Aidbox · OAuth Scopes

Aidbox OAuth Scopes

OAuth 2.0 searched

Aidbox publishes 12 OAuth 2.0 scopes via the authorizationCode, clientCredentials, implicit, and password flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Aidbox API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

HealthcareUnited StatesFHIRHL7InteroperabilitySMART on FHIREHRHealth DataFHIR ServerBulk DataTerminologyDigital Health

Scopes: 12 Flows: authorizationCode, clientCredentials, implicit, password Method: searched

Scopes (12)

Scope	Description	Flows
openid	OpenID Connect authentication; issue an id_token.
profile	Access to the user's basic profile claims.
email	Access to the user's email claim.
groups	Access to the user's group memberships.
fhirUser	Return a fhirUser claim identifying the current user as a FHIR resource.
launch	EHR launch context (requires an EHR launch).
launch/patient	Standalone launch requesting patient context selection.
offline_access	Issue a refresh token for long-lived access (permission-offline).
online_access	Refresh token valid only while the user's session is active.
patient/*.cruds	Patient-compartment access to all resource types (SMART v2 CRUDS = create, read, update, delete, search). Narrowable per resource, e.g. patient/Observation.rs.
user/*.cruds	User-level access to all resource types the user is permitted to see (SMART v2).
system/*.cruds	System/backend-services access to all resource types (SMART Backend Services, v2).

📄 Provider scope reference: https://www.health-samurai.io/docs/aidbox/modules/security-and-access-control/auth/smart-on-fhir

Source

OAuth Scopes

generated: '2026-07-24'
method: searched
source: well-known/aidbox-smart-configuration.json (scopes_supported) + SMART App Launch scope syntax
docs: https://www.health-samurai.io/docs/aidbox/modules/security-and-access-control/auth/smart-on-fhir
schemes:
- name: SMART-on-FHIR / OAuth2
  authorizationUrl: https://sandbox.aidbox.app/auth/authorize
  tokenUrl: https://sandbox.aidbox.app/auth/token
  flows: [authorizationCode, clientCredentials, implicit, password]
scopes:
- scope: openid
  description: OpenID Connect authentication; issue an id_token.
- scope: profile
  description: Access to the user's basic profile claims.
- scope: email
  description: Access to the user's email claim.
- scope: groups
  description: Access to the user's group memberships.
- scope: fhirUser
  description: Return a fhirUser claim identifying the current user as a FHIR resource.
- scope: launch
  description: EHR launch context (requires an EHR launch).
- scope: launch/patient
  description: Standalone launch requesting patient context selection.
- scope: offline_access
  description: Issue a refresh token for long-lived access (permission-offline).
- scope: online_access
  description: Refresh token valid only while the user's session is active.
- scope: patient/*.cruds
  description: >-
    Patient-compartment access to all resource types (SMART v2 CRUDS = create, read,
    update, delete, search). Narrowable per resource, e.g. patient/Observation.rs.
- scope: user/*.cruds
  description: User-level access to all resource types the user is permitted to see (SMART v2).
- scope: system/*.cruds
  description: System/backend-services access to all resource types (SMART Backend Services, v2).
smart_scope_syntax:
  versions: [v1, v2]
  v1_examples: [patient/Observation.read, user/*.read, system/Patient.write]
  v2_actions: c=create, r=read, u=update, d=delete, s=search
  note: >-
    Aidbox supports both SMART v1 (.read/.write/.*) and v2 (.cruds granular) scope syntaxes;
    scopes_supported in the sandbox smart-configuration advertises the wildcard *.cruds forms.