FAQ

Any authorized representative of a company can register a company account. The representative should have the authority to act on behalf of the company.

Company Information:

• Company Legal Name:
• Company Email Domain:
• Company ID/EIN:
• Company Address:
• Phone:
• Company Website:
• Customer Service Email:
• Customer Service Phone:

Primary Contact Information:

• Name:
• Company Email: Official company email address of the primary contact, using the company email domain.
• Company Phone Number:
• Designation:

Secondary Contact Information:

• Name:
• Company Email: Official company email address of the secondary contact, using the company email domain.
• Company Phone Number:
• Designation:

Account Email:
An email address matching the company email domain, used to log in to the API Marketplace. A distribution list (DL) is recommended for continuity of access and account management.

The point of contact for customer service should be a support email distribution list (DL) that includes the email addresses of technical personnel. In addition, a primary authorized individual should be identified who can provide the technical support email address and phone number for any technical conversations between CareFirst and the company. This setup ensures that all technical inquiries are handled efficiently and by the appropriate personnel.

The company email domain is essential for account registration for several reasons. We use the company email domain to ensure that all business communication is conducted using this domain and not personal email addresses such as Gmail, Yahoo, etc. All email addresses are validated to use this domain.

To register as a developer with the CareFirst API Marketplace, click the "Register" link in the top menu of this portal. You will be asked to provide your email address, phone number, and other required details during registration. After completing the process, you can log in and access developer features on the portal. See the Register as a Developer section in Documentation for more information.

Learn more about the registration process.

There could be several reasons why you are not receiving a verification code through the email distribution list (DL):

• Email filtering: The email containing the verification code might be filtered out by your email system's spam or junk filters. Ensure that the email address sending the verification code is added to your safe sender list.
• DL configuration: The distribution list might not be configured to receive external emails. Check with your IT department to ensure that the DL is set up to accept emails from external sources.
• Email address validation: Ensure that all email addresses in the DL are validated and correctly configured to receive emails. Sometimes, issues with individual email addresses within the DL can cause delivery failures.

If you continue to experience issues, it might be helpful to contact your IT support team for further assistance.

Once you have registered as a developer, you will be able to browse the API Catalog for a list of APIs available to you. You can create applications in the Manage Applications section to subscribe to those APIs and view credentials for each application within the Manage Applications page for the respective environment. See the application registration and credential management sections in Documentation.

See the Register Your Application section in Documentation.

To request API credentials, log in to the API Marketplace and go to the Manage Applications section. Create a new application and add the respective APIs to your application. Once your application is approved, you can get the credentials by clicking "Manage Credentials" to view your subscription key, client ID, and secret. Credentials are only usable after your application is approved.

CareFirst supports five core interoperability APIs:

APIs introduced under CMS-9115-F:

• Patient Access API
• Provider Directory API
• Payer-to-Payer API

APIs introduced under CMS-0057-F:

• Provider Access API
• Prior Authorization API

Note: CMS-0057-F expands the Patient Access and Payer-to-Payer APIs to include certain prior authorization information, where applicable to the plan. Plans marked with an asterisk (*) in the CMS API availability matrix are limited to CMS-9115-F requirements; the CMS-0057-F enhancements do not apply to those plans.

There are various APIs that your application can subscribe to. To view the available APIs, please visit the API Catalog page after logging in.

To get your application approved, you need to submit a request through the Contact Us form with the subject "Application Approval Request."

Interop 1.0 uses line-of-business (LOB)-specific endpoints and continues to be supported. Interop 2.0 uses shared environment hosts and is documented as available after January 1, 2027. These are platform version labels, not FHIR release labels, and do not mean every API is available to every plan.

No. Availability depends on the API, line of business, applicable mandate, and documented limitations. Consult the CMS and BCBSA API availability matrices for applicability: Yes indicates applicability for the listed API and LOB, subject to limitations; NA means not applicable.

CMS-9115-F and CMS-0057-F define federal interoperability requirements. CareFirst documents BCBSA Inter-Plan Program (IPP) availability separately for Provider Access and Prior Authorization across additional LOBs.

See the Base URL section in Documentation for interoperable API hosts, paths, and OAuth Authorization Code endpoints. For client credentials gateway configuration, see the External Developers or Internal Developers section under Non-Interoperable APIs. Select the appropriate environment and LOB, and do not mix sandbox and production settings.

See the Sandbox Test Credentials section in Documentation. These test-user credentials are for member sign-in during sandbox testing, not your application's client ID or secret, and are not production member accounts.

No. The matrix describes plan applicability, not application approval. For APIs requiring authorization, complete the applicable application onboarding, API subscription, approval, and credential requirements. The Provider Directory API is public and does not require member authorization.

The Patient Access API enables authorized third-party applications to access healthcare information on behalf of a CareFirst member who has granted permission.

Available data (subject to applicable regulatory requirements) may include:

• Claims and encounters
• Coverage information
• Clinical data
• Care team information
• Formulary information
• Prior authorization information

The Patient Access API aligns with applicable CARIN Blue Button, US Core, and PDex implementation guides.

The Provider Directory API provides access to CareFirst provider network information using FHIR-based standards.

No. The Provider Directory API is publicly accessible and does not require member authorization.

The Provider Directory API aligns with the HL7 Da Vinci Plan-Net Implementation Guide.

The Payer-to-Payer API supports the exchange of member healthcare information between health plans using standards-based interoperability frameworks.

The Payer-to-Payer API aligns with applicable HL7 PDex Payer-to-Payer implementation guidance.

The API is intended for authorized payer organizations that have completed CareFirst onboarding and approval requirements.

The Provider Access API enables authorized provider organizations to access patient information maintained by CareFirst for treatment, care coordination, and healthcare operations as permitted by applicable regulations.

The Provider Access API is intended for contracted CareFirst providers, including provider organizations, health systems, EHR vendors, and other authorized healthcare technology partners approved by CareFirst.

Available data (subject to applicable regulatory requirements) may include:

• Claims and encounter data
• Clinical information
• Care team information
• Prior authorization information

The Prior Authorization API supports electronic prior authorization workflows using industry-standard FHIR-based APIs.

Supported capabilities may include:

• Prior authorization request submission
• Prior authorization status inquiry
• Prior authorization determination retrieval

CareFirst's Prior Authorization API strategy aligns with applicable HL7 Da Vinci implementation guides, including:

• Coverage Requirements Discovery (CRD)
• Documentation Templates and Rules (DTR)
• Prior Authorization Support (PAS)

Supported attachment capabilities, formats, and submission requirements are documented within the Prior Authorization API specifications.

CRD discovers coverage and prior authorization requirements. DTR collects required documentation through questionnaires and rules. PAS submits and queries prior authorization requests. Subscription and Notification (SN) provides subscription notifications when a request's status changes. Consult the published API contract for supported operations and access requirements; availability is not universal.

To register your Brokerage Agency company account, you should choose the "Healthcare Broker Developer" option. This type is appropriate if your main focus is on health insurance brokerage services, as it enables you to manage and integrate various brokerage-related functionalities seamlessly.

If you are not getting the necessary response, please send an email to DeveloperPortalSupport@carefirst.com with details about your concern.

You can find more information about CareFirst BlueCross BlueShield on the official website: www.carefirst.com