72.7.1Authenticate and Authorize Provider System

Before calling $davinci-data-export, the provider system must authenticate and obtain an access token using SMART on FHIR and OAuth 2.0. This ensures secure, System-to-System communication with Smile CDR and enforces access control based on Group membership and consent.

72.7.1.1Authenticate and Authorize Workflow

1. Provider System Requests Token
   • The provider system sends a request to the Identity Provider (IdP) with its client credentials.
   • Note: The IdP may be Smile (Pattern 1) or an external IdP (Pattern 2).
2. IdP Issues Access Token
   • The IdP validates credentials and issues a JWT access token containing the necessary scopes (e.g., patient/*.read).
3. Provider System Calls FHIR Server
   • The access token is included in the Authorization header when calling $davinci-data-export.
4. FHIR Server Validates Token
   • The FHIR server validates the token against the IdP configuration and confirms Group membership.
   • Consent preferences are enforced, ensuring opted-out members are excluded.
5. Access Granted or Denied
   • Data is returned only for members the provider system is authorized to access.