Roles Reference
Provider Access API
The Provider Access API authorizes requests using Entra ID App Roles carried in the
client-credentials token's roles claim, rather than SMART-style scopes.
Every approved provider organization is currently granted the wildcard role below.
Wildcard
| Role | Grants |
|---|---|
system.all.read |
Read and search access to every supported resource type, subject to per-request patient attribution checks. This is the role assigned to every approved provider organization. |
Resource-Level Roles
Roles follow the system.{ResourceType}.read convention. These are checked
individually only if a future registration is scoped to specific resource types instead
of the system.all.read wildcard. See the
Provider API Reference
for the endpoint each role gates.
| Role | Resource | Status |
|---|---|---|
system.Patient.read |
Patient — Demographics | Available |
system.Condition.read |
Condition — Diagnoses | Available |
system.Observation.read |
Observation — Labs & Vitals | Available |
system.DocumentReference.read |
DocumentReference — Clinical Notes | Available |
system.DiagnosticReport.read |
DiagnosticReport — Reports | Available |
system.Medication.read |
Medication — Definitions | Available |
system.MedicationRequest.read |
MedicationRequest — Prescriptions | Available |
system.MedicationDispense.read |
MedicationDispense — Fills | Available |
system.AllergyIntolerance.read |
AllergyIntolerance — Allergies | Available |
system.Immunization.read |
Immunization — Vaccines | Available |
system.Procedure.read |
Procedure — Procedures | Available |
system.Encounter.read |
Encounter — Visits | Available |
system.CarePlan.read |
CarePlan — Care Plans | Available |
system.CareTeam.read |
CareTeam — Care Teams | Available |
system.Goal.read |
Goal — Care Goals | Available |
system.Device.read |
Device — Implanted Devices | Available |
system.Provenance.read |
Provenance — Audit Trail | Available |
system.RelatedPerson.read |
RelatedPerson — Family/Caregivers | Available |
system.ServiceRequest.read |
ServiceRequest — Orders & Referrals | Available |
system.Specimen.read |
Specimen — Specimens | Available |
system.QuestionnaireResponse.read |
QuestionnaireResponse — Assessments | Available |
system.Coverage.read |
Coverage — Insurance Coverage | Available |
system.ExplanationOfBenefit.read |
ExplanationOfBenefit — Adjudicated Claims | Available |
system.Claim.read |
Claim — Prior Authorization Requests | Available |
system.ClaimResponse.read |
ClaimResponse — Prior Authorization Determinations | Available |
system.InsurancePlan.read |
InsurancePlan — Formulary Plans | Available |
system.MedicationKnowledge.read |
MedicationKnowledge — Formulary Drugs | Available |
system.Organization.read |
Organization — Payer/Provider Orgs | Available |
system.Practitioner.read |
Practitioner — Providers | Available |
system.PractitionerRole.read |
PractitionerRole — Provider Roles | Available |
system.Location.read |
Location — Facilities | Available |
Attribution: Holding a role — including
system.all.read — is necessary but not sufficient. Every request is also
checked against the provider's recorded patient attributions before data is returned. See
Getting Started for details.