The Health Data API Authorization Server issues access tokens after applying the authentication and authorization requirements of the selected environment and protocol. When user authentication is required, it relies on an acceptable result from the Authentication Service, with which it MAY be grouped. Authentication alone does not establish API access entitlement. Client assertion validation applies only when the selected flow uses asymmetric client authentication. The Authorization Server remains responsibility-distinct from a Resource Server, including when the two are co-located. This generic role does not by itself claim IHE IUA or SMART conformance. The Health Data API qualifier identifies this IG's role, not a central EU-operated service. See the applicable IHE IUA Authorization Server or SMART Authorization Server definition and the relevant Authorization requirements.