Verify Access

Verifying access confirms that the issued OAuth 2.0 access token includes the expected scopes and permissions for your intended API workflows. This step helps ensure that your system can read, write, or subscribe to the appropriate Fast Healthcare Interoperability Resources (FHIR) data before moving on to broader testing.

Review Token Scopes

OAuth 2.0 scopes associated with an access token define which API capabilities and FHIR resources your system can access. Scopes are returned as part of the token response and should be reviewed to confirm alignment with the intended use case.

Common examples include:

• system/Patient.read
• system/DocumentReference.read
• system/Observation.write
• patient360

If required scopes are missing, requests may succeed at the authentication level but fail due to authorization restrictions.

Validate Permissions with Targeted Requests

Confirm access by issuing requests that exercise the expected permissions:

• Use read requests to validate retrieval access.
• Use write requests, where supported, to validate writeback permissions.
• Use subscription-related workflows to validate event delivery configuration.

Authorization failures typically indicate a scope mismatch or a feature that has not been provisioned for the tenant.

Confirm Feature Alignment

Access validation also depends on feature provisioning. Even with correct scopes, API responses may be limited if a feature is not enabled for the tenant.

If responses do not match expectations:

• Confirm assigned scopes.
• Confirm feature provisioning.
• Verify the request is sent to the correct environment.

Once access is verified, your system is ready for tool-based testing or deeper workflow exploration.