API Reference

Provider Access API

Base URL: https://cms-api.wasatch.org/provider/fhir/r4

Authorization

The Provider Access API does not proxy authorization the way the Patient Access API does. Clients authenticate directly against the Microsoft identity platform using the OAuth 2.0 client credentials grant and present the resulting token as a Bearer token on every request. See Getting Started for the full token request.

Clinical Resources

All endpoints follow the pattern GET https://cms-api.wasatch.org/provider/fhir/r4/{Resource} and require a valid Bearer token carrying system.all.read or the matching system.{Resource}.read role. Results for a specific patient additionally require an active attribution between the requesting provider and that patient, and are rejected if the patient has opted out. See the Roles Reference for the complete role list.

Resource	Returns	Required Role
`GET /Patient`	Demographic and contact information for an attributed patient.	`system.Patient.read`
`GET /Condition`	Active and historical diagnoses and health problems for an attributed patient.	`system.Condition.read`
`GET /Observation`	Laboratory results, vital signs, and social history observations for an attributed patient.	`system.Observation.read`
`GET /DocumentReference`	Clinical notes and document attachments for an attributed patient.	`system.DocumentReference.read`
`GET /DiagnosticReport`	Laboratory and imaging diagnostic reports for an attributed patient.	`system.DiagnosticReport.read`
`GET /Medication`	Medication definitions referenced by MedicationRequest and MedicationDispense resources.	`system.Medication.read`
`GET /MedicationRequest`	Prescriptions and active medication orders for an attributed patient.	`system.MedicationRequest.read`
`GET /MedicationDispense`	Pharmacy dispensing records for an attributed patient's filled prescriptions.	`system.MedicationDispense.read`
`GET /AllergyIntolerance`	Documented allergies, intolerances, and adverse reactions for an attributed patient.	`system.AllergyIntolerance.read`
`GET /Immunization`	Administered vaccine history for an attributed patient.	`system.Immunization.read`
`GET /Procedure`	Surgical procedures and clinical interventions for an attributed patient.	`system.Procedure.read`
`GET /Encounter`	Office visits, inpatient stays, and other care events for an attributed patient.	`system.Encounter.read`
`GET /CarePlan`	Active and completed care plans for an attributed patient.	`system.CarePlan.read`
`GET /CareTeam`	Members of an attributed patient's care team and their roles.	`system.CareTeam.read`
`GET /Goal`	Care goals and achievement status for an attributed patient.	`system.Goal.read`
`GET /Device`	Implanted and patient-used medical devices for an attributed patient.	`system.Device.read`
`GET /Provenance`	Audit trail records for an attributed patient's clinical resources.	`system.Provenance.read`
`GET /RelatedPerson`	Family members and caregivers related to an attributed patient.	`system.RelatedPerson.read`
`GET /ServiceRequest`	Lab, imaging, and referral orders for an attributed patient.	`system.ServiceRequest.read`
`GET /Specimen`	Biological specimen collection details for an attributed patient.	`system.Specimen.read`
`GET /QuestionnaireResponse`	Structured assessment responses for an attributed patient.	`system.QuestionnaireResponse.read`

Claims & Benefits

CMS Data Scope Rules apply to every endpoint in this section — see Data Scope Rules for exactly what is excluded and why.

Resource	Returns	Required Role
`GET /Coverage`	Health insurance coverage details for an attributed patient.	`system.Coverage.read`
`GET /ExplanationOfBenefit`	Adjudicated claims and prior-authorization determinations for an attributed patient, with provider remittance and enrollee cost-sharing redacted.	`system.ExplanationOfBenefit.read`
`GET /Claim`	Prior authorization requests for an attributed patient (drug/pharmacy requests excluded).	`system.Claim.read`
`GET /ClaimResponse`	Prior authorization determinations for an attributed patient (drug/pharmacy requests excluded).	`system.ClaimResponse.read`

Formulary & Reference

Resource	Returns	Required Role
`GET /InsurancePlan`	Formulary and drug plan information for an attributed patient.	`system.InsurancePlan.read`
`GET /MedicationKnowledge`	Formulary drug entries with tier and coverage details.	`system.MedicationKnowledge.read`
`GET /Organization`	Payer and provider organization identities.	`system.Organization.read`
`GET /Practitioner`	Provider identity, NPI, and credential information.	`system.Practitioner.read`
`GET /PractitionerRole`	Provider roles, specialties, and practice location affiliations.	`system.PractitionerRole.read`
`GET /Location`	Practice and facility addresses. Has no patient linkage, so it is not subject to attribution.	`system.Location.read`

Bulk Data Export

For pulling every attributed patient's data in one operation instead of resource-by-resource polling, see Bulk Export.

Error responses are returned as FHIR OperationOutcome resources with HTTP status codes 400, 401, 403, or 404 as appropriate — including a distinct 403 for patients who have opted out of provider data access, versus one for no recorded attribution. All successful responses use Content-Type: application/fhir+json.