generated: '2026-07-24'
method: searched
source: >-
  fhir/1uphealth-fhir-r4-capabilitystatement.json (SMART-on-FHIR oauth-uris) +
  https://docs.1up.health/docs/get-started/o-auth
docs: https://docs.1up.health/docs/get-started/o-auth
summary:
  types: [oauth2]
  model: SMART-on-FHIR
  oauth2_flows: [authorizationCode, clientCredentials]
  api_key_in: []
  notes: >-
    All 1up FHIR endpoints are secured with SMART-on-FHIR OAuth 2.0 (declared in the
    live CapabilityStatement restful-security-service = SMART-on-FHIR). System-to-system
    and bulk-data integrations use the OAuth 2.0 client_credentials grant; patient- and
    user-facing apps use the SMART authorization_code (app launch) flow. CMS solution
    products (Provider Access, Payer-to-Payer, Electronic Prior Authorization) are
    fronted by Keycloak realms on the 1up gateway with per-environment token endpoints.
schemes:
  - name: SMARTonFHIR
    type: oauth2
    description: >-
      SMART-on-FHIR OAuth 2.0 as advertised in each CapabilityStatement's
      security.extension oauth-uris block.
    flows:
      - flow: authorizationCode
        authorizationUrl: https://auth.1up.health/oauth2/authorize/system
        tokenUrl: https://auth.1up.health/oauth2/token
        description: SMART app-launch / patient-authorization flow for user-facing apps.
      - flow: clientCredentials
        tokenUrl: https://auth.1up.health/oauth2/token
        description: >-
          System (backend) authorization for server-to-server access and Bulk Data
          ($export) jobs.
    sources:
      - fhir/1uphealth-fhir-r4-capabilitystatement.json
      - fhir/1uphealth-fhir-stu3-capabilitystatement.json
      - fhir/1uphealth-fhir-dstu2-conformance.json
  - name: KeycloakClientCredentials
    type: oauth2
    description: >-
      Product-specific OpenID Connect / Keycloak realms fronting the CMS solution APIs
      (Provider Access, Payer-to-Payer, Electronic Prior Authorization). Credentials are
      issued from the 1up Dev Portal (Create a Client).
    flows:
      - flow: clientCredentials
        tokenUrl: https://gateway.1up.health/auth/realms/dev-portal/protocol/openid-connect/token
        description: Provider Access & Payer-to-Payer (dev-portal realm).
      - flow: clientCredentials
        tokenUrl: https://gateway.1upcoreprod.com/auth/realms/epa-prod/protocol/openid-connect/token
        description: Electronic Prior Authorization production realm.
      - flow: clientCredentials
        tokenUrl: https://gateway.1upcoreuat.com/auth/realms/epa-uat/protocol/openid-connect/token
        description: Electronic Prior Authorization UAT/demo realm.
    sources:
      - https://docs.1up.health/docs/get-started/o-auth