This page is part of the FHIRcast (v3.0.0-ballot: STU3 (v3.0.0) Ballot 1) based on FHIR (HL7® FHIR® Standard) R4. The current version which supersedes this version is 2.0.0. For a full list of available versions, see the Directory of published versions

OAuth 2.0 Authorization Scopes

FHIRcast defines OAuth 2.0 access scopes that correspond directly to FHIRcast events. These scopes associate read or write permissions to an event. Applications that need to receive workflow related events SHOULD ask for read scopes. Applications that request context changes SHOULD ask for write scopes.

Expressed in Extended Backus-Naur Form (EBNF) notation, the FHIRcast syntax for OAuth 2.0 access scopes is:

FhircastScopes ::= fhircast  '/' ( FHIRcast-event-name | '*' ) '.' ( 'read' | 'write' | '*' )

Note the FHIRcast event format contains a noun-verb, for example: Patient-open. So, a requested scope of fhircast/Patient-open.read would authorize the subscribing application to receive a notification when the patient in context changed. Similarly, a scope of fhircast/Patient-open.write authorizes the subscribing application to request a context change.