The formal definition of the SMART launch conformance as a FHIR logical model.

CONDITIONAL, String conveying this system’s OpenID Connect Issuer URL. Required if the server’s capabilities include sso-openid-connect; otherwise, omitted.

CONDITIONAL, String conveying this system’s JSON Web Key Set URL. Required if the server’s capabilities include sso-openid-connect; otherwise, optional.

REQUIRED, URL to the OAuth2 authorization endpoint. Required if server supports the launch-ehr or launch-standalone capability; otherwise, optional.

OPTIONAL, Array of grant types supported at the token endpoint. The options are “authorization_code” (when SMART App Launch is supported) and “client_credentials” (when SMART Backend Services is supported).

OPTIONAL, URL to the OAuth2 token endpoint.

array of client authentication methods supported by the token endpoint. The options are “client_secret_post”, “client_secret_basic”, and “private_key_jwt”.

OPTIONAL, If available, URL to the OAuth2 dynamic registration endpoint for this FHIR server.

OPTIONAL, DEPRECATED, URL to the EHR’s app state endpoint. Deprecated; use associated_endpoints with the smart-app-state capability instead.

RECOMMENDED, URL for a Brand Bundle. See User Access Brands.

RECOMMENDED, Identifier for the primary entry in a Brand Bundle. See User Access Brands.

RECOMMENDED, Array of scopes a client may request. See scopes and launch context. The server SHALL support all scopes listed here; additional scopes MAY be supported (so clients should not consider this an exhaustive list).

RECOMMENDED, Array of OAuth2 response_type values that are supported. Implementers can refer to response_types defined in OAuth 2.0 (RFC 6749) and in OIDC Core.

RECOMMENDED, URL where an end-user can view which applications currently have access to data and can make adjustments to these access rights.

RECOMMENDED, URL to a server’s introspection endpoint that can be used to validate a token.

RECOMMENDED, URL to a server’s revoke endpoint that can be used to revoke a token.

REQUIRED, Array of strings representing SMART capabilities (e.g., sso-openid-connect or launch-standalone) that the server supports.

REQUIRED, Array of PKCE code challenge methods supported. The S256 method SHALL be included in this list, and the plain method SHALL NOT be included in this list.

OPTIONAL, Array of objects for endpoints that share the same authorization mechanism as this FHIR endpoint, each with a “url” and “capabilities” array. This property is deemed experimental.

url of the endpoint

List of capabilities of the endpoint.

The formal definition of the SMART launch conformance as a FHIR logical model.

CONDITIONAL, String conveying this system’s OpenID Connect Issuer URL. Required if the server’s capabilities include sso-openid-connect; otherwise, omitted.

CONDITIONAL, String conveying this system’s JSON Web Key Set URL. Required if the server’s capabilities include sso-openid-connect; otherwise, optional.

REQUIRED, URL to the OAuth2 authorization endpoint. Required if server supports the launch-ehr or launch-standalone capability; otherwise, optional.

OPTIONAL, Array of grant types supported at the token endpoint. The options are “authorization_code” (when SMART App Launch is supported) and “client_credentials” (when SMART Backend Services is supported).

OPTIONAL, URL to the OAuth2 token endpoint.

array of client authentication methods supported by the token endpoint. The options are “client_secret_post”, “client_secret_basic”, and “private_key_jwt”.

OPTIONAL, If available, URL to the OAuth2 dynamic registration endpoint for this FHIR server.

OPTIONAL, DEPRECATED, URL to the EHR’s app state endpoint. Deprecated; use associated_endpoints with the smart-app-state capability instead.

RECOMMENDED, URL for a Brand Bundle. See User Access Brands.

RECOMMENDED, Identifier for the primary entry in a Brand Bundle. See User Access Brands.

RECOMMENDED, Array of scopes a client may request. See scopes and launch context. The server SHALL support all scopes listed here; additional scopes MAY be supported (so clients should not consider this an exhaustive list).

RECOMMENDED, Array of OAuth2 response_type values that are supported. Implementers can refer to response_types defined in OAuth 2.0 (RFC 6749) and in OIDC Core.

RECOMMENDED, URL where an end-user can view which applications currently have access to data and can make adjustments to these access rights.

RECOMMENDED, URL to a server’s introspection endpoint that can be used to validate a token.

RECOMMENDED, URL to a server’s revoke endpoint that can be used to revoke a token.

REQUIRED, Array of strings representing SMART capabilities (e.g., sso-openid-connect or launch-standalone) that the server supports.

REQUIRED, Array of PKCE code challenge methods supported. The S256 method SHALL be included in this list, and the plain method SHALL NOT be included in this list.

OPTIONAL, Array of objects for endpoints that share the same authorization mechanism as this FHIR endpoint, each with a “url” and “capabilities” array. This property is deemed experimental.

url of the endpoint

List of capabilities of the endpoint.

The formal definition of the SMART launch conformance as a FHIR logical model.

CONDITIONAL, String conveying this system’s OpenID Connect Issuer URL. Required if the server’s capabilities include sso-openid-connect; otherwise, omitted.

CONDITIONAL, String conveying this system’s JSON Web Key Set URL. Required if the server’s capabilities include sso-openid-connect; otherwise, optional.

REQUIRED, URL to the OAuth2 authorization endpoint. Required if server supports the launch-ehr or launch-standalone capability; otherwise, optional.

OPTIONAL, Array of grant types supported at the token endpoint. The options are “authorization_code” (when SMART App Launch is supported) and “client_credentials” (when SMART Backend Services is supported).

OPTIONAL, URL to the OAuth2 token endpoint.

array of client authentication methods supported by the token endpoint. The options are “client_secret_post”, “client_secret_basic”, and “private_key_jwt”.

OPTIONAL, If available, URL to the OAuth2 dynamic registration endpoint for this FHIR server.

OPTIONAL, DEPRECATED, URL to the EHR’s app state endpoint. Deprecated; use associated_endpoints with the smart-app-state capability instead.

RECOMMENDED, URL for a Brand Bundle. See User Access Brands.

RECOMMENDED, Identifier for the primary entry in a Brand Bundle. See User Access Brands.

RECOMMENDED, Array of scopes a client may request. See scopes and launch context. The server SHALL support all scopes listed here; additional scopes MAY be supported (so clients should not consider this an exhaustive list).

RECOMMENDED, Array of OAuth2 response_type values that are supported. Implementers can refer to response_types defined in OAuth 2.0 (RFC 6749) and in OIDC Core.

RECOMMENDED, URL where an end-user can view which applications currently have access to data and can make adjustments to these access rights.

RECOMMENDED, URL to a server’s introspection endpoint that can be used to validate a token.

RECOMMENDED, URL to a server’s revoke endpoint that can be used to revoke a token.

REQUIRED, Array of strings representing SMART capabilities (e.g., sso-openid-connect or launch-standalone) that the server supports.

REQUIRED, Array of PKCE code challenge methods supported. The S256 method SHALL be included in this list, and the plain method SHALL NOT be included in this list.

OPTIONAL, Array of objects for endpoints that share the same authorization mechanism as this FHIR endpoint, each with a “url” and “capabilities” array. This property is deemed experimental.

url of the endpoint

List of capabilities of the endpoint.