Developers · Standards-based API
SMART App Launch
Connect a patient's chosen app, or a clinician's app, to a ChartVoyant practice with SMART App Launch 2. The person signs in and consents, and your app receives a token scoped to what they approved.
At a glance
| Status | Live in production. |
| Version | SMART App Launch 2 (STU2). SMART v2 scopes and SMART v1 read scopes are both accepted. |
| Launches | Standalone patient, standalone clinician, and EHR launch from inside the chart. |
| Client types | Public and native (none), confidential symmetric (client_secret_basic), confidential asymmetric (private_key_jwt, RS384 or ES384). |
| Security | Authorization code with PKCE S256 on every flow; plain or missing PKCE is rejected. aud must equal the practice's FHIR base. Redirect URIs must match registration exactly. |
| Identity | OpenID Connect with openid fhirUser. ID tokens are signed RS256. |
| Cost | No fee and no revenue share. |
Live, with certification in progress
The FHIR and authorization hosts are live in production. ONC certification is in progress and ChartVoyant is not yet CHPL-listed. An internal security assessment has been completed with follow-up remediation ongoing; an independent external security review has not been completed. Access requires an enabled practice, a registered app and the right patient or practice authorization.
Endpoints
Read them from discovery rather than hard-coding them.
| Endpoint | URL |
|---|---|
| Discovery | https://fhir.chartvoyant.com/r4/{practice}/.well-known/smart-configuration |
| OpenID configuration | https://auth.chartvoyant.com/.well-known/openid-configuration |
| Authorize | https://auth.chartvoyant.com/oauth/authorize (GET or POST) |
| Token | https://auth.chartvoyant.com/oauth/token |
| Introspect | https://auth.chartvoyant.com/oauth/introspect |
| Revoke | https://auth.chartvoyant.com/oauth/revoke |
| Public signing keys | https://auth.chartvoyant.com/oauth/jwks.json |
| Style | https://fhir.chartvoyant.com/r4/{practice}/.well-known/smart-style.json, so an embedded app can match the chart. |
Launch flows
| Flow | How it works |
|---|---|
| Patient standalone | The patient signs in with their existing portal account, chooses the practice where applicable, and reviews consent. They can uncheck a resource class or narrow a supported category. The token carries the patient context; the app cannot name a different patient. |
| Clinician standalone | The clinician completes staff sign-in and MFA, selects a patient and consents. The ID token's fhirUser names their Practitioner resource. |
| EHR launch | The clinician opens a chart and selects your app's tile. ChartVoyant calls your launch URL with iss and an opaque launch. The token response includes patient, encounter when present, need_patient_banner and smart_style_url. |
Authorize request (synthetic placeholders)
GET https://auth.chartvoyant.com/oauth/authorize ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri=https://your-app.example/callback &aud=https://fhir.chartvoyant.com/r4/your-practice &scope=launch/patient openid fhirUser offline_access patient/Patient.rs patient/Observation.rs &code_challenge=BASE64URL_SHA256_OF_VERIFIER&code_challenge_method=S256 &state=RANDOM_STATE&nonce=RANDOM_NONCE
Native apps may use exact registered loopback (localhost or 127.0.0.1) or HTTPS callbacks. Custom URI schemes are not supported. The full guide has complete code for each flow.
Scopes
| Scope | Meaning |
|---|---|
| patient/{Type}.rs | Read and search within the patient's context. .r and .s alone are accepted. |
| user/{Type}.rs | Read and search what the authorizing clinician may access. |
| patient/*.read, user/*.read | SMART v1 read forms. |
| ?category=… | Finer-grained constraints on supported Condition and Observation categories, enforced on search and read. |
| launch, launch/patient | EHR launch context, or a patient picker in a standalone launch. |
| openid fhirUser | Signed identity claims. These are not resource permissions. |
| offline_access | A refresh token for access while the user is away. |
| online_access | A refresh token bounded by the authorizing sign-in session. |
| Write scopes | Not supported. The API is read-only. |
Tokens and revocation
- Authorization codes expire after 120 seconds and work once.
- Access tokens are opaque bearer tokens that last 3,600 seconds.
- Offline refresh tokens are valid for 95 days from first issue, across rotation; each refresh invalidates the previous token.
- Online refresh ends with the authorizing session.
- Patients can revoke an app at any time in the patient portal under Connected apps. App disablement, sign-out and account changes end access too.
How to register an app
- Read the guide
The full SMART on FHIR-4 developer guide and the public practice directory need no account, payment or agreement.
- Request registration
Email info@chartvoyant.com or use the support form with the details your app needs. Send no patient records, private keys or client secrets.
- We register and enable it
We apply the same identity and configuration checks to every developer, and register and enable a complete eligible request within five business days. If something is missing, we tell you what.
- Authorize and connect
A patient or clinician authorizes your app at sign-in. Then call the practice's FHIR base with the access token.
No fee
There is no fee to patients, practices or app developers for the standardized FHIR API, registration, testing, production access, calls or Bulk Data, and no revenue share. The API Use Agreement and profit share for the separate ChartVoyant API do not apply here.