This API is for use by Health IT developers seeking to use AXEIUM's ONC-Certified Standardized API for Health Level 7 (HL7®) Fast Healthcare Interoperability Resources (FHIR®) services. It maps EHR data into FHIR R4 patient and observation resources.

This collection helps partners and customers integrate the API in their workflows to meet the requirements of the Standardized API for Patient and Population Services as defined in 45 CFR §170.315(g)(10).

Before using this API, please review the Terms & Conditions and API Documentation.

For ONC Certification and API transparency conditions, refer to Axeium — ONC Certification.

Returns the OpenID Connect discovery document with all server capabilities, supported grant types, endpoints and scopes.

Returns the SMART App Launch 2.0 configuration document, including authorization and token endpoints, and supported capabilities.

Like most RESTful APIs, the AXEIUM OpenAPI uses OAuth 2.0 for security. When making calls to any resource within the OpenAPI you must pass a bearer token. This token is passed in the Authorization Header:

Authorization: Bearer <access_token>

To obtain a Bearer token, you must call an Authorization Server. The authorization server exposes two endpoints:

• authorize — used to confirm the user's credentials
• token — used to obtain the Bearer token

As per the FHIR specification, the AXEIUM OpenAPI supports both JSON and XML. For simplicity, examples are limited to JSON.

The AXEIUM OpenAPI uses OAuth 2.0 and OpenID Connect, based on the SMART App Launch Framework 2.0. References: OAuth 2.0 · OpenID Connect · SMART App Launch

The authorization code grant type is the primary supported flow as it is considered most secure. Other grant types such as implicit flow may be supported for backward compatibility but are not recommended.

Per 45 CFR §170.315(g)(10) and the g10 Certification Companion Guide, all communications with the AXEIUM FHIR API are encrypted using TLS version 1.2 or higher.

The following SMART on FHIR scopes are supported by the AXEIUM Health IT Module. Applications must request only the scopes necessary for their function.

Patient-Level Scopes

User-Level Scopes

System Scopes

OpenID Connect & Launch Scopes

For native applications (mobile apps, desktop clients), the AXEIUM Health IT Module supports secure issuance of initial refresh tokens using the PKCE (Proof Key for Code Exchange) extension per RFC 7636.

PKCE Flow for Native Apps

1. App generates a cryptographically random code_verifier (43–128 characters)
2. App computes code_challenge = BASE64URL(SHA256(code_verifier))
3. Authorization request includes code_challenge and code_challenge_method=S256
4. Token request includes the original code_verifier

Refresh tokens are issued when the offline_access scope is requested. Refresh tokens for native apps are single-use and rotated on each use to prevent token reuse attacks.

GET /connect/authorize?
  response_type=code
  &client_id=my_native_app
  &redirect_uri=myapp://callback
  &scope=launch/patient+patient/*.read+openid+offline_access
  &state=random_state_value
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK...
  &code_challenge_method=S256

When patients are presented with an authorization dialog with scopes, they are required to log in to the Carefluence Admin portal prior to generating a token for API access. In this workflow, they receive a verification code via email or text to the phone number or email registered in AXEIUM EHR. This verification code must be entered on the login page to access the APIs.

Users and developers wishing to consume this service must request access credentials by sending an email to support@axeium.com that includes:

• Whether you are a developer or patient
• Which clinic you want to connect to
• Your application name and description
• Your redirect URI(s)
• Your application type: public (native/SPA) or confidential (server-side)
• Requested scopes

Once registration is complete, you will receive login credentials allowing you to request the access token. The AXEIUM support team will help walk you through the steps.

Additional Error Information

A response with a 4xx or 5xx code may contain additional information in the form of a FHIR OperationOutcome. For example:

{
  "resourceType": "OperationOutcome",
  "issue": [{
    "severity": "error",
    "code": "forbidden",
    "diagnostics": "Access denied: invalid scope or missing patient context"
  }]
}

The AXEIUM Health IT Module implements the following US Core Implementation Guide 6.1.0 profiles. All elements marked MustSupport in the applicable profile are implemented.

Clinical Notes Supported (DocumentReference)

Additional Data Supported

Beyond USCDI v3 required data elements, AXEIUM additionally supports:

• Assessment and Plan of Treatment
• Health Concerns (Condition with category health-concern)

The following table maps USCDI v3 data elements to their FHIR R4 resource representations as implemented by AXEIUM.

Use of this API is governed by the AXEIUM API Terms and Conditions. View Full Terms of Use

Per 45 CFR 170.404(a)(2), these terms are publicly available and apply to all developers accessing this API. Key provisions include:

• Developers must not block or impede patient access to their health information
• API access may not be used for anti-competitive purposes
• Fees, if any, are transparent and non-discriminatory
• Axeium reserves the right to revoke access for violation of these terms

Swagger URLs

Authentication

Follow these steps to authenticate and obtain an access token via Swagger UI:

1

Access Swagger & Click Authorize

Navigate to the Swagger URL. Locate and click the Authorize button (lock icon) at the top of the page.

2

Enter Client ID

In the authorization dialog, enter external in the client_id field. Leave client_secret empty. Click Authorize.

3

Sign In

You will be redirected to the login page. Enter your username and password, then click Sign In.

4

Grant Access

After successful authentication, click Grant to allow the application to create an access token on your behalf.

5

Confirm & Close

You will see a confirmation that access has been granted. Click Close to return to the Swagger interface. You are now authenticated.

Using API Methods (Example)

Once authenticated, you can explore and test available endpoints:

3

Execute

Click Execute. The response will appear below with the status code and response body.

Document Return Protocol

The AXEIUM API supports clinical document exchange using the following protocol:

1. GET DocumentReference — Retrieve document references using the US Core DocumentReference operation ($docref). Returns FHIR JSON references to available documents.
2. POST DocumentReference — Submit clinical documents in C-CDA (Consolidated Clinical Document Architecture) XML format.

Available Methods

Conforms to US Core Patient Profile. Supports JSON and XML. Compliant with FHIR R4 v4.0.1.

Conforms to US Core Encounter Profile. MustSupport elements: status, class, type, subject, participant, period, reasonCode, diagnosis.