Acentra Health · Interoperability SolutionSandbox Environment

Da Vinci · Claim Submit

Prior Authorization Support (PAS)

Direct electronic submission and status tracking of prior authorization requests from EHR systems to payers using FHIR® format.

Implementation GuideDa Vinci PAS

VersionV 2.2.0-ballot (STU 2.2 Ballot)open_in_new

SecuritySMART on FHIR

Base Path/priorauth/api/v1

User GuidePDFpicture_as_pdf

send_to_mobile

Overview

The Prior Authorization Support (PAS) API is a FHIR®-based interoperability API that enables the direct electronic submission and management of prior authorization requests, including status checks, from EHR systems to payers.

It allows EHR systems to submit requests using FHIR® standards and receive payer responses in FHIR® format. Combined with Da Vinci CRD and DTR, PAS ensures requests are submitted only when necessary and include complete, relevant information on the first submission.

New to the PAS API? The PAS API user guide (PDF) opens in a new tab explains the submission and inquiry flows, including the pre-signed URL mechanism for attachments.

menu_book

User Guide

PAS API User Guide

Both flows in one guide. Submission: request, pre-signed URL mechanism, processing and responses to the EHR. Inquiry: request processing and responses. Also scopes, resources and headers.

PDF · 23 pages · 1.1 MB

open_in_newView Guide downloadDownload PDF

What’s inside

Submission FlowPre-signed URLsInquiry FlowSupported ScopesRequest Headers

fact_check

Capability Statement

Developers can access the Acentra Health FHIR server capabilities for the PAS API using the CapabilityStatement endpoint:

METAhttps://sb.fhir.mhbapp.com/priorauth/api/v1/metadata

View JSON

The CapabilityStatement describes the supported profiles, interactions, and authorization and token endpoints.

API Access Setup

settings_suggestFHIR SMART Configuration

Clients can retrieve SMART configuration details by invoking the SMART configuration endpoint at /.well-known/smart-configuration, appended to the FHIR Base URL.

vpn_key

The FHIR Base URL is provided upon successful App Registration approval.

key

Getting an Access Token

The PAS API uses SMART Backend Services (system-to-system) authorization. Authenticate with a signed JWT client_assertion, signed with the private key that matches the public key you registered. No secret is sent over the wire. Request the token with the client_credentials grant.

POSTToken Endpointhttps://sb.fhir.mhbapp.com/sof/oauth2/token

HTTP Headers

Header	Value
content-type	application/x-www-form-urlencoded
accept	application/json

HTTP Body

Parameter	Value
grant_type	client_credentials
scope	{scopes} (space-separated; only scopes approved for your registration)
client_assertion_type	urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion	{signed_jwt}

Client Assertion (JWT) Claims

Claim	Value
iss	{client_id}
sub	{client_id}
aud	https://sb.fhir.mhbapp.com/sof/oauth2/token
iat	Issue time (current time, in seconds since epoch)
exp	Expiry; keep it short, for example 5 minutes after `iat`
jti	Unique ID. Each assertion can be used once; a repeated `jti` is rejected.

info

Sign the JWT with the algorithm you selected at registration, and register the matching public key or JWKS. Use the returned access_token as the Bearer token on API requests. The sandbox also accepts client_id with client_secret for quick testing, but client_assertion is the recommended method.

terminal

Operations

The PAS API supports the following operations.

POST$submithttps://sb.fhir.mhbapp.com/priorauth/api/v1/Claim/$submit

POST$inquirehttps://sb.fhir.mhbapp.com/priorauth/api/v1/Claim/$inquire

attachment

For attachment submissions, the PAS API uses the PAS DocumentReference Profile, which requires document content to be provided as Base64-encoded data. Due to limitations imposed by the Acentra Health API Gateway, attachment payloads exceeding 10 MB are not supported through the PAS API. Documents or attachments larger than 10 MB must be submitted using the CDex API.

dataset

Profiles

The PAS API supports the following profiles.

datasetPAS Beneficiary PatientdatasetPAS ClaimdatasetPAS Claim ResponsedatasetPAS Communication RequestdatasetPAS CoveragedatasetPAS Device RequestdatasetPAS Document ReferencedatasetPAS Insurer OrganizationdatasetPAS Medication RequestdatasetPAS Nutrition OrderdatasetPAS PractitionerdatasetPAS PractitionerRoledatasetPAS Request BundledatasetPAS Response BundledatasetPAS Service RequestdatasetPAS Requestor Organization

http

Request Headers

All requests for PAS API profiles require the following headers:

Header	Value
content-type	application/json
accept	application/json
authorization	Bearer {access_token}

science

Sample Responses & Data

gpp_good

Important Information for EHR Systems

Topic	Reference
Privacy, Security and HIPAA	healthit.gov - Privacy, Security and HIPAA
ONC Model Privacy Notice	healthit.gov - Model Privacy Notice