuth: []
    servers:
    - url: https://api.dpc.cms.gov/api/v1
      description: Production
    - url: https://sandbox.dpc.cms.gov/api/v1
      description: Sandbox
components:
  securitySchemes:
    basic_auth:
      type: http
      scheme: basic
    bearer_token:
      type: apiKey
      description: The Group and Patient endpoints require a Bearer Token. 1) Put your credentials in Basic Authentication, 2) Request a bearer token from /auth/token, 3) Put "Bearer {TOKEN}" in this field (no quotes) using the bearer token retrieved in step 2
      name: Authorization
      in: header
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.bluebutton.cms.gov/v2/o/authorize/
          tokenUrl: https://api.bluebutton.cms.gov/v2/o/token/
          scopes:
            patient/Patient.read: Read Patient resource
            patient/Coverage.read: Read Coverage resources
            patient/ExplanationOfBenefit.read: Read ExplanationOfBenefit resources
            profile: OpenID profile claims
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: DPC uses asymmetric SMART Backend Services authentication.
x-refined-from:
- cms-auth-api-openapi.yml
- cms-gov-blue-button-2-openapi.yml
- cms-gov-dpc-openapi.yml