Epic SMART Backend Services

The DenialOS FHIR runtime prepares a SMART Backend Services token request using:

• client_credentials grant;
• JWT bearer client assertion;
• connection-specific private-key binding reference;
• supported asymmetric signing algorithm;
• read-only FHIR scopes;
• issuer/subject equal to the registered client ID;
• token-endpoint audience;
• bounded five-minute assertion lifetime;
• unique JWT ID.

Private keys and access tokens do not enter the deterministic request object.

JWKS

DenialOS exposes public signing material through:

/.well-known/jwks.json

The endpoint publishes public key material only.

A deployed public URL is not implied by source code; DNS and deployment are external requirements.

External registration

Epic must register the application/client and its public key configuration before the runtime can perform a genuine sandbox exchange.