Medplum · OAuth Scopes

Medplum OAuth Scopes

OAuth 2.0 searched

Medplum publishes 12 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Medplum API on a user’s behalf.

Tokens are issued from https://api.medplum.com/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

HealthcareFHIROpen-SourceDeveloper PlatformHIPAASMART on FHIRClinicalInteroperability

Scopes: 12 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://api.medplum.com/oauth2/authorize

Token URL
https://api.medplum.com/oauth2/token

Flows
authorizationCodeclientCredentials

Scopes (12)

Scope	Description	Flows
openid	OpenID Connect base scope; required to obtain an id_token.
profile	Access to the authenticated user's profile claims.
email	Access to the authenticated user's email claim.
phone	Access to the authenticated user's phone claim.
address	Access to the authenticated user's address claim.
patient/*.rs	Read and search any FHIR resource type within the launch-context patient's compartment (SMART v2 fine-grained scope syntax).
user/*.cruds	Create, read, update, delete, and search any FHIR resource type as the authenticated user (SMART v2 fine-grained scope syntax; e.g. user/Encounter.cu grants write-only access to Encounter).
fhirUser	Grants the client the authenticated user's FHIR resource reference (fhirUser claim).
launch	EHR-launch context scope (SMART App Launch, provider/EHR-initiated launch).
launch/patient	Standalone-launch context scope that resolves the launch patient context.
offline_access	Requests a refresh token so the client can obtain new access tokens without re-authentication.
online_access	Requests an access token valid only for the current session (no refresh token).

📄 Provider scope reference: https://www.medplum.com/docs/access/smart-scopes

Source

OAuth Scopes

generated: '2026-08-14'
method: searched
source: probed https://api.medplum.com/.well-known/oauth-authorization-server + https://api.medplum.com/.well-known/openid-configuration
docs: https://www.medplum.com/docs/access/smart-scopes
description: >-
  Medplum's OpenAPI does not declare an oauth2 securityScheme with a scopes map (only http
  basic/bearer + openIdConnect are declared), so no baseline could be mechanically derived by
  derive-oauth-scopes.py (0 providers with oauth2 schemes found). This file is built entirely
  from two live, provider-served surfaces: the RFC 8414 authorization-server metadata document
  (probed) and the SMART Scopes documentation page (searched).
schemes:
  - name: Medplum OAuth2 / OIDC
    source: probed https://api.medplum.com/.well-known/oauth-authorization-server
    issuer: https://api.medplum.com/
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.medplum.com/oauth2/authorize
        tokenUrl: https://api.medplum.com/oauth2/token
        userinfoUrl: https://api.medplum.com/oauth2/userinfo
        introspectionUrl: https://api.medplum.com/oauth2/introspect
        registrationUrl: https://api.medplum.com/oauth2/register
      - flow: clientCredentials
        tokenUrl: https://api.medplum.com/oauth2/token
grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - "urn:ietf:params:oauth:grant-type:token-exchange"
scopes:
  # OIDC scopes advertised live by the authorization-server metadata document.
  - scope: openid
    description: OpenID Connect base scope; required to obtain an id_token.
    sources: [probed oauth-authorization-server]
  - scope: profile
    description: Access to the authenticated user's profile claims.
    sources: [probed oauth-authorization-server]
  - scope: email
    description: Access to the authenticated user's email claim.
    sources: [probed oauth-authorization-server]
  - scope: phone
    description: Access to the authenticated user's phone claim.
    sources: [probed oauth-authorization-server]
  - scope: address
    description: Access to the authenticated user's address claim.
    sources: [probed oauth-authorization-server]
  # SMART App Launch 2.0.0 scopes documented at docs/access/smart-scopes.
  - scope: "patient/*.rs"
    description: >-
      Read and search any FHIR resource type within the launch-context patient's compartment
      (SMART v2 fine-grained scope syntax).
    sources: [docs]
  - scope: "user/*.cruds"
    description: >-
      Create, read, update, delete, and search any FHIR resource type as the authenticated user
      (SMART v2 fine-grained scope syntax; e.g. user/Encounter.cu grants write-only access to
      Encounter).
    sources: [docs]
  - scope: fhirUser
    description: Grants the client the authenticated user's FHIR resource reference (fhirUser claim).
    sources: [docs]
  - scope: launch
    description: EHR-launch context scope (SMART App Launch, provider/EHR-initiated launch).
    sources: [docs]
  - scope: launch/patient
    description: Standalone-launch context scope that resolves the launch patient context.
    sources: [docs]
  - scope: offline_access
    description: Requests a refresh token so the client can obtain new access tokens without re-authentication.
    sources: [docs]
  - scope: online_access
    description: Requests an access token valid only for the current session (no refresh token).
    sources: [docs]
notes: >-
  Medplum documents SMART App Launch 2.0.0 support with the fine-grained (v2) scope syntax
  ("patient/Observation.r", "user/*.cruds", etc.) rather than only the coarse v1 syntax
  ("patient/*.read"). ClientApplication.signInForm.showScopeSelection controls whether the
  end-user sees a scope-consent screen; ONC 170.315(g)(10) requires granular scope selection be
  offered to patient-facing apps.
standard: SMART App Launch 2.0.0