FHIR R4 in an afternoon.

Sandbox · instant access

Get a read-only sandbox token in seconds. The sandbox serves 200 real provider records drawn from CMS data. Production keys require a pilot agreement and optionally a BAA.

Quickstart · 60 seconds

One request to verify a provider.

Pass an NPI in the identifier parameter. The response is a valid FHIR R4 Practitioner bundle with row-level provenance on meta.tag.

curl https://fonteum.com/api/fhir/r4/Practitioner?identifier=1234567890 \
  -H "Authorization: Bearer $FONTEUM_API_KEY" \
  -H "Accept: application/fhir+json"

Capability statement

US Core 6.1.0. Five resources. One endpoint.

The CapabilityStatement at /api/fhir/r4/metadata declares all supported interactions, search parameters, and conformance profiles. Every resource is tagged with a 14-tuple provenance block on meta.tag.

Auth flow

SMART on FHIR backend services. No redirect required.

Server-to-server apps use the SMART Backend Services profile. No user login, no OAuth redirect flow. Generate a JWT signed with your RS384 private key and post it to the token endpoint.

# 1. Build the client assertion JWT (RS384)
{
  "iss": "<client_id>",
  "sub": "<client_id>",
  "aud": "https://fonteum.com/api/fhir/r4/token",
  "exp": <unix_timestamp + 300>,
  "jti": "<unique_id>"
}

# 2. Exchange for an access token
curl -X POST https://fonteum.com/api/fhir/r4/token \
  -d "grant_type=client_credentials" \
  -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
  -d "client_assertion=<signed_jwt>" \
  -d "scope=system/Practitioner.read"

Webhook subscriptions

Get notified when a provider record changes.

FHIR R4 Subscription resources let you register a channel and receive a ping whenever a Practitioner or Organization resource changes. The notification payload carries the updated resource and the provenance delta. Available to pilot customers — ask at press@fonteum.com.

Status & SLA

p99 under 300 ms. Daily source refresh.

SLA applies to pilot and production tiers. Latency is measured at the API gateway. Source data refresh lag is separately tracked at /freshness.