Contact Us

SMART on FHIR

Endpoints

FHIR Servers and associated Authorization Servers expose several endpoints that are used for various purposes.  The following sections describe standard endpoints exposed by Opala’s FHIR servers and Authorization servers for SMART App Launch, OpenID Connect discovery, and FHIR resource access.

Note: In the examples below, replace https://{baseurl} with the target FHIR or Authorization Server’s base URL.

SMART App Launch Configuration Endpoint

Many SMART servers expose a standard OpenID Connect metadata endpoint that shows the SMART App Launch security configuration it supports at the following URL:

https://{baseurl}/.well-known/smart-configuration

This endpoint is not password protected and it will return a response similar to the following: 

{
  “issuer”: “https://{baseurl}”,
  “authorization_endpoint”: “https://{baseurl}/oauth/authorize”,
  “token_endpoint”: “https://{baseurl}/oauth/token”,
  “introspection_endpoint”: “https://{baseurl}/oauth/token/introspect”,
  “response_types_supported”: [ “code”, “token” ]
}


For example, Opala’s SMART App Launch configuration endpoint for Patient Access is:

https://opala.tech/patient-access/premera/v1/fhir-r4/.well-known/smart-configuration

OpenID Connect Discovery Endpoint

Many SMART servers also publish a standard OpenID Connect Discovery document at:

https://{baseurl}/.well-known/openid-configuration

This endpoint contains core OAuth 2.0 and OpenID metadata, such as userinfo_endpoint, jwks_uri, and grant_types_supported.

For example, Opala's Patient Access OpenID connect endpoint is:

https://opala.tech/.well-known/openid-configuration

FHIR CapabilityStatement (Metadata) Endpoint

Many FHIR servers expose a standard FHIR API metadata endpoint that shows the URLs for the various endpoints it supports at the following URL:

https://{baseurl}/metadata

For example, Opala's Patient Access API metadata endpoint is:

https://opala.tech/patient-access/premera/v1/fhir-r4/metadata

For example, Opala's ATR API metadata endpoint is:

https://opala.tech/atr/premera/v1/fhir-r4/metadata

UserInfo Endpoint

The UserInfo endpoint is part of the OpenID Connect specification and can be invoked by a client that has requested the openid and profile scopes to learn more about the authenticated user and associated session.

The URL for the UserInfo endpoint can be found using the server metadata endpoint via the userinfo_endpoint attribute.

Invoking the UserInfo Endpoint

The following example shows a request to the userinfo endpoint:

GET https://{baseurl}/userinfo

Authorization: Bearer {access_token}

The following example shows a corresponding response:

200 OK
Content-Type: application/json

{
    "profile": "https://{baseurl}/RelatedPerson/myusername",
    "sub": "myusername",
    "name": "John Smith",
    "family_name": "John",
    "given_name": "Smith"
}

Accessing FHIR Resources

After a SMART app obtains an access token from the Authorization Server, it can use that token to access authorized FHIR resources.

Example:

GET https://opala.tech/patient-access/premera/v1/fhir-r4/Patient/123
Authorization: Bearer {access_token}
Accept: application/fhir+json

The scopes granted during authorization (for example, patient/*.rs or patient/Observation.rs) determine which resources can be retrieved.

For more information about obtaining and using authorization with SMART on FHIR, see Authorization Flows and the HL7 FHIR documentation on Finding and Retrieving Patient information.