Acentra Health · Interoperability SolutionSandbox Environment

Da Vinci · Questionnaire

Documentation Templates and Rules (DTR)

Streamlined collection of payer-required documentation for prior authorization, driven by FHIR® Questionnaire and QuestionnaireResponse resources.

Implementation GuideDa Vinci DTR

VersionV 2.2.0-ballot (STU 2.2 Ballot)open_in_new

SecuritySMART on FHIR

Base Path/priorauth/api/v1

User GuidePDFpicture_as_pdf

assignment

Overview

The Documentation Templates and Rules (DTR) API is a FHIR®-based interoperability API that streamlines the collection of patient documentation required by payer systems for prior authorization processing.

It leverages FHIR® Questionnaire and QuestionnaireResponse resources to define and collect documentation, while enforcing secure access through the SMART on FHIR security framework and OAuth 2.0.

New to the DTR API? The DTR API user guide (PDF) opens in a new tab explains how a DTR session is launched and how questionnaires and rules are processed.

menu_book

User Guide

DTR API User Guide

How DTR is launched and how a request and its response are processed, plus base URLs, the CapabilityStatement, supported scopes, resources and request headers.

PDF · 17 pages · 1.3 MB

open_in_newView Guide downloadDownload PDF

What’s inside

DTR LaunchRequest ProcessingResponse ProcessSupported ScopesRequest Headers

fact_check

Capability Statement

Developers can access the Acentra Health FHIR server capabilities for the DTR API using the CapabilityStatement endpoint:

METAhttps://sb.fhir.mhbapp.com/priorauth/api/v1/metadata

View JSON

The CapabilityStatement describes the supported profiles, interactions, and authorization and token endpoints.

API Access Setup

settings_suggestFHIR SMART Configuration

Clients can retrieve SMART configuration details by invoking the SMART configuration endpoint at /.well-known/smart-configuration, appended to the FHIR Base URL.

vpn_key

The FHIR Base URL is provided upon successful App Registration approval.

key

Getting an Access Token

The DTR API uses SMART Backend Services (system-to-system) authorization. Authenticate with a signed JWT client_assertion, signed with the private key that matches the public key you registered. No secret is sent over the wire. Request the token with the client_credentials grant.

POSTToken Endpointhttps://sb.fhir.mhbapp.com/sof/oauth2/token

HTTP Headers

Header	Value
content-type	application/x-www-form-urlencoded
accept	application/json

HTTP Body

Parameter	Value
grant_type	client_credentials
scope	{scopes} (space-separated; only scopes approved for your registration)
client_assertion_type	urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion	{signed_jwt}

Client Assertion (JWT) Claims

Claim	Value
iss	{client_id}
sub	{client_id}
aud	https://sb.fhir.mhbapp.com/sof/oauth2/token
iat	Issue time (current time, in seconds since epoch)
exp	Expiry; keep it short, for example 5 minutes after `iat`
jti	Unique ID. Each assertion can be used once; a repeated `jti` is rejected.

info

Sign the JWT with the algorithm you selected at registration, and register the matching public key or JWKS. Use the returned access_token as the Bearer token on API requests. The sandbox also accepts client_id with client_secret for quick testing, but client_assertion is the recommended method.

terminal

Operations

The DTR API supports the following operations.

POST$questionnaire-packagehttps://sb.fhir.mhbapp.com/priorauth/api/v1/$questionnaire-package

dataset

Profiles

The DTR API supports the following profiles.

datasetDTR Questionnaire Package Input ParametersdatasetDTR Questionnaire Package Output ParametersdatasetDTR Questionnaire Package BundledatasetR4 QuestionnairedatasetDTR Questionnaire Response

http

Request Headers

All requests for DTR API profiles require the following headers:

Header	Value
content-type	application/json
accept	application/json
authorization	Bearer {access_token}

science

Sample Responses & Data

gpp_good

Important Information for EHR Systems

Topic	Reference
Privacy, Security and HIPAA	healthit.gov - Privacy, Security and HIPAA
ONC Model Privacy Notice	healthit.gov - Model Privacy Notice