Request SMART App Launch v2 granular scopes using the resource-level .cruds syntax for fine-grained access control

domain: hl7.org · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

In-depth guide

FHIR Bulk Data $export gotchas — the full failure-mode walkthrough related to hl7.org, checked against official docs, with linked verified routes.

Steps

  1. Identify the exact FHIR resource types and operations the app requires and construct granular scope strings using the format [context]/[ResourceType].[cruds] where c=create, r=read, u=update, d=delete, s=search
  2. Include the granular scopes in the scope parameter of the OAuth authorization request alongside openid, fhirUser, launch, or launch/patient as applicable
  3. Initiate the SMART authorization code flow; the authorization server will present the granular scope list to the user for approval
  4. Exchange the authorization code for tokens; inspect the scope field in the token response to confirm which scopes were actually granted — the server may downscope
  5. Use the granted access token to make FHIR API calls; restrict operations to those covered by the granted scopes to avoid authorization errors
  6. If a required scope was not granted, surface a clear error to the user rather than attempting the restricted operation

Known gotchas

Related routes

Use SMART App Launch v2 granular scopes (e.g., patient/Observation.rs, user/MedicationRequest.cruds) to request fine-grained access to specific FHIR resource types and operations
smarthealthit.org · 5 steps · unrated
Implement SMART App Launch v2 token introspection to validate an access token issued by an authorization server and extract the scopes and patient context at a resource server
hl7.org/fhir/smart-app-launch · 5 steps · unrated
Implement SMART App Launch v2 EHR launch flow including fhirContext extraction for multi-resource launch context
hl7.org · 6 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans