Acentra Health · Interoperability SolutionSandbox Environment
Da Vinci · Electronic Prior Authorization

ePA Quick Start

From registration to your first prior authorization request: the order to follow, what each API does, and where to find the endpoints, guides and sample requests.

APIsCRD · DTR · PAS · CDex
SecuritySMART Backend Services
Base Path/priorauth/api/v1
route

Overview

Electronic prior authorization (ePA) uses four Da Vinci APIs that work as one flow. Register once for all of them, get one access token, then follow the steps below. Everything here runs against synthetic data in the sandbox.

app_registrationRegister Your EHR System
checklist

Before You Start

  1. Open App Registration, choose EHR Systems and select the Prior Authorization (ePA) Bundle. It selects CRD, DTR, PAS Submission, PAS Inquiry and CDex together.

  2. Provide the public key (JWKS URL or JWK Set) that matches the private key your system will sign with, and the signing algorithm.

  3. Verify your email with the token we send. Keep the Client ID from the confirmation screen.

  4. After approval, credentials and the FHIR Base URL are sent to your business email.

format_list_numbered

The Flow, Step by Step

  1. Get an Access Token

    Sign a short-lived JWT with your private key and exchange it at the token endpoint using the client_credentials grant. Use the returned access_token as the Bearer token on every call below.

    Token Request and JWT Claims

  2. CRD: Ask Whether Prior Authorization Is Needed

    When a clinician books, orders or signs, your EHR calls the matching CDS Hook. The payer replies with cards describing coverage requirements and whether documentation or authorization is needed.

    CRD Hooks and EndpointsCRD Sample QueriesCRD User Guide (PDF)

  3. DTR: Collect the Required Documentation

    Retrieve the payer’s questionnaire package and rules with $questionnaire-package, then complete the questionnaire from the patient record.

    DTR OperationsDTR Sample QueriesDTR User Guide (PDF)

  4. PAS: Submit the Request

    Send the prior authorization request with Claim/$submit and receive the payer’s response. Large attachments use the pre-signed URL mechanism described in the guide.

    PAS OperationsPAS Sample QueriesPAS User Guide (PDF)

  5. PAS Inquiry: Check the Status

    Ask for the current status of a request you already submitted with Claim/$inquire.

    PAS Operations

  6. CDex: Send Supporting Clinical Data

    Proactively send clinical documents to the payer. Synthetic PAS requests give you a PA tracking ID you can use for CDex interactions; no separate CDex test data is provided.

    CDex OperationsCDex User Guide (PDF)
build

Token Troubleshooting

Typical messages when the token request is rejected, and what to change.

MessageWhat to Do
iss/sub must match client_idSet both iss and sub to your Client ID exactly as issued.
aud claim mismatchSet aud to the token endpoint URL shown on the API pages, character for character.
Assertion has expired / iat is in the futureCreate a new assertion for every request, keep exp short, and sync your server clock (NTP). About a minute of clock drift is tolerated.
Duplicate jti detectedEvery assertion needs a new unique jti; never reuse a JWT.
JWT algorithm is not allowedSign with the algorithm you registered. Contact support if you need to change it.
Invalid assertion signature / Unable to verify assertion signatureThe public key or JWKS you registered must match the private key you sign with. Re-check the key and its kid.
Requested scope is not allowedRequest only the scopes approved for your registration. To add APIs, register again with your Client ID.
Missing client_assertion_typeSend client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer together with client_assertion.

Still stuck? Email fhir-support@acentra.com with your Client ID and the time of the request. Never send your private key.

check