Authorization

Nable APIs are authenticated using OAuth 2, an open authorization protocol that grants third party applications limited access to users' account. The authentication and authorization are facilitated only between the end-user and the Nable HTTPS service. OAuth 2 provides dependable security for your application data that can be accessed via web and mobile devices.

You can obtain an OAuth token by following the steps below:

  1. Registering a client

  2. Getting Authorization Grant

  3. Getting Access Token

Registering a client

SMART client can be registered at. For example https://${Server_Name}/api/fhir_resgistration.php

You can regiseter the app by posting your client name , redirect uri for your client and weather the client will be confidential or public.

There is additional parameter for confidential clients based on their launch. If the clinet wants an EHR launch or App standalone launch.

If the registeration is completed successfully a client_id will be generated. There will also be a client secret generated if the client is confidential.

Getting Authorization Grant

To get authorization grant from users, make a GET request to the authorization URL with associated parameters.

params:

There will be an additional parameter for EHR launch with launch and for standalone app the additional parameter would be aud

Getting Access Token

After getting an authorization grant, POST the code to the access token endpoint to get the access token and the refresh token.

params:

Regenrating the access token with refresh token

Once the access token expires, it can be regenerated using the refresh token by making a POST call to the access token endpoint with following parameters.

params:

Revoking a token

You can visit token revocation endpoint to revoke a token.

Token Introspection token

You can visit token introspection endpoint to check if the token is valid or invalid.

Scopes

The list of supported scopes are given below:

  • patient/encounter.read
  • patient/patient.read