Healthcare / FHIR API
FHIR Authentication
FHIR R4Authenticate FHIR requests with OAuth 2.0 bearer tokens, tenant context and healthcare-specific scopes.
Authentication
OAuth 2.0
Bearer token
Scope
healthcare.read
Required
Standard
HL7 FHIR R4
FHIR R4
Rate limit
600 requests / min
Default
Response
Bundle / JSON
application/fhir+json
OAuth 2.0
Use OAuth 2.0 bearer tokens issued for the current Mediloop identity and tenant context.
Required headers
| Header | Required | Purpose |
|---|---|---|
| Authorization | Yes | Bearer access token |
| Accept | Recommended | FHIR JSON response |
| X-Tenant-Id | Contextual | Active professional/organization tenant |
FHIR scopes
| Scope | Purpose |
|---|---|
| healthcare.fhir.read | Read FHIR resources |
| healthcare.fhir.write | Create/update FHIR resources |
| healthcare.fhir.audit | Read history/audit |
| healthcare.fhir.subscribe | Manage subscriptions |
Tenant context
Professional access is evaluated against the active membership and tenant, not merely the user identity.
SMART on FHIR
SMART on FHIR compatibility can be used where enabled for the integration profile; production enablement is contract and environment dependent.
Example request
Authenticated request
curl "https://api.mediloop.com/fhir/r4/Patient/pat_123" -H "Authorization: Bearer $ACCESS_TOKEN" -H "X-Tenant-Id: $TENANT_ID"