Going to production

Sandbox access is self-serve; production access is reviewed. Three things are deliberately independent decisions:

1. Security review — approves a specific versioned snapshot of your app's configuration and permissions for production.
2. Production registration — provisions your production client after approval.
3. Marketplace listing — an optional, separately reviewed public listing. Private and invite-only distribution don't need it.

Before you submit

• Finish your integration against the sandbox — reviews evaluate the exact configuration and permission schema you submit, frozen as an immutable snapshot.
• Production URIs must be HTTPS — the loopback-HTTP allowance is sandbox-only.
• Tighten your permission schema to what you actually use, and write rationales for the reviewer and the consenting clinician. Over-broad scope requests are the most common reason for change requests.
• Make sure your app's support email and URLs are current; deprecation and security notices go to the registered owner.

The security review

Submit from your app's page in the portal. The submission captures your configuration and permission schema at that version; editing after submission creates new draft versions and does not alter what's under review. Review ends in approval, a request for changes, or rejection — with reasons — and an approved app stays approved while a newer version is under review, so iterating is safe.

Broadening scopes later means a new schema version and a new review; clinics see a re-consent prompt only after the new version is approved and deployed.

Production registration

After approval you can provision production: a separate public client with its own client_id and endpoints — your sandbox registration keeps working unchanged. The EMR remains authoritative for clinic-by-clinic enablement and consent; production registration makes your app available, not installed.

Marketplace listing

If you want public distribution, submit your listing content (name, description, imagery, links) for the independent marketplace-content review. Publication and unpublication never touch production access — unpublishing a listing does not suspend running installations.

After launch

• Watch the changelog — breaking changes carry Deprecation/Sunset headers and a 6-to-12-month window per the versioning policy.
• Every API change reaches your sandbox at least one release cycle before production: keep your sandbox integration alive as your early-warning system.