Authorization

Ava Ecosystem provisions public SMART App Launch clients: authorization code + PKCE S256, EHR launch, OpenID Connect. There are no client secrets. See the App launch & PKCE guide for the step-by-step flow.

Endpoints

Endpoint	URL
SMART discovery	`https://sandbox.avaemr.ca/.well-known/smart-configuration`
Authorization	`https://sandbox.avaemr.ca/oauth/authorize`
Token	`https://sandbox.avaemr.ca/oauth/token`
FHIR base	`https://sandbox.avaemr.ca/fhir/r4/{partition_id}`

Always resolve endpoints from the discovery document at runtime.

Protocol details

Standards: FHIR R4 4.0.1, SMART App Launch 2.2.0.
Grant types: authorization_code.
PKCE methods: S256.
Launch modes: ehr.
SMART capabilities: launch-ehr, client-public, sso-openid-connect, context-ehr-patient, permission-patient, permission-user, permission-v2.

Scope grammar

<context>/<ResourceType>.<interactions>    e.g. patient/Patient.rs

patient/ scopes are confined to the launched patient; user/ scopes follow the signed-in clinician's access. Interaction letters are SMART v2 granular: c create, r read, s search. Protocol scopes: launch, openid, fhirUser, launch/servicerequest — launch is always required and fhirUser requires openid.

Supported scopes

launch
openid
fhirUser
launch/servicerequest
patient/Patient.r
patient/Patient.rs
user/Patient.rs
user/Practitioner.r
user/Practitioner.rs
user/PractitionerRole.rs
user/Organization.rs
user/Location.rs
patient/Appointment.rs
user/Appointment.rs
patient/Encounter.rs
user/Encounter.rs
patient/Condition.rs
user/Condition.rs
patient/AllergyIntolerance.rs
user/AllergyIntolerance.rs
user/ServiceRequest.r
patient/MedicationRequest.rs
patient/FamilyMemberHistory.rs
user/DocumentReference.c
user/Media.c