generated: '2026-08-12'
method: searched
source: openapi/diagnostic-robotics-patient-questionnaire-openapi.yml, openapi/diagnostic-robotics-precision-population-health-openapi.yml,
  openapi/diagnostic-robotics-symptom-search-openapi.yml
docs: https://docs.diagnosticrobotics.com/docs/proactive-patient-risk-feed-api/3y8qknbsqo42r-authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - password
  credentials_issued_by: provider
  self_serve_signup: false
  note: >-
    Credentials are never self-serve. The Patient Questionnaire and Symptom Search services take an x-client API
    key "provided by Diagnostic Robotics"; the Precision Population Health service takes an OAuth 2.0 client_id /
    client_secret pair that Diagnostic Robotics issues per customer, exchanged for a bearer token at
    POST /api/oauth/token on the customer's own subdomain.
schemes:
- name: apikey
  type: apiKey
  in: header
  parameter: x-client
  description: Client API key, provided by Diagnostic Robotics, must be supplied with any request
  sources:
  - openapi/diagnostic-robotics-patient-questionnaire-openapi.yml
  - openapi/diagnostic-robotics-symptom-search-openapi.yml
- name: OAuth2PasswordBearer
  type: oauth2
  flows:
  - flow: password
    tokenUrl: /api/oauth/token
    scopes: 0
  applied_to: 14 of 15 operations in the Precision Population Health spec
  docs_form: >-
    POST https://[CLIENT].precision-population-health.diagnosticrobotics.com/api/oauth/token with
    Content-Type application/x-www-form-urlencoded and body client_id={client_id}&client_secret={client_secret};
    the response TokenResponse is presented as `Authorization: Bearer {token}` on every subsequent call.
  sources:
  - openapi/diagnostic-robotics-precision-population-health-openapi.yml
  - https://docs.diagnosticrobotics.com/docs/proactive-patient-risk-feed-api/3y8qknbsqo42r-authentication
- name: OAuth2AuthorizationCodeBearer
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://digital-outreach.us.auth0.com/authorize?audience=dev-digital-outreach-api-identifier
    tokenUrl: https://digital-outreach.us.auth0.com/oauth/token
    scopes: 0
  applied_to: 1 operation (upload_api_v1_dataset__dataset_type__upload_post)
  sources:
  - openapi/diagnostic-robotics-precision-population-health-openapi.yml
x-findings:
- id: dead-auth0-tenant
  severity: high
  detail: >-
    The published OpenAPI declares an authorizationCode flow against the Auth0 tenant
    digital-outreach.us.auth0.com. That host no longer resolves as an Auth0 tenant - every discovery path
    returns HTTP 404 with the body "Unknown host: digital-outreach.us.auth0.com". The declared audience
    (dev-digital-outreach-api-identifier) is also a development identifier. The scheme as published is not
    usable; the password/client-credentials flow at /api/oauth/token is the live path.
  evidence:
  - url: https://digital-outreach.us.auth0.com/.well-known/openid-configuration
    status: 404
  - url: https://digital-outreach.us.auth0.com/.well-known/oauth-authorization-server
    status: 404
  checked: '2026-08-12'
- id: no-oauth-discovery
  severity: medium
  detail: >-
    No RFC 8414 / OIDC discovery document is served on any Diagnostic Robotics host. The token endpoint is
    documented only in prose and in the OpenAPI, and tokenUrl is recorded as a relative path (/api/oauth/token)
    rather than an absolute URL.
  evidence:
  - url: https://sandbox.precision-population-health.diagnosticrobotics.com/.well-known/oauth-authorization-server
    status: 200
    note: HTTP 200 but the body is the React SPA index.html, not a discovery document
  checked: '2026-08-12'
x-evidence:
- url: https://sandbox.precision-population-health.diagnosticrobotics.com/api/v2/RiskList
  status: 401
  body: '{"detail":"Not authenticated"}'
- url: https://sandbox.precision-population-health.diagnosticrobotics.com/api/oauth/token
  status: 405
  note: GET rejected; endpoint is POST-only, confirming the documented token endpoint is live