UCSF Health

If an endpoint's access token is refreshable, the Token Refresh API can be used to issue a new access token prior to the refresh token expiring. Otherwise, if the access token is non-refreshable, the user is required to re-authorize the application after the access token expires.

This is the payer imposed upper bound on the time period for which a user can keep refreshing an access token. Once the maximum authorization period has elapsed, the user is required to re-authorize the application.

If an endpoint deviates from the standard authorization flow and custom settings are required. These customizations vary from custom parameters in the authorization or token endpoints, to custom locations for retrieving the patient ID.