Scopes for user read/write + access to all patients

[lindsay-davis-zocdoc]

Hey Athena,

I followed the instructions to access the dev sandbox outlined in this document: https://mydata.athenahealth.com/access-the-apis and have been able to retrieve an auth code and authenticate successfully in Postman. In this document, the example auth link it provides includes the scopes "scope=openid%20profile%20patient/.read%20launch/patient". I updated this to "scope=openid%20profile%20user/.read%20user/*.write%20launch/patient to be able to create a new patient successfully. Authenticating this way only allows me to access information for the one patient I select to retrieve the code. I found instructions to remove the scope launch/patient here, but cannot retrieve an auth code this way: https://github.com/athenahealth/apiserver-athenaFlex/issues/18

How can I get access to search all patients? The current auth link I am using is constructed as follows: https://ap22sandbox.fhirapi.athenahealth.com/demoAPIServer/oauth2/authorize?state=defaultState&scope=openid%20profile%20user/*.read%20user/*.write%20launch/patient&response_type=code&redirect_uri={{redirect_uri}}&aud=https%3A%2F%2Fap23sandbox.fhirapi.athenahealth.com%2FdemoAPIServer&client_id={{client_id}}

Also, the endpoint /Practitioner returns 20 results in the searchset. I am looking to test the appointment booking flow. Do any of the test practitioners have open schedules or open slots for booking? If so, which IDs?

[deepaktiwari29]

Hello @lindsay-davis-zocdoc , Regarding your query about generating an access token to search all patients, as stated in #18 , you can make a request that excludes the launch/patient scope, and you will be provided with the desired access token. Here's the updated scope paramter value: scope=openid%20profile%20user/.read%20user/.write Please provide us with any additional details if you come across any issues when attempting to generate the access token this way.

You can use Practitioner/1225652472001060 for booking your appointments. Please refer to #238.

[lindsay-davis-zocdoc]

Thank you Deepak.

To confirm, this looks like it only allows access to test patients created with this user? I am now able to create multiple test patients and only access the ones I have created (this works for me for my testing).

[deepaktiwari29]

@lindsay-davis-zocdoc, Yes, it is right. On the patient selection page, we only show patients that this user has access to.

[deepaktiwari29]

Hello @lindsay-davis-zocdoc, hoping we have answered your question. Marking this issue as closed, if you have any further questions, please open a new ticket.