EMIS Health · Authentication Profile

Emis Health Authentication

Authentication

EMIS Health secures its APIs with http, oauth2, and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, authorizationCodePKCE, and resourceOwnerPassword flow(s).

HealthcareUnited KingdomEHREMRInteroperabilityHL7FHIRPrimary CareNHSClinical DataElectronic Patient Record
Methods: http, oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode, clientCredentials, authorizationCodePKCE, resourceOwnerPassword API key in:

Security Schemes

bearer http
scheme: bearer
OAuth2CodeEMIS-X-GP-PAPI oauth2
· flows: authorizationCode

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-24'
method: searched
source: openapi/emis-health-partner-api-openapi.json
docs: https://docs.partner.emis-x.uk/auth/
summary:
  types: [http, oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, authorizationCodePKCE, resourceOwnerPassword]
  token_format: JWT bearer
  token_validity: ~1 hour (issuer may change at any time)
  identity_provider: Microsoft Entra External ID / Azure AD B2C (identity.stg.emis-x.uk)
  extra_authorization: >-
    Access tokens carry an "authorizations" JWT claim array of ERN-scoped grants
    (e.g. clinical-cr.read, clinical-cr.write) plus userERN / orgERN / orgName
    identity context, governing EMIS-X clinical record access per partner agreement.
flows_documented:
- flow: client_credentials
  client: Machine-to-machine, confidential client
  user_present: false
  tokens: access
- flow: authorization_code
  client: Web app, confidential client
  user_present: true
  tokens: [id, access, refresh]
- flow: authorization_code_pkce
  client: Mobile / SPA / desktop, public client
  user_present: true
  tokens: [id, access, refresh]
- flow: resource_owner_password
  client: Automated testing only (not for production)
  user_present: false
  tokens: [access, refresh]
schemes:
- name: bearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  applied_to: all 38 partner operations (every operation also accepts OAuth2CodeEMIS-X-GP-PAPI)
  sources: [openapi/emis-health-partner-api-openapi.json]
- name: OAuth2CodeEMIS-X-GP-PAPI
  type: oauth2
  flows:
  - flow: authorizationCode
    scopes: 7
    authorizationUrl: https://identity.stg.emis-x.uk/b205162c-c95a-4639-8076-bb1fcb152d2b/b2c_1a_clientcredentials/oauth2/authorize
    tokenUrl: https://identity.stg.emis-x.uk/b205162c-c95a-4639-8076-bb1fcb152d2b/b2c_1a_clientcredentials/oauth2/token
  sources: [openapi/emis-health-partner-api-openapi.json]
request_context:
  header: applicationId
  required: true
  note: Every partner operation requires an applicationId header identifying the calling partner application.