openapi: 3.2.0
info:
  title: Fhir Patient Access Authorize API
  description: "**Patient Access API for CMS 9115-F**\n\nTo access the DentaQuest Patient Access API, a third-party application must obtain a valid JWT token by following the SMART on FHIR authorization framework.\n\n**1. Get Your Credentials** To begin, you must request a `client_id` and `client_secret` by completing the request form available at: [Logic Manager Form](https://dentaquest.logicmanager.com/incidents/?t=1241&p=215&k=F0E3BD92F157F9B73EDE82834286E7CEA4044134B39D92AC3EE7E56392194241)\n\n**2. Authorize and Get a Token** With your credentials, you can initiate the authorization flow to obtain member consent and exchange the resulting authorization code for a JWT token.\n\n- **Authorization Endpoint:** `https://api.dentaquest.com/FhirPatientAccess/v1/authorize`\n    \n- **Token Endpoint:** `https://api.dentaquest.com/FhirPatientAccess/v1/token`\n    \n\nFor a detailed guide on this process, refer to the [SMART App Launch Framework](https://hl7.org/fhir/smart-app-launch/1.0.0/).\n\n### **API Standards and Conformance**\n\nThis API conforms to the following standards and implementation specifications:\n\n- **FHIR Version:** `4.0.1` (R4)\n    \n- **Implementation Guide:** `HL7 US Core Implementation Guide 7.0.0-ballot`\n    \n- **Security:** \n    - `SMART Application Launch Framework Implementation Guide Release 1.0.0`\n    - `OpenID Connect Core 1.0`\n    \n\n### **Exception Handling**\n\nThe API uses standard HTTP status codes to indicate the success or failure of a request. In the event of an error (HTTP status codes `4xx` or `5xx`), for example an invalid SMART on FHIR Token (`403 Forbidden`) or a malformed request (`400 Bad Request`). The response body will also contain a FHIR `OperationOutcome` resource. This resource provides detailed, structured information about the error, including severity, error codes, and human-readable diagnostics to assist with troubleshooting.\n\n### **Exception Response**\n| HTTP Status | Response                | Reason                                                                                                                               |\n| ----------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |\n| **400**     | `Bad Request`           | The request could not be understood by the server due to malformed syntax (e.g., an invalid parameter).                              |\n| **401**     | `Unauthorized`          | The request lacks valid authentication credentials. This may occur if the JWT token is missing, expired, or invalid.                 |\n| **403**     | `Forbidden`             | The server understood the request, but refuses to authorize it. This may occur if the member has not granted the application access. |\n| **404**     | `Not Found`             | The requested FHIR resource (e.g., a specific Patient or Coverage record) does not exist.                                            |\n| **500**     | `Internal Server Error` | The server encountered an unexpected condition that prevented it from fulfilling the request.                                        |\n\n"
  version: v1
servers:
- url: https://api.dentaquest.com/FhirPatientAccess/v1
- url: https://api.deltadentalma.com/FhirPatientAccess/v1
tags:
- name: Authorize
paths:
  /authorize:
    get:
      summary: /Authorize
      operationId: authorize
      responses:
        '200':
          description: ''
      tags:
      - Authorize