API client

WeCare clinical system, cl_wecare_4f19.

This screen answersUS-12 US-50

Acceptance criteria

US-12 API Security Framework HIGHEST NEW SCREEN

As a platform owner, I want a secure authentication/authorization layer for third-party clients, so that external systems can only access data they are explicitly scoped for.

Provisioned client gets OAuth2 credentials or scoped API key per the US-17 spec.
Missing/invalid credentials → error code 401/403, no data.
Admin can revoke client’s access in near-real-time. An administrator can switch the API credentials off.

US-50 API Security: Per-Endpoint Scoping HIGHEST NEW SCREEN

As a platform owner, I want each API endpoint family to have its own scope profile, so that clients only access the specific data they're authorized for.

Each endpoint family (reception/finance/diagnosis) carries its own scope profile.
Out-of-scope entity request → rejected even with valid credentials.
Scope profiles reviewed against data-sensitivity per family.

Wireframe state

ActiveRevoked

Access is switched off. Revoked on 4 Oct 2026 at 16:40 by Hadeel Al-Qahtani. Calls with these credentials return 401. The client keeps its history for the audit log.

Credentials

Rotate secret

Client IDcl_wecare_4f19

Client secretHidden. Shown once at creation.

Token URLhttps://api.alraneem-hospital.example/oauth2/token

Credential typeOAuth2 client credentials

Expires2 Apr 2027

Scopes

Endpoint family	Read	Write
Reception and eligibilityPatients, eligibility checks	Granted	Granted
Finance, payment and claimClaims, batches, payment notices	No access	No access
Diagnosis and doctorDiagnoses, care team	No access	Granted

Scope changes apply to the next call. Out of scope requests return 403.

Recent calls

Quarantined responses

Time	Endpoint	Result	Time taken
10:42:07	POST /v1/diagnoses	201 Created	184 ms
10:41:55	GET /v1/eligibility/EL-30551	200 OK	96 ms
10:38:20	POST /v1/diagnoses	422 Invalid	71 ms
10:31:02	GET /v1/claims/CL-20418	403 Out of scope	48 ms

Details

Status: Active
Created: 3 Oct 2026 by Hadeel Al-Qahtani
Contact: integration@wecare.example
Rate limit: 300 calls a minute
Allowed IPs: 41.178.20.0/24
Last call: 2 min ago

Details

Status: Revoked
Created: 3 Oct 2026 by Hadeel Al-Qahtani
Revoked: 4 Oct 2026, 16:40
Reason: Vendor contract ended
Last call: 4 Oct 2026, 16:39

Switch off access

Revoking stops this client within a minute. You can add a new client if the system needs access again.

Revoke access

Access

Revoked clients cannot be switched back on. Add a new client to give this system access again.

Add API client