Scopes
Scopes are the capabilities a token carries. Each resource requires a specific scope; a request without it returns 403. Scopes map 1:1 onto the same capability engine that authorizes every action in MedFlo.
There are 24 scopes across five domains. Most are read scopes (<domain>.read); a small number of ingest / management scopes carry .write or .manage. Request only what your integration needs — the app-registration flow lets you pick the exact set.
Scope catalog
Patient, census & facility structure
| Scope | Grants |
|---|---|
| residents.read | Read resident demographics/identifiers (FHIR Patient). |
| census.read | Read ADT records + bed availability (census). |
| facilities.read | Read facilities, units, floors, rooms, beds. |
| practitioners.read | Read practitioners/providers (FHIR Practitioner). |
| users.read | Read the caller's user info. |
Coverage & clinical
| Scope | Grants |
|---|---|
| coverage.read | Read payer coverage/eligibility (FHIR Coverage). |
| clinical.read | Read clinical resources (conditions, meds, allergies, immunizations, observations). |
| diagnostics.read | Read diagnostic reports / lab & radiology results (FHIR DiagnosticReport). |
| careplans.read | Read care plans, kardexes, focuses (FHIR CarePlan). |
| notes.read | Read progress / encounter notes. |
| assessments.read | Read assessments, templates, and HIPPS codes. |
| adl.read | Read activities-of-daily-living + ADL score. |
| therapy.read | Read therapy tracks/minutes. |
| nutrition.read | Read nutrition and supplement orders. |
| consents.read | Read advance-directive and privacy consents. |
| contacts.read | Read patient contacts. |
| incidents.read | Read incidents. |
| calendar.read | Read calendar events and occurrences. |
| episodes.read | Read care periods / episodes of care. |
Financial
| Scope | Grants |
|---|---|
| financial.read | Read daily balance, statements, journal-entries summary. |
| charges.write | Post ancillary charge batches (ingest). |
| payments.write | Post private-cash payment imports (ingest). |
Integration plane
| Scope | Grants |
|---|---|
| webhooks.manage | Create/manage signed event subscriptions. |
| apps.manage | Register/publish apps, grant scopes, toggle org/facility enablement. |
Discover scopes at runtime
curl -s 'https://medflo-pcc-vendor-api-eez5kqwsxa-uw.a.run.app/api/v1/oauth/scopes'Requesting scopes
Pass a space-delimited scope when you request a token. The token is narrowed to the intersection of what you ask for and what your client was granted — never a superset. If you request a scope your client doesn't hold, the token endpoint returns 400 invalid_scope (it fails loudly rather than silently dropping it).
Omit scope entirely to receive all scopes your client holds.
Least privilege
Request only the scopes a given integration needs. A read-only analytics consumer should request residents.read coverage.read and nothing else; an event consumer that manages subscriptions needs webhooks.manage.
Scope ≠ tenancy
residents.read lets you read residents within your own tenant only. Which org and facilities you can reach is a separate check — see Tenancy & scoping.