SMART clinical scopes

OAuth scope syntax used by SMART on FHIR to grant resource-level access, FHIR access control.

Definition

A clinical scope names a context (patient/, user/ or system/), a FHIR resource type (or *), and the permitted interactions. SMART v2 replaced the v1 .read/.write suffixes with granular .cruds letters — c (create), r (read), u (update), d (delete), s (search) — and optional query constraints, advertised by the permission-v2 capability.

Origin

Defined in the HL7 SMART App Launch implementation guide, section "Scopes and Launch Context" (STU 2.x); the v2 granular syntax is part of that normative release.

Example in context

patient/Observation.rs?category=http://terminology.hl7.org/CodeSystem/observation-category|vital-signs

Related terms

• SMART App Launch — the framework that negotiates these scopes.
• SMART Backend Services — uses the parallel system/ scopes.