This page is part of the FHIRcast (v2.1.0-ballot: STU3 Ballot 1) based on FHIR R4. . For a full list of available versions, see the Directory of published versions

OAuth2 authorization scopes

FHIRcast defines OAuth 2.0 access scopes that correspond directly to FHIRcast events. These scopes associate read or write permissions to an event. Apps that need to receive workflow related events SHOULD ask for read scopes. Apps that request context changes SHOULD ask for write scopes. Hubs may decide what specific interactions and operations will be enabled by these scopes.

Expressed in Extended Backus-Naur Form (EBNF) notation, the FHIRcast syntax for OAuth 2.0 access scopes is:

scope ::= ( 'fhircast' ) '/' ( FHIRcast-event | '*' ) '.' ( 'read' | 'write' | '*' )

Note the FHIRcast event format contains a noun-verb, for example: patient-open. So, a requested scope of fhircast/patient-open.read would authorize the subscribing application to receive a notification when the patient in context changed. Similarly, a scope of fhircast/patient-open.write authorizes the subscribed app to request a context change.