FHIR API Documentation

1. Basic API Information

FHIR Server Base URL	https://integration.medicalofficeforce.co/fhir
FHIR Version	FHIR R4 (4.0.1)
SMART Authorization Endpoint	`/auth/authorize` (Relative to Base URL)
SMART Token Endpoint	`/auth/token` (Relative to Base URL)
Supported OAuth Flows	Authorization Code Client Credentials
Bulk Data Export	`/$export`

2. Capability & Configuration

Dynamic discovery metadata describing what this server supports and how it is secured.

FHIR Capability Statement

Shows supported resources, supported operations, and search parameters.

Endpoint: GET /metadata

Link: /metadata

SMART Discovery Configuration

Shows supported authorization features, capabilities, and token endpoints.

Endpoint: GET /.well-known/smart-configuration

Link: /.well-known/smart-configuration

3. Supported FHIR Resources

We actively support the US Core standard profiles. Primary resources include:

Patient Observation Condition Encounter AllergyIntolerance MedicationRequest MedicationDispense Procedure Immunization DiagnosticReport DocumentReference CarePlan CareTeam Organization Practitioner

Note: Refer to the Capability Statement for the exhaustive list.

4. Authorization Example (EHR Launch / Standalone)

To request authorization for a user to access clinical data, direct their browser to the authorization endpoint.

Example Authorization URL:

GET /auth/authorize?
  response_type=code
  &client_id=example-client-id
  &scope=launch patient/*.read openid fhirUser
  &redirect_uri=https://app.example.com/callback
  &aud=[FHIR_SERVER_BASE_URL]
  &state=xyz123

5. Token Request Example

Exchange an authorization code for an access token (and conditionally an ID token and refresh token).

Example: Authorization Code Grant

POST /auth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTH_CODE_RECEIVED_FROM_CALLBACK
&client_id=example-client-id
&client_secret=example-client-secret
&redirect_uri=https://app.example.com/callback

Example: System/Backend Client Credentials Grant

For headless apps (e.g. bulk export), use asymmetric JWT assertions.

POST /auth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&scope=system/*.read
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&client_assertion=eyJhbGci...[JWT_SIGNED_BY_PRIVATE_KEY]...

MEDICAL OFFICE FORCE VERSION 1.0