generated: '2026-09-07' method: probed source: https://partners.centene.com/.well-known/openid-configuration docs: https://partners.centene.com/apiDetail/2718669d-6e2e-42b5-8c90-0a82f13a30ba provider: Centene providerId: centene note: >- Read from Centene's own OpenID Provider Metadata document, served anonymously at partners.centene.com/.well-known/openid-configuration and again from the issuer https://sso.entrykeyid.com. This supersedes the single `resource.READ` scope derivable from the two Provider RTR OpenAPI oauth2 blocks - the discovery document publishes 74 scopes, including the complete SMART on FHIR v2 patient-compartment read family the CMS Patient Access API actually uses. Centene's Patient Access getting-started guide confirms the member authorization flow requests `patient/*.read` and `openid`, and returns a token whose granted scope string is `Patient/*.read launch/patient offline_access`. authorization_server: issuer: https://sso.entrykeyid.com authorization_endpoint: https://sso.entrykeyid.com/as/authorization.oauth2 token_endpoint: https://sso.entrykeyid.com/as/token.oauth2 jwks_uri: https://sso.entrykeyid.com/pf/JWKS userinfo_endpoint: https://sso.entrykeyid.com/idp/userinfo.openid introspection_endpoint: https://sso.entrykeyid.com/as/introspect.oauth2 revocation_endpoint: https://sso.entrykeyid.com/as/revoke_token.oauth2 registration_endpoint: https://sso.entrykeyid.com/as/clients.oauth2 sandbox_issuer: https://sandbox.entrykeyid.com pkce: [S256, plain] software: Ping Identity PingFederate grant_types_supported: - "implicit" - "authorization_code" - "refresh_token" - "password" - "client_credentials" - "urn:pingidentity.com:oauth2:grant_type:validate_bearer" - "urn:ietf:params:oauth:grant-type:jwt-bearer" - "urn:ietf:params:oauth:grant-type:saml2-bearer" - "urn:ietf:params:oauth:grant-type:device_code" - "urn:ietf:params:oauth:grant-type:token-exchange" - "urn:openid:params:grant-type:ciba" scope_count: 74 smart_on_fhir: implementation_guide: HL7 SMART App Launch Framework 2.0.0 launch_modes_supported: [standalone] launch_modes_not_supported: [ehr-launch] note: >- Centene's own getting-started guide states the API implements the SMART standalone launch flow only, and explicitly does not implement SMART EHR Launch. scopes: - scope: "patient/*.read" description: "SMART on FHIR - read every FHIR resource in the authorizing patient compartment." - scope: "patient/AllergyIntolerance.read" description: "SMART on FHIR - read AllergyIntolerance resources in the authorizing patient compartment." - scope: "patient/CarePlan.read" description: "SMART on FHIR - read CarePlan resources in the authorizing patient compartment." - scope: "patient/CareTeam.read" description: "SMART on FHIR - read CareTeam resources in the authorizing patient compartment." - scope: "patient/Coverage.read" description: "SMART on FHIR - read Coverage resources in the authorizing patient compartment." - scope: "patient/DiagnosticReport.read" description: "SMART on FHIR - read DiagnosticReport resources in the authorizing patient compartment." - scope: "patient/Encounter.read" description: "SMART on FHIR - read Encounter resources in the authorizing patient compartment." - scope: "patient/ExplanationOfBenefit.read" description: "SMART on FHIR - read ExplanationOfBenefit resources in the authorizing patient compartment." - scope: "patient/Gaps.read" description: "SMART on FHIR - read Gaps resources in the authorizing patient compartment." - scope: "patient/Goal.read" description: "SMART on FHIR - read Goal resources in the authorizing patient compartment." - scope: "patient/Immunization.read" description: "SMART on FHIR - read Immunization resources in the authorizing patient compartment." - scope: "patient/Location.read" description: "SMART on FHIR - read Location resources in the authorizing patient compartment." - scope: "patient/Medication.read" description: "SMART on FHIR - read Medication resources in the authorizing patient compartment." - scope: "patient/MedicationRequest.read" description: "SMART on FHIR - read MedicationRequest resources in the authorizing patient compartment." - scope: "patient/Observation.read" description: "SMART on FHIR - read Observation resources in the authorizing patient compartment." - scope: "patient/Organization.read" description: "SMART on FHIR - read Organization resources in the authorizing patient compartment." - scope: "patient/Patient.read" description: "SMART on FHIR - read Patient resources in the authorizing patient compartment." - scope: "patient/Practitioner.read" description: "SMART on FHIR - read Practitioner resources in the authorizing patient compartment." - scope: "patient/Procedure.read" description: "SMART on FHIR - read Procedure resources in the authorizing patient compartment." - scope: "patient/Provenance.read" description: "SMART on FHIR - read Provenance resources in the authorizing patient compartment." platform_scopes: note: >- The remaining scopes in scopes_supported belong to the shared EntryKey ID tenant - identity administration, profile claims, event and data-platform scopes. They are published by the same authorization server but are not part of the public interoperability API surface. Recorded as fetched; descriptions are not published by Centene. scopes: - scope: "FName" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "Idaas" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "LName" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "LastLoginTime" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "MDM_UMPI.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "PCSentitlements" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "PingUUID" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "address" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "cn" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "email" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "guid" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "hniAliasName" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "hniIsDisabled" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "hniUserType" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "hniuid" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Accounts.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Clients.create" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Clients.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Clients.edit" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Clients.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Clients.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.create" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.edit" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.proof" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Identities.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Profiles.create" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Profiles.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Profiles.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Profiles.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "idaas/Registration.create" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "memberOf" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "name" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "openid" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "pcs/entitlements.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "pcs/entitlements.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "phone" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "prisma-microseg" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "prisma-microseg/Ruleset.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "prisma-microseg/Ruleset.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "prisma-microseg/Ruleset.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "profile" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "resource.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "resource.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "service" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "sn" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "snowflake/Data.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "user_type" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "web/member/delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "xp/Events.create" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "xp/Events.delete" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "xp/Events.read" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." - scope: "xp/Events.write" description: "Published in scopes_supported by the Centene EntryKey ID OpenID provider; description not published." per_api_scopes: note: >- The partner portal's own API catalogue records the scopes and grant types each published API requires. Read anonymously from external-api.my.centene.com/partner-portal/apis. entries: - api: FHIR - Patient Access grant_types: ['Authorization Code (Resource Server)'] scopes: ['patient/*.read', openid] audience: patientaccess - api: FHIR - Provider Directory grant_types: [] scopes: [] authentication: none note: Public and unauthenticated. No scope surface. - api: Provider RTR - FHIR PDEX Directory API (External) grant_types: ['Client Credentials (Service Account)'] scopes: [resource.read, openid] audience: prtrdemographic - api: Provider RTR - Demographics API grant_types: ['Client Credentials (Service Account)'] scopes: [resource.read] audience: prtrdemographic - api: Provider Carrier Entity Search (PCES) API grant_types: ['Client Credentials (Service Account)'] scopes: [openid, resource.read] audience: ewsext - api: Product Mapping V2 grant_types: ['Authorization Code (Resource Server)', 'Authorization Code + PKCE (SPA)', 'Client Credentials (Service Account)'] scopes: [openid] audience: ewsext - api: LWC EDI CORE REAL TIME SERVICE grant_types: ['Client Credentials (Service Account)'] scopes: [resource.read, profile, openid] audience: edicorertservice derived_from_spec: note: >- Retained from the OpenAPI derivation for traceability. Both Provider RTR specs declare a single clientCredentials flow with one scope. token_url: https://stage.entrykeyid.com/as/token.oauth2 scopes: - scope: resource.READ description: read access sources: - openapi/centene-provider-rtr-demographics-openapi.json - openapi/centene-provider-rtr-fhir-pdex-openapi.json maintainers: - FN: Kin Lane email: kin@apievangelist.com