Connect

Two layers of permission. Your credentials say who you are; each practice separately decides what you may do for them.

#Get a token

bash

curl -X POST https://app.priorauth.in/api/oauth/token \
  -H "content-type: application/x-www-form-urlencoded" \
  -d grant_type=client_credentials \
  -d client_id=$PRIORAUTH_CLIENT_ID \
  -d client_secret=$PRIORAUTH_CLIENT_SECRET

json

{ "access_token": "...", "token_type": "Bearer", "expires_in": 3600 }

Re-mint on expiry, do not cache indefinitely

A 401 mid-session usually means the token aged out, not that your credentials are wrong. Mint a new one with a margin rather than on failure.

#Naming the practice

Every request names the practice it is for. Your credentials do not imply one, and there is no default.

json

{ "practiceId": "p_north", "skill": "prior_auth_intake", "...": "..." }

A practice you have not been authorised for is refused, and the refusal does not distinguish "that practice does not exist" from "you cannot reach it". Both answer identically, because the difference would tell you who our customers are.

#Scopes are granted per practice

A practice grants specific scopes when it connects you. You get what it granted and nothing else, checked on every call rather than at connection time.

Scope	Lets you
`encounters:read`	See scheduled procedures that may need authorization.
`priorauth:submit`	Start an authorization task. Still subject to the human release.
`priorauth:read`	Read the status and outcome of tasks you started.
`tasks:write`	Raise a task in the practice worklist.
`eligibility:check`	Ask a payer whether a procedure needs authorization for a member.

A practice can revoke you at any time

Without telling us first, and without leaving the platform. Handle a sudden practice_not_connected gracefully - it is a customer decision, not an outage, and retrying will not fix it.

#Discovering what we can do

The agent card describes our capabilities in a machine-readable form. Fetch it rather than hard-coding a skill list.

bash

curl -H "authorization: Bearer $TOKEN" https://app.priorauth.in/api/agent-card