{"openapi":"3.0.1","info":{"title":"Payer Access API","description":"Intercambio pagador-a-pagador CMS-0057-F según Da Vinci PDex 2.1.0. Búsqueda de miembro y recuperación del expediente longitudinal cuando un miembro cambia de plan. Solo de máquina a máquina, mediante SMART Backend Services.","version":"v1"},"paths":{"/health":{"get":{"tags":["Health"],"summary":"Indica que la aplicación responde y qué imagen la sirve.","operationId":"get-health","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthStatus"}}}}}},"head":{"tags":["Health"],"summary":"Indica que la aplicación responde y qué imagen la sirve.","operationId":"head-health","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthStatus"}}}}}}},"/metadata":{"get":{"tags":["Metadata"],"summary":"Devuelve el CapabilityStatement de FHIR R4 de este servidor.","operationId":"get-metadata","responses":{"200":{"description":"OK","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirCapabilityStatement"}}}}}}},"/Patient/$member-match":{"post":{"tags":["PayerExchange"],"summary":"Busca un afiliado entrante en los registros de First Medical.","description":"\n\r\n  <b>Why this endpoint exists:</b> CMS-0057-F requires a receiving\r\n            payer to retrieve a new member's history from their prior payer. Before\r\n            any data moves, the two payers must agree on <i>which</i> member is\r\n            being discussed. Da Vinci HRex defines the `$member-match`\r\n            operation for exactly this, and PDex 2.1.0 requires it as the entry\r\n            point to payer-to-payer exchange.\r\n\n\r\n  <b>Data flow:</b> requesting payer's JWT is validated → caller is\r\n            resolved to a registered payer → the HRex `Consent` parameter is\r\n            validated → member is matched in the FHIR server → the opt-in is recorded\r\n            for that payer → a member identifier is returned. No clinical data\r\n            crosses in this step.\r\n\n\r\n  <b>Consent:</b> payer-to-payer exchange is opt-in, and the\r\n            requesting payer attests to the member's consent in the request. The\r\n            attestation is accepted only from the authenticated client's own payer,\r\n            after a unique match, and an Active record is then created or refreshed\r\n            (one per member; another payer's record is revoked and kept). A missing\r\n            or invalid Consent answers 422 and records nothing.\r\n\n\r\n  <b>Why 422 on an ambiguous match:</b> returning a guess would\r\n            disclose one member's data to a request about another. The operation\r\n            returns exactly one match or none.","operationId":"post-member-match","parameters":[{"name":"api-version","in":"query","schema":{"type":"string"}},{"name":"x-api-version","in":"header","schema":{"type":"string"}}],"requestBody":{"description":"FHIR Parameters resource carrying MemberPatient, CoverageToMatch and Consent.","content":{"application/json":{"schema":{}},"text/json":{"schema":{}},"application/*+json":{"schema":{}}}},"responses":{"200":{"description":"Exactly one member matched and the consent was recorded.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirMemberMatchParameters"}}}},"403":{"description":"Caller not authorized.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"422":{"description":"The Consent is missing or invalid, zero or multiple members matched, or the request was incomplete.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"500":{"description":"The consent could not be recorded.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}}},"/Patient":{"get":{"tags":["PayerExchange"],"summary":"Finds the Patient a `$member-match` identifier stands for.","description":"\n\r\n  <b>Why this endpoint exists:</b> the HRex `$member-match` answer\r\n            carries only a `MemberIdentifier`. PDex payer-to-payer turns it into\r\n            the Patient id the later reads need with\r\n            `GET Patient?identifier={system}|{value}`.\r\n\n\r\n  <b>Same gates as `$everything`:</b> a registered requesting\r\n            payer, active Vital coverage, and an Active opt-in recorded for that payer.\r\n            A caller that is not a registered payer is 403, as everywhere else. Any\r\n            other miss (no such member, not Vital, no opt-in, an ambiguous match)\r\n            answers the same empty searchset, so the search cannot be used to learn\r\n            that someone is a member, holds another plan, or has not opted in.","operationId":"get-patient-search","parameters":[{"name":"identifier","in":"query","description":"Token `system|value`; the system is `urn:firstmedical:member-id`.","schema":{"type":"string"}},{"name":"api-version","in":"query","schema":{"type":"string"}},{"name":"x-api-version","in":"header","schema":{"type":"string"}}],"responses":{"200":{"description":"Searchset Bundle holding the matched Patient, or no entry.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirBundle"}}}},"400":{"description":"identifier is missing.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"403":{"description":"Caller not authorized.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"502":{"description":"The clinical data store could not be reached.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}}},"/Patient/{id}/$everything":{"get":{"tags":["PayerExchange"],"summary":"Devuelve el historial longitudinal de un afiliado identificado.","description":"\n\r\n  <b>Why this endpoint exists:</b> CMS-0057-F requires payers to\r\n            exchange the member's clinical and claims data, including at least\r\n            5 years of claims history, within 1 business day of the member's\r\n            request. `Patient/$everything` is the FHIR R4 operation for\r\n            retrieving a patient's complete record in one call.\r\n\n\r\n  <b>Data flow:</b> the member's consent for the calling payer is checked\r\n            (recorded by `$member-match`, period not ended) → `_since` is clamped\r\n            server-side to no earlier than 5 years ago → Patient, Coverage,\r\n            ExplanationOfBenefit, Claim, ClaimResponse, Condition, MedicationRequest,\r\n            AllergyIntolerance, Observation, Procedure and Immunization are read from\r\n            the FHIR server, along with the Practitioner/Organization resources those\r\n            reference → denied and drug prior authorizations are removed and the\r\n            window is applied by date of service (ExchangeScope) → returned as a\r\n            single FHIR Bundle.\r\n\n\r\n  <b>Why the window is clamped rather than validated:</b> the\r\n            regulation sets a floor on what must be shared, not a ceiling on what a\r\n            client may ask for. Clamping satisfies the request without\r\n            over-disclosing.","operationId":"get-patient-everything","parameters":[{"name":"id","in":"path","description":"Id del recurso Patient de FHIR, tal como lo devuelve $member-match.","required":true,"schema":{"type":"string"}},{"name":"_since","in":"query","description":"Límite inferior opcional en ISO 8601; se ajusta a la ventana de reclamaciones.","schema":{"type":"string"}},{"name":"api-version","in":"query","schema":{"type":"string"}},{"name":"x-api-version","in":"header","schema":{"type":"string"}}],"responses":{"200":{"description":"FHIR Bundle containing the member's record.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirBundle"}}}},"403":{"description":"Caller not authorized, or member has not opted in.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"422":{"description":"_since is not an ISO 8601 date or date-time.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}},"502":{"description":"The clinical data store could not be reached.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}}},"/api/consent/{memberId}":{"get":{"tags":["PayerExchange"],"summary":"Indica el estado del consentimiento de intercambio entre pagadores de un afiliado.","description":"<b>Por qué existe este endpoint:</b> 42 CFR 422.121(b) hace que el intercambio entre pagadores requiera la aceptación del afiliado (opt-in). El pagador solicitante puede preguntar si el afiliado que va a pedir lo aceptó antes de enviar $member-match. Devuelve solo la decisión de consentimiento, nunca datos clínicos.\n\n<b>El mismo control que las operaciones de intercambio (QA-51):</b> el gateway admite solo un token de client_credentials que otorgue payer/Exchange.read, y esta acción exige además que el cliente sea un pagador solicitante registrado, igual que $member-match y $everything. Antes aceptaba cualquier token autenticado, así que una credencial que el gateway nunca admitiría podía leer la decisión de cualquier afiliado desde dentro de la red.\n\nUn afiliado sin decisión registrada, un id que no corresponde a ningún afiliado y un afiliado sin cobertura Vital activa responden igual, optedIn false, de modo que la operación no sirve para averiguar si alguien es afiliado ni de qué línea.","operationId":"get-consent","parameters":[{"name":"memberId","in":"path","description":"Identificador del afiliado en First Medical.","required":true,"schema":{"type":"string"}},{"name":"api-version","in":"query","schema":{"type":"string"}},{"name":"x-api-version","in":"header","schema":{"type":"string"}}],"responses":{"200":{"description":"The member's consent decision.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConsentStatus"}}}},"403":{"description":"Caller is not an authorized requesting payer.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}}},"/.well-known/smart-configuration":{"get":{"tags":["SmartConfiguration"],"summary":"Devuelve la configuración de SMART Backend Services.","operationId":"get-smart-configuration","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SmartConfiguration"}}}}}}},"/Patient/$everything":{"get":{"tags":["UnsupportedOperations"],"summary":"Patient/$everything a nivel de tipo no está disponible; use Patient/{id}/$everything.","operationId":"get-patient-everything-type","responses":{"404":{"description":"OperationOutcome, code not-supported.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}},"post":{"tags":["UnsupportedOperations"],"summary":"Patient/$everything a nivel de tipo no está disponible; use Patient/{id}/$everything.","operationId":"post-patient-everything-type","responses":{"404":{"description":"OperationOutcome, code not-supported.","content":{"application/fhir+json":{"schema":{"$ref":"#/components/schemas/FhirOperationOutcome"}}}}}}},"/openapi.json":{"get":{"tags":["Discovery"],"summary":"Este documento OpenAPI","description":"La descripción OpenAPI 3 de esta API, legible sin token.","operationId":"get-openapi","responses":{"200":{"description":"The OpenAPI document.","content":{"application/json":{"schema":{"required":["openapi","info","paths"],"type":"object","description":"An OpenAPI 3.0 document."}}}}}}}},"components":{"schemas":{"ConsentStatus":{"type":"object","properties":{"memberId":{"type":"string","description":"The member identifier the caller asked about.","nullable":true},"optedIn":{"type":"boolean","description":"True only when an affirmative opt-in is on record."}},"description":"A member's payer-to-payer consent decision, and nothing else."},"FhirBundle":{"type":"object","properties":{"resourceType":{"type":"string","nullable":true},"type":{"type":"string","nullable":true},"total":{"type":"integer","format":"int32","nullable":true},"link":{"type":"array","items":{"$ref":"#/components/schemas/FhirBundleLink"},"nullable":true},"entry":{"type":"array","items":{"$ref":"#/components/schemas/FhirBundleEntry"},"nullable":true}},"description":"A FHIR R4 searchset Bundle. Entries are US Core 7.0.0 and CARIN C4BB\r\nresources, as listed on Patient/{id}/$everything."},"FhirBundleEntry":{"type":"object","properties":{"fullUrl":{"type":"string","nullable":true},"resource":{"type":"object","additionalProperties":{},"nullable":true}},"description":"A Bundle entry. resource is a FHIR R4 resource."},"FhirBundleLink":{"type":"object","properties":{"relation":{"type":"string","nullable":true},"url":{"type":"string","nullable":true}},"description":"A Bundle link, for example the next page."},"FhirCapabilityStatement":{"type":"object","properties":{"resourceType":{"type":"string","nullable":true},"status":{"type":"string","nullable":true},"date":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"fhirVersion":{"type":"string","nullable":true},"format":{"type":"array","items":{"type":"string"},"nullable":true},"instantiates":{"type":"array","items":{"type":"string"},"nullable":true},"rest":{"type":"array","items":{"type":"object","additionalProperties":{}},"nullable":true}},"description":"The FHIR R4 CapabilityStatement, instantiating the PDex server statement.\r\nThe rest element follows the FHIR specification."},"FhirIdentifier":{"type":"object","properties":{"system":{"type":"string","nullable":true},"value":{"type":"string","nullable":true},"type":{"type":"object","additionalProperties":{},"nullable":true}},"description":"A FHIR Identifier."},"FhirMemberMatchParameters":{"type":"object","properties":{"resourceType":{"type":"string","nullable":true},"parameter":{"type":"array","items":{"$ref":"#/components/schemas/FhirParameter"},"nullable":true}},"description":"The FHIR Parameters resource $member-match returns (Da Vinci HRex\r\nmember-match-out): exactly one MemberIdentifier, typed MB."},"FhirOperationOutcome":{"type":"object","properties":{"resourceType":{"type":"string","nullable":true},"issue":{"type":"array","items":{"$ref":"#/components/schemas/FhirOperationOutcomeIssue"},"nullable":true}},"description":"A FHIR R4 OperationOutcome. Every error this API answers carries one."},"FhirOperationOutcomeIssue":{"type":"object","properties":{"severity":{"type":"string","description":"fatal, error, warning or information.","nullable":true},"code":{"type":"string","description":"FHIR issue type, for example forbidden, processing or not-supported.","nullable":true},"diagnostics":{"type":"string","description":"Human readable detail. Never names a member.","nullable":true}},"description":"One issue of an OperationOutcome."},"FhirParameter":{"type":"object","properties":{"name":{"type":"string","nullable":true},"valueIdentifier":{"$ref":"#/components/schemas/FhirIdentifier"},"valueString":{"type":"string","nullable":true}},"description":"One parameter of a Parameters resource."},"HealthStatus":{"type":"object","properties":{"status":{"type":"string","nullable":true},"gitSha":{"type":"string","nullable":true},"buildNumber":{"type":"string","nullable":true},"builtAt":{"type":"string","nullable":true}},"description":"Liveness and the image serving it."},"SmartConfiguration":{"type":"object","properties":{"issuer":{"type":"string","nullable":true},"jwks_uri":{"type":"string","nullable":true},"token_endpoint":{"type":"string","nullable":true},"grant_types_supported":{"type":"array","items":{"type":"string"},"nullable":true},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string"},"nullable":true},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string"},"nullable":true},"scopes_supported":{"type":"array","items":{"type":"string"},"nullable":true},"capabilities":{"type":"array","items":{"type":"string"},"nullable":true}},"description":"The SMART Backend Services discovery document."}},"securitySchemes":{"Bearer":{"type":"http","description":"Paste a JWT token.","scheme":"Bearer","bearerFormat":"JWT"},"oauth2":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"https://api-fmcom-interoppatientaccess-dev-001.azure-api.net/smart-auth/api/token","scopes":{"payer/Exchange.read":"Payer-to-payer exchange for a matched member"}}}}}},"security":[{"Bearer":[]},{"oauth2":["payer/Exchange.read"]}],"servers":[{"url":"https://api-fmcom-interoppatientaccess-dev-001.azure-api.net/payer-access"}]}