HealthEx · OAuth Scopes

HealthEx OAuth Scopes

OAuth 2.0 searched

HealthEx publishes 5 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the HealthEx API on a user’s behalf.

Tokens are issued from https://api.healthex.io/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyHealthcareHealth RecordsFHIRPatient ConsentData SharingInteroperabilityTEFCAMCPAgents

Scopes: 5 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://api.healthex.io/oauth/authorize

Token URL
https://api.healthex.io/oauth/token

Flows
authorizationCode

Scopes (5)

Scope	Description	Flows
patient/*.read	SMART-on-FHIR wildcard read scope granting read access to all FHIR resource types for a patient who has consented to share their record.	authorizationCode
offline_access	Issue a refresh token for long-lived, offline access.	authorizationCode
openid	OpenID Connect authentication.	authorizationCode
profile	Basic profile claims.	authorizationCode
email	Email address claim.	authorizationCode

📄 Provider scope reference: https://docs.healthex.io/authentication

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: https://api.healthex.io/.well-known/oauth-authorization-server
docs: https://docs.healthex.io/authentication
schemes:
  - name: patientOAuth2
    source: https://api.healthex.io/.well-known/oauth-authorization-server
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.healthex.io/oauth/authorize
        tokenUrl: https://api.healthex.io/oauth/token
        pkce: S256
scopes:
  - scope: patient/*.read
    description: >-
      SMART-on-FHIR wildcard read scope granting read access to all FHIR
      resource types for a patient who has consented to share their record.
    flows: [authorizationCode]
    sources: [oauth-authorization-server, oauth-protected-resource]
  - scope: offline_access
    description: Issue a refresh token for long-lived, offline access.
    flows: [authorizationCode]
    sources: [oauth-authorization-server]
  - scope: openid
    description: OpenID Connect authentication.
    flows: [authorizationCode]
    sources: [oauth-authorization-server]
  - scope: profile
    description: Basic profile claims.
    flows: [authorizationCode]
    sources: [oauth-authorization-server]
  - scope: email
    description: Email address claim.
    flows: [authorizationCode]
    sources: [oauth-authorization-server]
notes: >-
  Patient data access is scope-gated via SMART-on-FHIR patient/*.read. The
  organization-level API (JWT from apiKey/apiSecret) is not scoped — HealthEx
  states none of the currently supported organization APIs require additional
  permissions.