Flexpa · OAuth Scopes

Flexpa OAuth Scopes

OAuth 2.0 searched

Flexpa uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://api.flexpa.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

HealthcareFHIRPatient AccessClaims DataHealth Insurance
Scopes: 0 Flows: authorizationCode, clientCredentials, refreshToken Method: searched

OAuth endpoints

Authorization URL
https://api.flexpa.com/oauth/authorize
Token URL
https://api.flexpa.com/oauth/token
Flows
authorizationCodeclientCredentialsrefreshToken

Scopes (0)

Flexpa implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://www.flexpa.com/docs/consent

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-14'
method: searched
source: https://api.flexpa.com/.well-known/oauth-authorization-server
docs: https://www.flexpa.com/docs/consent
provider: Flexpa
providerId: flexpa
summary: >-
  Flexpa's OAuth scope surface is SMART on FHIR's, not a bespoke permission
  taxonomy: exactly two scopes are advertised by the authorization server, and
  both were read from live discovery documents rather than inferred. The captured
  OpenAPI declares only a bearer scheme, so this artifact is the only place the
  scope contract is recorded.
schemes:
- name: OAuth 2.0 / SMART on FHIR
  source: https://api.flexpa.com/.well-known/oauth-authorization-server
  issuer: https://api.flexpa.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.flexpa.com/oauth/authorize
    tokenUrl: https://api.flexpa.com/oauth/token
    pkce: S256
    note: Produces a Patient Access Token via the Flexpa Consent experience.
  - flow: clientCredentials
    tokenUrl: https://api.flexpa.com/oauth/token
    note: >-
      Produces an Application Access Token (server-to-server), authenticated with
      HTTP Basic using publishable key as username and secret key as password.
  - flow: refreshToken
    tokenUrl: https://api.flexpa.com/oauth/token
  registration_endpoint: https://api.flexpa.com/oauth/register
  jwks_uri: https://api.flexpa.com/.well-known/jwks.json
  token_endpoint_auth_methods:
  - client_secret_basic
  - none
scopes:
- name: launch/patient
  description: >-
    SMART on FHIR standalone patient launch context. Required on every
    authorization URL; grants read access to the authorizing patient's compartment
    (Patient, Coverage, ExplanationOfBenefit and the clinical resources Flexpa
    derives).
  required: true
  surfaces:
  - https://api.flexpa.com/fhir
  - https://api.flexpa.com/mcp
- name: offline_access
  description: >-
    Issues a refresh token so the application can continue retrieving the
    patient's data after the initial access token expires. Corresponds to the
    permission-offline SMART capability.
  required: false
  surfaces:
  - https://api.flexpa.com/fhir
  - https://api.flexpa.com/mcp
smart_capabilities:
- launch-standalone
- client-public
- client-confidential-symmetric
- context-standalone-patient
- permission-offline
- permission-patient
notes: >-
  Scope granularity is patient-compartment-wide; there is no per-resource scope
  (no patient/ExplanationOfBenefit.read style scopes) and no scope that
  distinguishes claims from clinical data. The MCP server at
  https://api.flexpa.com/mcp is protected by the same two scopes, per
  /.well-known/oauth-protected-resource.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/flexpa-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.