Temple Health · OAuth Scopes

Temple Health OAuth Scopes

OAuth 2.0 probed

Temple Health publishes 15 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Temple Health API on a user’s behalf.

Tokens are issued from https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Academic Medical CenterCMS InteroperabilityCures ActDSTU2EpicFHIRFox Chase Cancer CenterHL7HealthcareHospital SystemMyChartAuthenticationPatient AccessPrice TransparencyR4SMART on FHIRTemple UniversityUS CoreUSCDI

Scopes: 15 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize

Token URL
https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token

Flows
authorizationCode

Scopes (15)

Scope	Description	Flows
epic.scanning.dmsusername	Epic vendor-specific scope for document-management scanning user context. Epic-proprietary, not part of SMART App Launch.	authorizationCode
fhirUser	Identity of the user launching the app	authorizationCode
launch	EHR launch context for provider-launched apps	authorizationCode
offline_access	Refresh token for long-lived access	authorizationCode
openid	OpenID Connect authentication	authorizationCode
patient/AllergyIntolerance.read	Read the launching patient's allergies	authorizationCode
patient/Condition.read	Read the launching patient's conditions	authorizationCode
patient/DocumentReference.read	Read the launching patient's documents	authorizationCode
patient/Encounter.read	Read the launching patient's encounters	authorizationCode
patient/MedicationRequest.read	Read the launching patient's medication requests	authorizationCode
patient/Observation.read	Read the launching patient's observations	authorizationCode
patient/Patient.read	Read the launching patient's demographics	authorizationCode
profile	OpenID Connect profile claim for the launching user	authorizationCode
system/Patient.read	System-level Patient read (Bulk Data)	authorizationCode
user/Patient.read	Read Patient as the launching user	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-15'
method: probed
source: Live GET https://epicaccess.templehealth.org/FhirProxyPrd/api/FHIR/R4/.well-known/smart-configuration
  and .../FhirProxyPrd/oauth2/.well-known/openid-configuration (both HTTP 200, 2026-08-15), reconciled
  against the oauth2 securitySchemes in openapi/*.yml.
docs: null
discovery:
  smart_configuration: https://epicaccess.templehealth.org/FhirProxyPrd/api/FHIR/R4/.well-known/smart-configuration
  openid_configuration: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/.well-known/openid-configuration
  issuer: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2
  authorization_endpoint: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
  token_endpoint: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  grant_types_supported:
  - authorization_code
  - refresh_token
  - client_credentials
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - urn:ietf:params:oauth:grant-type:token-exchange
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - client_secret_basic
  - private_key_jwt
  code_challenge_methods_supported:
  - S256
  smart_capabilities:
  - launch-ehr
  - launch-standalone
  - client-public
  - client-confidential-symmetric
  - client-confidential-asymmetric
  - context-banner
  - context-style
  - context-ehr-patient
  - context-ehr-encounter
  - context-standalone-patient
  - permission-offline
  - permission-patient
  - permission-user
  - permission-v1
  - permission-v2
  - sso-openid-connect
  - authorize-post
server_declared_scopes_supported:
- epic.scanning.dmsusername
- fhirUser
- launch
- openid
- profile
discrepancy: 'IMPORTANT: the server''s own scopes_supported list contains only five values and does NOT
  enumerate any patient/*, user/* or system/* clinical scope — even though it declares the permission-patient,
  permission-user, permission-offline, permission-v1 and permission-v2 SMART capabilities, which mean
  those scope families ARE grantable. scopes_supported on this endpoint is therefore incomplete as a machine-readable
  grant list: a client that trusted it would conclude no clinical data is reachable. The clinical scopes
  below come from the OpenAPI security requirements and the SMART App Launch scope syntax the declared
  capabilities commit to.'
schemes:
- name: smartOnFhir
  source: openapi/temple-health-allergy-intolerance-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-bulk-data-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-condition-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-document-reference-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-encounter-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-medication-request-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-metadata-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-observation-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
- name: smartOnFhir
  source: openapi/temple-health-patient-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/authorize
    tokenUrl: https://epicaccess.templehealth.org/FhirProxyPrd/oauth2/token
  description: SMART on FHIR / OAuth 2.0 with PKCE for patient-facing and provider-facing app launches.
scope_count: 15
scopes:
- scope: epic.scanning.dmsusername
  description: Epic vendor-specific scope for document-management scanning user context. Epic-proprietary,
    not part of SMART App Launch.
  flows:
  - authorizationCode
  sources:
  - well-known/temple-health-smart-configuration.json
  method: probed
  vendor_specific: true
- scope: fhirUser
  description: Identity of the user launching the app
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: launch
  description: EHR launch context for provider-launched apps
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: offline_access
  description: Refresh token for long-lived access
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: openid
  description: OpenID Connect authentication
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/AllergyIntolerance.read
  description: Read the launching patient's allergies
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/Condition.read
  description: Read the launching patient's conditions
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/DocumentReference.read
  description: Read the launching patient's documents
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/Encounter.read
  description: Read the launching patient's encounters
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/MedicationRequest.read
  description: Read the launching patient's medication requests
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/Observation.read
  description: Read the launching patient's observations
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: patient/Patient.read
  description: Read the launching patient's demographics
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: profile
  description: OpenID Connect profile claim for the launching user
  flows:
  - authorizationCode
  sources:
  - well-known/temple-health-smart-configuration.json
  method: probed
- scope: system/Patient.read
  description: System-level Patient read (Bulk Data)
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
- scope: user/Patient.read
  description: Read Patient as the launching user
  flows:
  - authorizationCode
  sources:
  - openapi/temple-health-allergy-intolerance-api-openapi.yml
  - openapi/temple-health-bulk-data-api-openapi.yml
  - openapi/temple-health-condition-api-openapi.yml
  - openapi/temple-health-document-reference-api-openapi.yml
  - openapi/temple-health-encounter-api-openapi.yml
  - openapi/temple-health-medication-request-api-openapi.yml
  - openapi/temple-health-metadata-api-openapi.yml
  - openapi/temple-health-observation-api-openapi.yml
  - openapi/temple-health-patient-api-openapi.yml
  method: derived
notes:
- 'Scope syntax is SMART App Launch: <context>/<Resource>.<permission>. permission-v1 (.read/.write) and
  permission-v2 (.rs/.cruds) are BOTH declared, so either syntax is accepted.'
- offline_access is declared via the permission-offline capability and is required for refresh tokens.
- system/* scopes apply only to the SMART Backend Services path (client_credentials + private_key_jwt)
  used for Bulk Data, not to patient-facing apps.
- No published scope reference page exists. Temple Health documents no scopes; Epic documents the scope
  model generally at https://fhir.epic.com/Documentation. The endpoint itself is the only Temple-specific
  source.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/temple-health-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.