Add API client

Create credentials for an outside system and choose what it may reach.

This screen answersUS-12 US-50

Acceptance criteria

US-12 API Security Framework HIGHEST NEW SCREEN

As a platform owner, I want a secure authentication/authorization layer for third-party clients, so that external systems can only access data they are explicitly scoped for.

Provisioned client gets OAuth2 credentials or scoped API key per the US-17 spec.
Missing/invalid credentials → error code 401/403, no data.
Admin can revoke client’s access in near-real-time. An administrator can switch the API credentials off.

US-50 API Security: Per-Endpoint Scoping HIGHEST NEW SCREEN

As a platform owner, I want each API endpoint family to have its own scope profile, so that clients only access the specific data they're authorized for.

Each endpoint family (reception/finance/diagnosis) carries its own scope profile.
Out-of-scope entity request → rejected even with valid credentials.
Scope profiles reviewed against data-sensitivity per family.

Wireframe state

DefaultCreated

Client

Client name

Shown in the audit log and on this list.

Technical contact

Credential type

Per the API scoping spec.

Expires

Allowed IP addresses (optional)

Leave empty to allow any address.

Rate limit

Scopes

Endpoint family	Direction	Read scope	Write scope
Reception and eligibilityPatients, eligibility checks	Pull and push	Read	Write
Finance, payment and claimClaims, batches, payment notices	Pull	Read	Write
Diagnosis and doctorDiagnoses, care team	Push	Read	Write

A client can only reach the families ticked here. A request for anything else is rejected, even with a valid credential.

CancelCreate API client

Save this secret. Copy the client secret now. It is shown once and cannot be read again. If you lose it, rotate the secret.

Credentials for WeCare clinical system

Client IDcl_wecare_4f19

Client secretrhcp_sk_live_9Qm2xT7vLd48aZfN3hRb0WcE

Token URLhttps://api.alraneem-hospital.example/oauth2/token

Expires2 Apr 2027

Granted scopes

Reception and eligibility: Read Write
Diagnosis and doctor: Write
Finance, payment and claim: No access
Rate limit: 300 calls a minute

API documentation Open client