Overview – Authorization & Security Standards
Technical Standards Followed
Supported OAuth Authorization Models
Two-Legged OAuth (Client Credentials Flow)
Designed for backend services that need access without user interaction. Apps use their client credentials to obtain access tokens.
Three-Legged OAuth (Authorization Code Flow)
Used when user login and consent is required. Apps request authorization from the user and exchange the authorization code for an access token.
Scopes & Permissions
context/resource.access
patient
, user
, or system
Condition
) or *
for allread
, write
, or *
for bothExamples
Scope | Description |
---|---|
patient/Condition.read | Read Condition data for the current patient |
system/Observation.read | Read all Observations across patients |
user/. | Read and write all user-authorized resources |
openid fhirUser | Request user identity and profile |
launch | Get context during launch from within the EHR |
launch/patient | Request patient selection during standalone launch |
offline_access | Enables long-lived access via refresh token |
online_access | Refresh tokens valid while the user is online |
Scope Evaluation Logic
1.
2.
3.
Wildcard Scope Expansion
patient/*.read includes:
user/*.read includes:
system/*.read includes:
SMART on FHIR Authorization Workflow
Initiating Authorization
Apps construct a request to Edvak's authorization endpoint with:
response_type
: codeclient_id
: App client IDredirect_uri
: Must match a registered redirect URIscope
: Requested permissions (e.g. openid patient/*.read
)state
: CSRF protection valueaud
: Base URL of the Edvak FHIR APIcode_challenge
& code_challenge_method
: For PKCE (public clients)End-User Authorization
Edvak presents a login and consent screen. Based on the response:If granted: an authorization code is sent to the app’s redirect URI If denied: an error response is returned
Exchanging Authorization Code for Access Token
Apps exchange the code for an access token:
Token Response Includes:
access_token
: Required for accessing APIstoken_type
: Always "Bearer"expires_in
: Token lifetime (in seconds)scope
: Granted scopesrefresh_token
: If offline or online access was requestedid_token
: If OpenID Connect identity was requestedRefreshing an Access Token
Warning: Avoid Reusing Refresh Tokens
POST /token
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token
refresh_token=YOUR_REFRESH_TOKEN
client_id=CLIENT_ID (required for public apps)
client_secret=CLIENT_SECRET (required for confidential apps)
Token Security Requirements
Cache-Control: no-store
Pragma: no-cache
JWKS (Optional Asymmetric Authentication)
[email protected]
Accessing FHIR Resources
GET https://fhir-dev.edvak.com/fhir/Patient/123
Authorization: Bearer <ACCESS_TOKEN>