Skip to content

Quickstart

Make your first call in two steps — get a token, then read a resource. You use your own issued credentials, which are granted after a short admin review.

You need your own credentials

There are no shared or public credentials. Request access, and once an admin approves your request we'll issue your own private, scoped client_id and a one-time client_secret. The examples below use MEDFLO_CLIENT_ID / MEDFLO_CLIENT_SECRET placeholders — plug in the values issued to you.

Step 1 — Get a token

Exchange the credentials for a short-lived bearer token at the token endpoint. Send it as application/x-www-form-urlencoded with grant_type=client_credentials. The token is valid for one hour.

# Exchange YOUR issued client credentials for a short-lived bearer token.
# Set these from the credentials issued to you after your access request is approved.
CLIENT_ID="your-client-id"
CLIENT_SECRET="your-client-secret"

curl -s -X POST 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  --data-urlencode 'scope=residents.read coverage.read clinical.read'

# → { "access_token": "eyJ...", "token_type": "Bearer",
#     "expires_in": 3600, "scope": "residents.read coverage.read clinical.read" }

The response follows RFC 6749:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "residents.read coverage.read clinical.read"
}

Step 2 — Call a resource

Send the token in the Authorization header to a tenant-scoped resource path. Here we list residents (FHIR Patient) for the sandbox tenant.

# Call a resource with the bearer token from the token step.
TOKEN="eyJ..."   # the access_token from /oauth/token

curl -s 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/ofctx/sandbox-org-0001/sandbox-fac-0001/residents?page_size=5' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Accept: application/json'

# → { "data": [ { "resourceType": "Patient", ... } ],
#     "meta": { "page": { "page": 1, "page_size": 5, "total": ... } },
#     "error": null }

Scopes and tenancy

A token only carries the scopes it was granted, and it can only reach the org / facility bound to its credentials. Requesting an out-of-scope scope, org, or facility returns 403. Read more in Scopes and Tenancy.

Next steps