Sun Life · OAuth Scopes

Sun Life OAuth Scopes

OAuth 2.0 searched

Sun Life publishes 5 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Sun Life API on a user’s behalf.

Tokens are issued from https://api.dentaquest.com/FhirPatientAccess/v1/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

InsuranceCanadaLife InsuranceHealth InsuranceEmployee BenefitsGroup BenefitsDental InsuranceDisabilityWealth ManagementFinancial ServicesCarrierFHIRPatient AccessProvider DirectoryHealthcare InteroperabilityCMS-9115-FDentaQuestSMART on FHIRDental Benefits

Scopes: 5 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://api.dentaquest.com/FhirPatientAccess/v1/authorize

Token URL
https://api.dentaquest.com/FhirPatientAccess/v1/token

Flows
authorizationCodeclientCredentials

Scopes (5)

Scope	Description	Flows
patient/*.read	Read access to every FHIR resource in the authorized patient compartment (Patient, Coverage, Organization, Practitioner, RelatedPerson).	authorizationCode
launch/patient	Request the standalone patient launch context so the app is bound to one member.	authorizationCode
offline_access	Issue a refresh token so the app can keep reading after the member leaves the browser.	authorizationCode
openid	OpenID Connect authentication; returns an id_token for the member.	authorizationCode
fhirUser	Return the FHIR resource representing the authenticated user.	authorizationCode

📄 Provider scope reference: https://www.dentaquest.com/en/interoperability-api

Source

OAuth Scopes

generated: '2026-07-25'
method: searched
source: https://api.dentaquest.com/FhirPatientAccess/v1/.well-known/smart-configuration
docs: https://www.dentaquest.com/en/interoperability-api
note: SMART App Launch 1.0.0 scopes published by the DentaQuest FHIR Patient Access API (Sun Life U.S.
  dental).
schemes:
- name: SMART on FHIR
  source: well-known/sun-life-dentaquest-smart-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.dentaquest.com/FhirPatientAccess/v1/authorize
    tokenUrl: https://api.dentaquest.com/FhirPatientAccess/v1/token
  - flow: clientCredentials
    tokenUrl: https://api.dentaquest.com/FhirPatientAccess/v1/token
scopes:
- scope: patient/*.read
  description: Read access to every FHIR resource in the authorized patient compartment (Patient, Coverage,
    Organization, Practitioner, RelatedPerson).
  flows:
  - authorizationCode
  sources:
  - well-known/sun-life-dentaquest-smart-configuration.json
- scope: launch/patient
  description: Request the standalone patient launch context so the app is bound to one member.
  flows:
  - authorizationCode
  sources:
  - well-known/sun-life-dentaquest-smart-configuration.json
- scope: offline_access
  description: Issue a refresh token so the app can keep reading after the member leaves the browser.
  flows:
  - authorizationCode
  sources:
  - well-known/sun-life-dentaquest-smart-configuration.json
- scope: openid
  description: OpenID Connect authentication; returns an id_token for the member.
  flows:
  - authorizationCode
  sources:
  - well-known/sun-life-dentaquest-smart-configuration.json
- scope: fhirUser
  description: Return the FHIR resource representing the authenticated user.
  flows:
  - authorizationCode
  sources:
  - well-known/sun-life-dentaquest-smart-configuration.json
authorization_server_scopes:
  issuer: https://dentaquest-ciam.okta.com/oauth2/ausg07qa99xVdvh4Q4h7
  scopes_supported:
  - interclient_access
  - openid
  - profile
  - email
  - address
  - phone
  - offline_access
  - device_sso
  source: well-known/sun-life-dentaquest-okta-openid-configuration.json
  note: Okta authorization-server scopes; the FHIR-facing scope set published for app developers is the
    SMART list above.
not_offered:
- scope: user/*.read
  note: Not advertised in smart-configuration despite permission-user in capabilities.
- scope: '*.write'
  note: The Patient Access API is read-only; no write scopes are published.