Prerequisites

Health Gorilla provides a Fast Healthcare Interoperability Resources (FHIR) R4-compliant RESTful API that enables secure access to healthcare data. The API supports standardized FHIR resources, OAuth 2.0 authentication, and API-based workflows for record retrieval, writeback, and event-driven notifications. Before beginning development, your organization must have API access provisioned, credentials issued, and the intended integration model defined.

Base URLs by Environment

Health Gorilla provides separate base URLs for the sandbox environment and the production environment. Selecting the correct base URL ensures that requests are routed to the intended environment and evaluated against the appropriate configuration.

Development and validation should begin in the sandbox environment before requests are sent to the production environment.

OAuth 2.0 Credentials

All API access requires OAuth 2.0 client credentials. Health Gorilla provisions credentials for your organization during implementation.

Provisioned credentials include:

• Client ID
• Client Secret

Credentials are environment-specific. Separate credentials are issued for the sandbox environment and the production environment, and must be stored securely. These credentials are used to request access tokens that authorize API requests.

Feature Provisioning

API behavior depends on which features are enabled for your tenant. Before testing an integration, confirm that your tenant is licensed and provisioned for the capabilities your organization intends to use. Health Gorilla manages feature enablement as part of onboarding and implementation. Production access for record retrieval, for Clinical Alerts and ADT notifications, and for the Lab Network each depends on completing the applicable onboarding, vetting, and licensing steps for that product.

Common API-enabled capabilities include:

• Patient360 record retrieval workflows
• Clinical Alerts delivery through API-supported workflows
• Diagnostic ordering and results retrieval through the Lab Network
• Writeback workflows for supported FHIR resources and interfaces

Limited responses or missing data often indicates that a feature has not been provisioned for your tenant.

OAuth 2.0 Scope Preparation

OAuth 2.0 scopes determine which API capabilities and FHIR resources your system can access. Scopes are assigned during implementation and included in issued access tokens. Assigned scopes govern read access, writeback permissions where supported, and FHIR subscription-related capabilities.

Examples of commonly assigned scopes include:

• system/Patient.read
• system/DocumentReference.read
• system/Observation.write
• patient360

Some scopes correspond to standard FHIR resource access, while others enable Health Gorilla-specific functionality. Authorization failures or unexpected restrictions typically indicate a scope mismatch.

Integration Readiness Check

Before proceeding to authentication and test requests, confirm that the following conditions are met:

1. The correct environment is selected and configured.
2. OAuth 2.0 credentials have been issued for that environment.
3. Required API features are enabled for your tenant.
4. Assigned scopes align with your intended API workflows.

Once these prerequisites are satisfied, your system is ready to request an access token and submit its first authenticated API request.