Payer-to-Payer API
Secure exchange of member data between health plans to support continuity of care during member transitions, per CMS interoperability requirements.
Overview
The Payer-to-Payer API enables secure, standards-based exchange of member data between health plans to support continuity of care during member transitions. It allows receiving payer systems to retrieve claims, encounters, and prior authorization information from previous payer systems through authorized workflows.
It aligns with CMS-recommended implementation guides - CPCDS, HL7® Da Vinci PDex, and FHIR® Bulk Data - and leverages HL7® FHIR® with SMART Backend Services Authorization.
New to the Payer-to-Payer API? The Payer-to-Payer API user guide (PDF) opens in a new tab explains both the responder and requestor flows, including Member Match and data export.
User Guide
Capability Statement
Developers can access the Acentra Health FHIR server capabilities for the Payer-to-Payer API through the CapabilityStatement endpoint:
View JSONThe CapabilityStatement describes the supported profiles, interactions, search parameters, and authorization and token endpoints.
API Access Setup
Clients can retrieve SMART configuration details by invoking the SMART configuration endpoint at /.well-known/smart-configuration, appended to the FHIR Base URL.
Getting an Access Token
The Payer-to-Payer API uses SMART Backend Services (system-to-system) authorization. Authenticate with a signed JWT client_assertion, signed with the private key that matches the public key you registered. No secret is sent over the wire. Request the token with the client_credentials grant.
| Header | Value |
|---|---|
| content-type | application/x-www-form-urlencoded |
| accept | application/json |
| Parameter | Value |
|---|---|
| grant_type | client_credentials |
| scope | {scopes} (space-separated; only scopes approved for your registration) |
| client_assertion_type | urn:ietf:params:oauth:client-assertion-type:jwt-bearer |
| client_assertion | {signed_jwt} |
| Claim | Value |
|---|---|
| iss | {client_id} |
| sub | {client_id} |
| aud | https://sb.fhir.mhbapp.com/sof/oauth2/token |
| iat | Issue time (current time, in seconds since epoch) |
| exp | Expiry; keep it short, for example 5 minutes after iat |
| jti | Unique ID. Each assertion can be used once; a repeated jti is rejected. |
access_token as the Bearer token on API requests. The sandbox also accepts client_id with client_secret for quick testing, but client_assertion is the recommended method.Operations
The Payer-to-Payer API supports the following operations.
Resources
$davinci-data-export bulk export operation - individual REST endpoints are not available for these profiles.Request Headers
All requests for Payer-to-Payer API profiles require the following headers:
| Header | Value |
|---|---|
| content-type | application/json |
| accept | application/json |
| authorization | Bearer {access_token} |
Sample Responses & Data
Important Information for Payer Systems
| Topic | Reference |
|---|---|
| CARIN Alliance Code of Conduct | carinalliance.com - Trust Framework and Code of Conduct |
| Privacy, Security and HIPAA | healthit.gov - Privacy, Security and HIPAA |
| ONC Model Privacy Notice | healthit.gov - Model Privacy Notice |