Tebra · OAuth Scopes

Tebra OAuth Scopes

OAuth 2.0 derived

Tebra publishes 27 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Tebra API on a user’s behalf.

Tokens are issued from https://fhir.prd.cloud.tebra.com/smartauth/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

HealthcarePractice ManagementEHRMedical BillingPatient EngagementKareoPatientPop

Scopes: 27 Flows: authorizationCode, clientCredentials Method: derived

OAuth endpoints

Authorization URL
https://fhir.prd.cloud.tebra.com/smartauth/oauth/authorize

Token URL
https://fhir.prd.cloud.tebra.com/smartauth/oauth/token

Flows
authorizationCodeclientCredentials

Scopes (27)

Scope	Description	Flows
fhirUser	FHIR user identity claim.	authorizationCode
launch/patient	Identify the launch patient context.	authorizationCode
offline_access	Obtain a refresh token.	authorizationCode
openid	OpenID Connect identity claim.	authorizationCode
patient/AllergyIntolerance.read	Read the patient's allergies/intolerances.	authorizationCode
patient/CarePlan.read	Read the patient's care plans.	authorizationCode
patient/CareTeam.read	Read the patient's care team.	authorizationCode
patient/Condition.read	Read the patient's conditions/problems.	authorizationCode
patient/Device.read	Read the patient's implantable devices.	authorizationCode
patient/DiagnosticReport.read	Read the patient's diagnostic reports.	authorizationCode
patient/DocumentReference.read	Read the patient's documents/clinical notes.	authorizationCode
patient/Encounter.read	Read the patient's encounters.	authorizationCode
patient/Goal.read	Read the patient's goals.	authorizationCode
patient/Immunization.read	Read the patient's immunizations.	authorizationCode
patient/Location.read	Read location resources.	authorizationCode
patient/Medication.read	Read medication resources.	authorizationCode
patient/MedicationRequest.read	Read the patient's medication requests.	authorizationCode
patient/Observation.read	Read the patient's observations (vitals/labs/smoking status).	authorizationCode
patient/Organization.read	Read organization resources.	authorizationCode
patient/Patient.read	Read the patient's demographic record.	authorizationCode
patient/Practitioner.read	Read practitioner resources.	authorizationCode
patient/PractitionerRole.read	Read practitioner-role resources.	authorizationCode
patient/Procedure.read	Read the patient's procedures.	authorizationCode
patient/Provenance.read	Read provenance resources.	authorizationCode
system/DocumentReference.read	Read document reference resources.	clientCredentials
system/Observation.read	Read observation resources.	clientCredentials
system/Patient.read	Read patient demographic records.	clientCredentials

📄 Provider scope reference: https://www.tebra.com/wp-content/uploads/2025/05/Tebra-FHIR-API-User-Guide.pdf

Source

OAuth Scopes

generated: '2026-08-14'
method: derived
source: openapi/tebra-fhir-api-openapi.yml
docs: https://www.tebra.com/wp-content/uploads/2025/05/Tebra-FHIR-API-User-Guide.pdf
docs_note: >-
  The guide's Technical Documentation section requires apps to "enter the SMART
  scopes required for the application" but does not publish an enumerated scope
  catalog, so the scope strings here are derived (standard SMART v1
  `patient|system/<Resource>.read` syntax) from the resource list Tebra's own
  guide documents, not copied verbatim from a scopes reference page.
schemes:
- name: smartOnFhirAuthCode
  source: openapi/tebra-fhir-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://fhir.prd.cloud.tebra.com/smartauth/oauth/authorize
    tokenUrl: https://fhir.prd.cloud.tebra.com/smartauth/oauth/token
  description: SMART on FHIR 3-legged OAuth 2.0 authorization-code flow for user-facing (patient/provider)
    applications. Authorization/token URLs are confirmed verbatim from the Tebra FHIR API User
    Guide. The scope list below is DERIVED, not verbatim - Tebra's guide instructs developers
    to "enter the SMART scopes required" without publishing an enumerated list, so these are
    the standard SMART v1 `patient/<Resource>.read` scope strings applied to the resource set
    Tebra's own guide documents.
- name: smartOnFhirClientCredentials
  source: openapi/tebra-fhir-api-openapi.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://fhir.prd.cloud.tebra.com/smartauth/oauth/token
  description: SMART on FHIR 2-legged OAuth 2.0 client-credentials flow for backend services
    applications (no end-user present). Token endpoint is confirmed verbatim from the Tebra
    FHIR API User Guide; Tebra currently supports only the Client Credentials workflow (not
    JWKS-based backend auth). Scope strings below are DERIVED (`system/<Resource>.read`, standard
    SMART v1 syntax), not verbatim - see note above.
scopes:
- scope: fhirUser
  description: FHIR user identity claim.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: launch/patient
  description: Identify the launch patient context.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: offline_access
  description: Obtain a refresh token.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: openid
  description: OpenID Connect identity claim.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/AllergyIntolerance.read
  description: Read the patient's allergies/intolerances.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/CarePlan.read
  description: Read the patient's care plans.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/CareTeam.read
  description: Read the patient's care team.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Condition.read
  description: Read the patient's conditions/problems.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Device.read
  description: Read the patient's implantable devices.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/DiagnosticReport.read
  description: Read the patient's diagnostic reports.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/DocumentReference.read
  description: Read the patient's documents/clinical notes.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Encounter.read
  description: Read the patient's encounters.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Goal.read
  description: Read the patient's goals.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Immunization.read
  description: Read the patient's immunizations.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Location.read
  description: Read location resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Medication.read
  description: Read medication resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/MedicationRequest.read
  description: Read the patient's medication requests.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Observation.read
  description: Read the patient's observations (vitals/labs/smoking status).
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Organization.read
  description: Read organization resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Patient.read
  description: Read the patient's demographic record.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Practitioner.read
  description: Read practitioner resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/PractitionerRole.read
  description: Read practitioner-role resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Procedure.read
  description: Read the patient's procedures.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: patient/Provenance.read
  description: Read provenance resources.
  flows:
  - authorizationCode
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: system/DocumentReference.read
  description: Read document reference resources.
  flows:
  - clientCredentials
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: system/Observation.read
  description: Read observation resources.
  flows:
  - clientCredentials
  sources:
  - openapi/tebra-fhir-api-openapi.yml
- scope: system/Patient.read
  description: Read patient demographic records.
  flows:
  - clientCredentials
  sources:
  - openapi/tebra-fhir-api-openapi.yml

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/tebra-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.