Ambience Healthcare Authentication

generated: '2026-07-31'
method: searched
source: https://auth.ambiencehealthcare.com/.well-known/openid-configuration
docs: https://www.ambiencehealthcare.com/informatics
summary:
  types:
  - openIdConnect
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - deviceCode
  - refreshToken
  - tokenExchange
  - jwtBearer
  - implicit
  - password
  note: 'Derived from the provider''s live OpenID Connect discovery document, not from
    an OpenAPI securitySchemes block — Ambience publishes no public OpenAPI. The Integration
    API itself is described only as "secure authentication and access control"; credentials
    are issued on request.'
schemes:
- name: OpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.ambiencehealthcare.com/.well-known/openid-configuration
  issuer: https://auth.ambiencehealthcare.com/
  sources:
  - well-known/ambience-healthcare-openid-configuration.json
  endpoints:
    authorization: https://auth.ambiencehealthcare.com/authorize
    token: https://auth.ambiencehealthcare.com/oauth/token
    device_authorization: https://auth.ambiencehealthcare.com/oauth/device/code
    userinfo: https://auth.ambiencehealthcare.com/userinfo
    jwks: https://auth.ambiencehealthcare.com/.well-known/jwks.json
    registration: https://auth.ambiencehealthcare.com/oidc/register
    revocation: https://auth.ambiencehealthcare.com/oauth/revoke
    backchannel_authentication: https://auth.ambiencehealthcare.com/bc-authorize
    mfa_challenge: https://auth.ambiencehealthcare.com/mfa/challenge
- name: OAuth2
  type: oauth2
  sources:
  - well-known/ambience-healthcare-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.ambiencehealthcare.com/authorize
    tokenUrl: https://auth.ambiencehealthcare.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://auth.ambiencehealthcare.com/oauth/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.ambiencehealthcare.com/oauth/device/code
    tokenUrl: https://auth.ambiencehealthcare.com/oauth/token
  - flow: implicit
    authorizationUrl: https://auth.ambiencehealthcare.com/authorize
    note: advertised in response_types_supported; not recommended, recorded as observed
  grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
client_authentication:
  methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  signing_algs:
  - RS256
  - RS384
  - PS256
hardening:
  pkce: true
  pkce_methods:
  - S256
  - plain
  dpop: true
  dpop_signing_algs:
  - ES256
  mfa: true
  backchannel_logout: true
  dynamic_client_registration: true
  id_token_signing_algs:
  - HS256
  - RS256
  - PS256
  observations:
  - HS256 is advertised for ID token signing alongside RS256/PS256 — a symmetric option
    that FAPI-grade profiles disallow.
  - The `implicit` response types and the `password` grant remain enabled on the tenant.
  - PKCE advertises `plain` in addition to `S256`.
downstream_auth:
  note: 'Ambience authenticates OUTBOUND into customer EHRs as a client. Per the provider''s
    informatics page it uses SMART on FHIR for Epic (deployed via the Epic Toolbox
    inside Hyperspace and Haiku), the athenahealth Marketplace / MDP programme for
    athenahealth, and FHIR plus REST APIs for Oracle Cerner Millennium.'
  source: https://www.ambiencehealthcare.com/informatics
x-evidence:
  fetched: '2026-07-31'
  url: https://auth.ambiencehealthcare.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=utf-8