The Authentication Service authenticates an end user, directly or through a Wallet or upstream identity provider, and supplies an authentication result trusted by the Health Data API Authorization Server. It does not grant API access or issue API access tokens in this role. This IG-defined role is not a formal IHE IUA or SMART actor. It MAY be grouped with the Health Data API Authorization Server in one implementation; the interface between separate implementations is deployment-defined, not an interoperable transaction specified by this IG. No ID token or token exchange is required by the actor split. See authentication and authorization groupings and Authorization.