Developers · Standards-based API
SMART Backend Services
System-to-system FHIR access with no user at the keyboard, for a population-health platform, a network or a practice's own systems. The practice authorizes your system, and your server proves who it is with a signed assertion.
At a glance
| Status | Live in production. |
| Grant | client_credentials with a private_key_jwt client assertion. |
| Signing | RS384 or ES384. You keep the private key; we hold only your public JWKS or HTTPS jwks_uri. |
| Token endpoint | https://auth.chartvoyant.com/oauth/token |
| Scope of access | One practice per client, limited to the scopes that practice allows. A system token reads any patient in that practice, and searches must name the patient. |
| Registration | Granted, not self-service: the practice explicitly authorizes your system before your keys are registered for it. |
| Cost | No fee and no revenue share. |
Live, with certification in progress
The FHIR and authorization hosts are live in production. ONC certification is in progress and ChartVoyant is not yet CHPL-listed. An internal security assessment has been completed with follow-up remediation ongoing; an independent external security review has not been completed. Access requires an enabled practice, a registered app and the right patient or practice authorization.
Request a token
Sign a fresh JWT for every token request. Synthetic placeholders throughout.
Assertion
// Header (sign with your private key; never send the private key anywhere)
{"alg":"RS384","typ":"JWT","kid":"YOUR_PUBLIC_KEY_ID"}
// Claims
{"iss":"YOUR_CLIENT_ID","sub":"YOUR_CLIENT_ID",
"aud":"https://auth.chartvoyant.com/oauth/token",
"exp":NOW_PLUS_300,"jti":"NEW_RANDOM_ID"}
Token request
POST https://auth.chartvoyant.com/oauth/token Content-Type: application/x-www-form-urlencoded grant_type=client_credentials &scope=system%2FPatient.rs%20system%2FObservation.rs &client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer &client_assertion=YOUR_SIGNED_JWT
issandsubare your client ID,audis the exact token endpoint,expis no more than five minutes ahead, andjtiis unique per request.- Replayed assertions, unregistered keys and unregistered algorithms are rejected.
- The response carries an access token that lasts 3,600 seconds and the granted scope. There is no refresh token and no ID token; sign a new assertion for a new token.
Scopes
| Scope | Meaning |
|---|---|
| system/{Type}.rs | Read and search one supported resource type across the practice. |
| system/*.rs | Every supported type, including all Bulk Data export classes. |
| system/Group.rs | Discover and read the practice's Group, which Bulk Data needs. |
A patient or clinician token cannot start a population export.
How to get access
- Read the guide
The full SMART on FHIR-4 developer guide and the public practice directory need no account, payment or agreement.
- Request registration
Email info@chartvoyant.com or use the support form with the details your system needs. Send no patient records, private keys or client secrets.
- We register and enable it
We apply the same identity and configuration checks to every developer, and register and enable a complete eligible request within five business days. If something is missing, we tell you what.
- Authorize and connect
The practice authorizes your system for its data. Then request a token with a signed assertion and call its FHIR base.
No fee
There is no fee to patients, practices or app developers for the standardized FHIR API, registration, testing, production access, calls or Bulk Data, and no revenue share. The API Use Agreement and profit share for the separate ChartVoyant API do not apply here.