Frequently Asked Questions
Common questions about connecting to the Patient Access API, Provider Access API, and Provider Directory API.
The Patient Access API is for consumer applications that a patient logs into and authorizes to see their own records (SMART App Launch, authorization code + PKCE).
The Provider Access API is for backend systems acting on behalf of a provider organization — there is no end-user login, and access is granted via OAuth 2.0 client credentials, scoped to patients attributed to that organization's NPI.
The Provider Directory API is public, read-only plan network data — every endpoint is unauthenticated, with no registration or API key required.
The Patient Access API supports the Authorization Code grant
with PKCE (response_type=code) as defined in the
SMART App Launch 2.2.0
specification, plus refresh tokens (offline_access scope) for
long-lived access without re-prompting the patient.
The Provider Access API supports only the client credentials grant. The Implicit grant and Resource Owner Password Credentials grant are not supported by either API.
No. The Provider Directory API is public, read-only plan network data —
every endpoint is unauthenticated, so there's no registration, approval, or
client_id involved. See
Getting Started to make your
first request.
Registration requests are typically reviewed within 3–5 business days. You will receive an email at the address you provided when a decision is made.
Per CMS Interoperability requirements, registrations cannot be denied without a specific documented security justification. If your registration is denied, the email will include the reason.
If you have not heard back after 5 business days, contact us using the details in the next question.
For technical questions or registration support, contact the developer support team:
- Email: api-support@wasatch.org
- Response time: 1–2 business days