Introduction
The CareFirst API Platform is following industry-standard protocols to expose CareFirst API(s) using the REST/JSON and OAuth 2.0 security protocols. API stands for Application Programming Interface, which is a software intermediary that allows two applications to talk to each other.
Developers need to register their application in the sandbox to start building and testing their application. Once the application is tested in the sandbox with non-production data, the developer can promote the configuration to production and request approval. CareFirst will approve the application to connect to the production environment.
CareFirst has multiple plans like CHPCDC, CHPMD, etc. Documentation and API(s) use lines of businesses (LOB) terms. Please refer to the additional information section for more details.
API Security
CareFirst APIs are secured using the OAuth 2.0 security protocol, which is the industry-standard for applications to integrate APIs. OAuth 2.0 is an authorization framework that allows applications to obtain limited access to user information via APIs.
Additionally, all consumer applications must include an HTTP header (x-api-subscription-key) with a valid subscription key assigned to their application.
OAuth 2.0 Protocol
CareFirst uses OAuth 2.0 protocols for authentication since APIs exchange members' protected health information with third-party applications upon authorization from the member. To access CareFirst's APIs in the sandbox, your application needs to use the Authorization Code grant type.
OAuth Grant Types
Authorization Code
The Authorization Code grant type is used by web and mobile apps. It is used by both web apps and native apps to obtain an access token after a user authorizes an application. Below are very high-level steps:
- The application opens a browser to send the user to the OAuth server.
- The user authenticates and grants the application access.
- The user is redirected back to the application with an authorization code.
- The application requests an access token from the OAuth server by presenting the authorization code.
Client Credentials
This flow is useful when the party that requires access to an API is a machine. This is a machine-to-machine authorization flow. In this case, the client is the resource owner, and no end-user authorization is required. An example is a CRON job as a client calling an API to do some function.
Register as a Developer
Developers can register themselves in the API Marketplace as either an Individual Developer or a Company Developer. Company registration includes various types of healthcare organizations such as payers, brokers, and partners.
Note: This registration process is only for external developers. If you are an Internal CareFirst Developer, you can access the API Marketplace directly using Single Sign-On (SSO) with your CareFirst credentials.
Company Registration
At the top-right corner of the API Marketplace click the Register button. This will redirect you to the registration page, where you'll need to select the appropriate developer type from the options below:
- Healthcare Payer Developer
- Healthcare Broker Developer
- Healthcare Partner Developer
Developers or technical account representatives from external health insurance payers who seek to integrate their applications to transfer patient data from CareFirst in order to comply with the Payer-to-Payer Data Exchange CMS Interoperability Final Rule.
Developers or technical account representatives from external health insurance brokerage agencies, such as Full-Service Producers (FSP), who aim to integrate their applications with CareFirst APIs to meet their business needs using CareFirst APIs.
Developers or technical account representatives from CareFirst external partners with business agreements, excluding payers or brokers.
Step 2: Company Information
After selecting a developer type, you will be redirected to the Company Information page. A multi-step form will appear, and you must complete all required fields to successfully register.
Required Fields:
- Company Legal Name*
- Company Email Domain*
- Employer Identification Number*
Example: CareTech Solutions
Enter the legal name of your company or organization.
Example: Caretechsolutions.com
Enter the official email domain used by your organization (e.g., the part after @ in your company email addresses).
Example: 12-3456789
Enter your organization's valid EIN. This is used for verification and compliance purposes.
Consent Checkbox
Select the checkbox to agree to the following:
You and your entity agree to abide by all HIPAA rules (Health Insurance Portability and Accountability Act of 1996 (HIPAA) | CDC) and to the extent the requested data could include substance abuse patient records, applicable provisions of 42 CFR Part 2. By completing and submitting the registration, you are hereby affirming that you are doing so on behalf of a HIPAA Covered Entity.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 3: Company Address
In this step, provide the following required information to define your organization's physical location and contact details. This information helps us verify your identity and ensure secure interaction with our APIs.
Required Fields:
- Street Address*
- Suite#
- State*
- City*
- Zip Code*
- Phone*
- Website Url*
Example: 1234 Innovation Drive
Enter the street address of your company's primary office location.
Example: Suite 500
Enter the suite, unit, or floor number if applicable. Leave blank if not applicable.
Example: MD
Enter the state or province.
Example: Baltimore
Enter the city where your company is located.
Example: 21201
Enter the ZIP or postal code for your company's address.
Example: +1 (410) 555-1234
Enter a valid business phone number. This may be used for verification or support purposes.
Example: https://www.caretechsolutions.com
Enter your company's official website URL.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 4: Customer Service Information
In this step, provide the contact details for your customer service team. This information will be used by CareFirst to communicate important updates and provide support related to your application:
Required Fields:
- Customer Service Email
- Customer Service Phone
Example: support@caretechsolutions.com
Enter the email address where your team will receive important notifications, updates, and support-related inquiries regarding your application.
Example: +1 (800) 555-1234
Provide a U.S.-based phone number that our support team can use to contact your application's primary support representative.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 5: Primary Contact Information
In this step, provide the details of the primary point of contact for your organization. This individual will be responsible for managing communication and coordination related to your application.
Required Fields:
- First Name*
- Last Name*
- Company Email Address*
- Company Phone Number*
- Designation*
Example: John
Enter the first name of the primary contact person.
Example: Doe
Enter the last name of the primary contact person.
Example: john.doe@caretechsolutions.com
Enter the official company email address of the primary contact. This will be used for all formal communications.
Example: +1 (410) 555-7890
Provide a direct phone number where the primary contact can be reached during business hours.
Example: CIO / Director / Manager / VP
Select the appropriate job title or role of the primary contact from the available options.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 6: Secondary Contact Information
In this step, provide the details of the Secondary point of contact for your organization. This individual will be responsible for managing communication and coordination related to your application.
Required Fields:
- First Name*
- Last Name*
- Company Email Address*
- Company Phone Number*
- Designation*
Example: Tony
Enter the first name of the secondary contact person.
Example: Brave
Enter the last name of the secondary contact person.
Example: tony.brave@caretechsolutions.com
Enter the official company email address of the secondary contact. This will be used for all formal communications.
Example: +1 (410) 555-7890
Provide a direct phone number where the secondary contact can be reached during business hours.
Example: CIO / Director / Manager / VP
Select the appropriate job title or role of the primary contact from the available options.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 7: Account Email Information
Note: This is the email address that will be used to authenticate to the system.
In this step, provide the account email address that will be used to log in and access the API Marketplace. This email will also receive system notifications and authentication-related communications.
Required Fields:
- Account Email Address*
Example: tony.stark@caretechsolutions.com
Enter the official email address that will serve as the login credential for accessing the system.
Note: The account email must match the company email domain provided in Step 2. We recommend using a distribution list (DL) rather than a personal email address to ensure continuity of access and proper account management.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 8: Confirm Email Address
A 6-digit security code has been sent to your email. Please check your messages and enter the code below.
Note: The code will expire after 3 minutes or if you request a new one.
This step ensures that the email address provided is valid and accessible, as it will be used for authentication and important system communications.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
You may also click the Resend OTP button if you did not receive the code, and the Verify button to confirm the entered code.
Step 9: Set Password
In this step, you will create a secure password for your account. This password, along with your registered email address, will be used to log in to the API Marketplace.
Required Fields:
- Password*:
- Set Password*
Example: P@ssw0rd!23
Create a strong password that meets security requirements. It should include a combination of uppercase and lowercase letters, numbers, and special characters.
Example: P@ssw0rd!23
Re-enter the same password to confirm it matches. This ensures there are no typos or mismatches.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 10: Terms of Use
Required Fields:
In this step, you are required to review and accept the Terms of Use before completing your registration.
These Terms of Use (Agreement) apply to your use of any CareFirst materials or services for which you have been or may be granted access.
CareFirst Developer Account Enrollment.
You agree to provide and maintain accurate contact information with CareFirst. You represent and warrant that: (i) all information you have provided and will provide to CareFirst is true, correct and complete in all respects and you will promptly notify CareFirst of any changes to such information; (ii) you are at least 18 years of age and have the legal right, power, and authority to accept the terms and conditions of this Agreement on behalf of yourself and on behalf of any company that you represent and (iii) any materials you provide, create or develop related to this Agreement do not and will not infringe any Intellectual Property Rights of any third party; and (iv) you are not a Restricted Person.
Select the checkbox to confirm your agreement and click the Submit button to proceed to the confirmation page.
To return to the previous page, click the Back button.
After clicking the Submit button, the user will be redirected to a confirmation page.
Company accounts require CareFirst team approval before use. You cannot log in until your account is reviewed and activated. You will receive an email notification once approved.
Access the Registration Page - Individual Registration
Click the Register button located at the top-right corner of the API Marketplace. You will be redirected to the registration page, where you must select the appropriate developer type from the option below:
- Healthcare Individual Developer
Developers or technical account representatives from external health insurance entities who seek to innovate the healthcare industry by creating applications that allow patients to access their data from CareFirst.
Step 1: Developer Information
After selecting a developer type, you will be redirected to the Developer Information page. A multi-step form will appear, and you must complete all required fields to proceed with registration.
In this step, provide the details of the primary point of contact for your organization. This individual will be responsible for managing communication and coordination related to your application.
Required Fields:
- First Name*
- Last Name*
- Account Email*
- From Company*
- Phone Number*
Example: John
Enter the first name of the contact person.
Example: Doe
Enter the last name of the contact person.
Example: john.doe@caretechsolutions.com
Enter the official email address of the contact. This will be used for all formal communications.
Example: CareTech Solutions
Enter the name of the company or organization the primary contact represents.
Example: +1 (410) 555-7890
Provide a direct phone number where the primary contact can be reached during business hours.
Select the checkbox to agree to the following:
By providing my wireless phone number, I agree and acknowledge that CareFirst may send text messages to my wireless phone number for OTP Authentication. Message and data rates may apply.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 2: Confirm Phone Number
This step ensures that the phone number provided is valid and accessible, as it will be used for authentication and important system communications.
A 6-digit security code has been sent to your email.
Please check your messages and enter the code below.
Note: The code will expire after 3 minutes or if you request a new one.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
You may also click the Resend OTP button if you did not receive the code, and the Verify button to confirm the entered code.
Step 3: Confirm Email Address
A 6-digit security code has been sent to your email.
Please check your messages and enter the code below.
Note: The code will expire after 3 minutes or if you request a new one.
This step ensures that the email address provided is valid and accessible, as it will be used for authentication and important system communications.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
You may also click the Resend OTP button if you did not receive the code, and the Verify button to confirm the entered code.
Step 4: Set Password
In this step, you will create a secure password for your account. This password, along with your registered email address, will be used to log in to the API Marketplace.
Required Fields:
- Password*:
- Set Password*
Example: P@ssw0rd!23
Create a strong password that meets security requirements. It should include a combination of uppercase and lowercase letters, numbers, and special characters.
Example: P@ssw0rd!23
Re-enter the same password to confirm it matches. This ensures there are no typos or mismatches.
Once all fields are completed, click the Next button to proceed to the next step.
To return to the previous page, click the Back button.
Step 5: Terms of Use
Required Fields:
In this step, you are required to review and accept the Terms of Use before completing your registration.
These Terms of Use (Agreement) apply to your use of any CareFirst materials or services for which you have been or may be granted access.
Select the checkbox to confirm your agreement and click the Submit button to proceed to the confirmation page.
To return to the previous page, click the Back button.
After clicking the Submit button, the user will be redirected to a confirmation page.
Login as a Developer
Click on the Log In button from the Menu bar.
Enter your registered email address and click Continue.
You will receive an OTP (One-Time Password) code sent to your account email. Enter this OTP code and click Verify.
Upon successful OTP verification, you will be prompted to enter your password.
After entering your password, you will be logged in as a developer and can access the API Marketplace.
Note: If you don't receive the code, please check your spam folder or request a new one.
Register Your Application
Follow the steps below to register a new application in the API Marketplace.
Step 1: Accessing the API Marketplace
To begin the application registration process, the user must log in as either an External Developer or an Internal Developer.
Once logged in, navigate to My Workspace, located at the top-right corner of the portal. Under My Workspace, select the Manage Application option.
Clicking on Manage Application will redirect the user to the application management page. On this page, at the bottom, the user will find a New App Registration button. Clicking this button initiates the creation of a new application.
Step 2: After clicking New App Registration, a multi-step form will appear. The user must complete all steps to successfully register the application.
Completing the Registration Form.
Application Details
In this step, provide the following required information:
- Application Component Name
- Application Component Description
- Business Purpose*
- Application URL*
- Outbound IPs
- Attestation Certificates URL
- App Logo URL
- Privacy Policy URL
- Terms of Use URL
Example: CFClaimsViewer
Enter the display name of the application component.
Example: A web-based tool for viewing and managing healthcare claims data.
Provide a detailed description of the application component.
Example: This application allows providers to access CareFirst APIs to retrieve patient claims data for billing and reconciliation.
Clearly explain the business purpose and use case for the application. Include why access to CareFirst APIs is required and how the application will utilize them.
Example (External): https://example.com
Example (Internal): https://www.carefirst.com
Provide the primary URL where the application is hosted. This should be the main address users will visit to access the application.
Note: For internal users, use https://www.carefirst.com as a placeholder if an external-facing URL is not applicable.
Example: 192.168.1.10, 192.168.1.11
List the public outbound IP addresses that the application will use to connect to CareFirst APIs. These IPs are required for whitelisting if the application operates outside the CareFirst network.
Example: https://example.com/certs
Provide the URL where the application's attestation certificates can be accessed.
Example: https://example.com/logo.png
Provide the URL for the application's logo.
Example: https://example.com/privacy
Enter link to the application's privacy policy.
Example: https://example.com/terms
Enter link to the application's terms of use.
Once all fields are completed, click the Continue button to proceed to the next step.
Step 3: Security Scheme
In this step, provide the following required information to define how your application will securely interact with our APIs:
- Client App Security Type
- Application Type
- System-to-System Apps - Designed for server-to-server communication.
- Server-based Web Apps - Applications that run on your server with backend logic.
- SPA Apps - Single-page applications that run entirely in the browser.
- Response Type
Example: OAuth 2.0
Select the authentication method your application will use. We recommend OAuth 2.0
for most applications, as it offers enterprise-grade security and is the standard
protocol supported by our platform.
If you select OAuth 2.0, additional fields such as Application Type and Response
Type will appear.
Alternatively, you may choose API Key authentication.
Note: API Key authentication is limited to a small set of low-risk APIs and requires explicit approval. Due to the manual approval process, API Key requests may take longer to process.
Example: Server-based Web App
Choose the type of application you are building:
Example: code
This field will appear based on your selected authentication method.
Once all fields are completed, click the Continue button to proceed to the next step.
Step 4: Support Contact Information
In this step, provide the following contact details to ensure proper communication and support:
- Support Distribution Email
- US Support Contact Phone Number
Example:support@example.com
Enter the email address that will receive notifications and important updates related to your application. Additionally, this email will be used to communicate credential and certification expiration/renewal notices.
Example:+1 (800) 555-1234
Provide a U.S.-based phone number where our support team can reach the primary contact for your application.
Once all fields are completed, click the Continue button to proceed.
Step 5: Review and Submit
Carefully review all the information you've entered throughout the registration process.
- To make changes, use the Back button.
- If everything is accurate, click Submit to complete the registration.
Step 6: Confirmation
After submission, a confirmation message will appear indicating that your application registration is complete.
If an error occurs, please contact Customer Support for assistance.
Post-Approval Access
Once your application is approved for the specified API(s), it will be available for testing and development.
- External Developers will have access to the Sandbox environment.
- Internal Developers will see all available environments, including deva, sita, uat, pit, and prod.
Important:
After successfully creating an application, users must add the required APIs by
navigating to Manage APIs.
Creating an application alone is not
sufficient—APIs must be explicitly added to enable functionality.
View Application
After successfully creating an application, users will see several options under Action Items.
On the View Application page, users can:
- View the application details along with the associated APIs.
- Access the Promote Application button, located at the bottom of the page.
If the user wishes to promote the application to a higher environment, they can do so from this page.
- If the application has not yet been Promoted to the target environment, both the application and its associated APIs will be deployed.
- If the application is already promoted, only the APIs will be deployed.
Edit Application
After registration, users can update specific fields using the Edit Application option. This allows for modifications to selected values without needing to recreate the application.
Manage Credentials
This page allows users to manage their credentials.
When renewing credentials, always ensure your applications are using the alternate key before proceeding to avoid service interruption. Renew keys regularly and immediately if compromised.
Primary Credential
- Primary Subscription Key
- Client ID
- Primary Client Secret
- Expiring On
- Scope
Example: sub-key-abc123xyz
Users can toggle the visibility of the Primary Subscription Key using the eye icon in the field. A Renew button is available on the right side, allowing users to renew the key.
Example: client-id-987654321
Users can toggle the visibility of the Client ID using the eye icon in the field.
Example: secret-key-xyz987abc
Users can toggle the visibility of the Primary Client Secret using the eye icon in the field. A Renew button is available on the right side, allowing users to renew the secret.
Example: 2025-12-31
Displays the expiration date of the Primary Client Secret.
Example:scope value
Displays the scope value associated with the credentials.
Secondary Credential
- Secondary Subscription Key
- Client ID
- Secondary Client Secret
- Expiring On
- Scope
Example: sub-key-abc123xyz
Users can toggle the visibility of the Primary Subscription Key using the eye icon in the field. A Renew button is available on the right side, allowing users to renew the key.
Example: client-id-987654321
Users can toggle the visibility of the Client ID using the eye icon in the field.
Example: secret-key-xyz987abc
Users can toggle the visibility of the Secondary Client Secret using the eye icon in the field. A Renew button is available on the right side, allowing users to renew the secret.
Example: 2025-12-31
Displays the expiration date of the Secondary Client Secret.
Example:scope value
Displays the scope value associated with the credentials.
Manage API(s)
This page allows users to view and manage all available APIs.
At the bottom of the page, users will find an Add/Remove API(s) button. Clicking this button redirects the user to another page where they can add or remove APIs for a specific application.
On the redirected page, users can utilize filter options such as Filter By and API Type to narrow down the list of APIs based on their preferences.
- Filter By
- API Type
Example: API Name, Environment, Status
Example: FHIR, REST, GraphQL
Application Approval Process
To get your application approved, you need to submit a request through the Contact Us form with the subject "Application Approval Request."
Invoking APIs Using Authorization Code Grant Type
Once your application has been registered, approved in the sandbox, and you have received valid credentials, you can utilize the Authorization code grant type to access the APIs through your application or tools such as Postman. It's important to conduct comprehensive testing in the sandbox environment before promoting your application to production.
Please refer to the additional information section for more details about different endpoints and test data with respect to different lines of business or plans.
Getting an Authorization Code
Authorization URI example. Please refer to the additional information section for LOB/plan specific endpoints.
The following parameter values need to be changed:
- Replace {{LOB}} with the LOB name you plan to test. Please refer to the additional information section for the LOB name.
- Replace {{client_id}} with your application client ID.
- redirect_uri
- scopes
- state
- aud
On a successful call, you should have the authorization code in your redirect URI.
Getting an Access Token
After receiving the application credentials and the authorization code, send a POST request against the Access Token endpoint using the URL, headers, and body content below. Please refer to the additional information section for LOB/plan specific endpoints.
URL
POST https://idp-pit.carefirst.com/fhir-oauth2/pub/{{lob}}/token
Headers
| content-type | application/json |
| accept | application/json |
| authorization | Basic base64{your_client_id}:{your_client_secret} |
Body
| code | {oauth code} |
| grant_type | "authorization_code" |
| redirect_uri | {your_redirect_uri} |
Using an access token to call Patient API
Please refer to the additional information section for LOB/plan specific endpoints.
Sample Request
curl --location --request GET 'https://chpdc-apix-pit.carefirst.com/extfhirpatientaccess/v1/Patient/62f4fdda-3bf5-3de1-9a27-cc6b64c75fb8' \
--header 'Authorization: Bearer {{Access Token}}'
{
"resourceType": "Patient",
"id": "62f4fdda-3bf5-3de1-9a27-cc6b64c75fb8",
"meta": {
"versionId": "1",
"lastUpdated": "2021-11-03T11:35:51.384+00:00",
"profile": [
"http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Patient",
"http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Patient|1.1.0"
]
},
"extension": [
{
"url": "https://carefirst.com/internal/last_updated_date",
"valueId": "2021-11-01"
},
{
"url": "https://carefirst.com/internal/row_id",
"valueId": "488024"
},
{
"url": "https://carefirst.com/internal/source_id",
"valueId": "MEDCAIDDC"
}
],
"identifier": [
{
"type":
{
"coding": [
{
"system": "http://terminology.hl7.org/CodeSystem/v2-0203",
"code": "MB"
}
]
},
"system": "https://carefirst.com/internal/CF_MEMBER_LIFE_ID",
"value": "15675098"
},
{
"system": "https://carefirst.com/internal/lob",
"value": "CHPDC"
},
{
"system": "https://carefirst.com/internal/group",
"value": "1000"
},
{
"system": "https://carefirst.com/internal/plan",
"value": "DCM"
}
],
"name": [
{
"family": "Jaschuh",
"given":
"Wn"
]
}
],
"gender": "male",
"birthDate": "1961-00-00",
"address":
[
{
"city": "WASHINGTON",
"state": "DC",
"postalCode": "20019",
"period":
{
"start": "2021-10-28",
"end": "9999-12-31"
}
}
]
}
Invoking APIs Using Client Credentials Grant Type
Once your application has been registered, approved in the sandbox, and you have received valid credentials, you can utilize the Client Credentials grant type to access the APIs through your application or tools such as Postman. It's important to conduct comprehensive testing in the sandbox environment before promoting your application to production.
Getting an access token
Once you have received the application credentials, please proceed to send an HTTP POST request to the access token endpoint. Ensure to include the specified parameters in the HTTP body.
| Environment | Token Endpoint | Scope |
|---|---|---|
| Sandbox | https://api-pit.carefirst.com/token/v2 | fb0bbf9f-9a04-46ce-a473-027706c2e37d/.default |
| Production | https://api.carefirst.com/token/v2 | 6e6bd3b4-6922-4d5b-b852-a5ff09bda986/.default |
Headers
| content-type | application/x-www-form-urlencoded |
| x-api-subscription-key | {your_subscription_key} |
Body
| client_id | {your_client_id} |
| grant_type | "client_credentials" |
| client_secret | {your_client_secret} |
| scope | {Refer to the above scope table} |
Get the Application Ready for Production
Before moving to production, ensure your application has been thoroughly tested in the sandbox environment with all required APIs and functionality.
Once testing is complete, you can promote your application to production by following the steps outlined in the Promote application to production section.
After successful promotion and CareFirst approval, you can begin calling CareFirst APIs in the production environment using your production credentials.
Important: Production APIs handle live data and require proper approval before access is granted. Make sure your application meets all security and compliance requirements.
Additional Information
This section provides comprehensive information about CareFirst APIs, organized into two categories:
Interoperable APIs
CareFirst Line of Businesses implementing CMS Interoperability mandate
| LOB | LOB Name |
| CHPDC | CareFirst BlueCross BlueShield Community Health Plan District of Columbia (aka DC Medicaid) |
| CHPMD | CareFirst BlueCross BlueShield Community Health Plan Maryland (aka MD Medicaid) |
| DSNP | CareFirst BlueCross Blue Shield Medicare Advantage Dual Prime (aka MD DSNP) |
| MAPD | CareFirst BlueCross Blue Shield Medicare Advantage |
| MHBE | Maryland Health Benefits Exchange |
| EGWP | Employer Group Waiver Plan |
CMS Interoperability mandate API(s) implemented by LOB(s)
| LOB | Patient Access | Provider Directory | Payer Access |
| CHPDC | YES | YES | YES |
| CHPMD | YES | YES | YES |
| DSNP | YES | YES | YES |
| MAPD | YES | YES | YES |
| MHBE | YES | Not applicable. | YES |
| EGWP | YES | YES | YES |
Credentials of test users in sandbox for testing Patient Access API
| LOB | Username | Password |
| CHPDC | chpdc_cftestuser5 chpdc_cftestuser6 |
Test@123 |
| CHPMD | chpmd_cftestuser5 | Test@123 |
| DSNP | dsnp_cftestuser5 | Test@123 |
| MAPD | mapd_cftestuser5 | Test@123 |
| MHBE | mhbe_cftestuser5 | Test@123 |
| EGWP | egwp_cftestuser2 | Test@123 |
Sandbox Well-Known /Smart Configuration Patient Access API Endpoints
Sandbox Patient Access API Endpoints
Sandbox Well-Known /Smart Configuration Payer Access API Endpoints
Sandbox Payer Access API Endpoints
Sandbox Well-Known /Smart Configuration Provider Directory API Endpoints
Sandbox Provider Directory API Endpoints
Production Well-Known/Smart Configuration for Patient Access API Endpoints
Production Patient Access API Endpoints
Production Well-Known/Smart Configuration Payer Access API Endpoints
Production Payer Access API Endpoints
Production Provider Directory API Endpoints
| LOB | API Endpoint |
| CHPDC | https://chpdc-apix.carefirst.com/extfhirproviderdir/v1 |
| CHPMD | https://chpmd-apix.carefirst.com/extfhirproviderdir/v1 |
| DSNP | https://dsnp-apix.carefirst.com/extfhirproviderdir/v1 |
| MAPD | https://mapd-apix.carefirst.com/extfhirproviderdir/v1 |
| MHBE | Not applicable. |
| EGWP | https://egwp-apix.carefirst.com/extfhirproviderdir/v1 |
Non-Interoperable APIs
The following tables provide configuration details for different personas and environments available in the CareFirst API platform. Use the appropriate URLs and scopes based on your persona and target environment:
Internal Developers
Internal developers have access to all development, testing, and production environments with comprehensive API access and scopes.
| Environment | Token URL | API Base URL | Scope |
|---|---|---|---|
| DEVA | https://az****-deva.carefirst.com/token/v1 | https://az****-deva.carefirst.com | f52f1b25-4b31-4a3c-b12c-7566f96ca928/.default |
| SITA | https://az****-sita.carefirst.com/token/v1 | https://az****-sita.carefirst.com | 5fa7e767-5da2-4093-aff9-e7ea8642c02f/.default |
| UAT | https://az****-uat.carefirst.com/token/v1 | https://az****-uat.carefirst.com | 5c14f2a0-d3be-4970-983b-d994d0c5f16d/.default |
| PIT | https://az****-pit.carefirst.com/token/v1 | https://az****-pit.carefirst.com | 517c5f8d-9180-4dae-be4f-a1df65324e38/.default |
| Production | https://az****-prod.carefirst.com/token/v1 | https://az****-prod.carefirst.com | b8945d59-cc76-4c1d-b6f6-ad479afe3e3e/.default |
External Developers
External developers have limited access to sandbox and production environments.
| Environment | Token URL | API Base URL | Scope |
|---|---|---|---|
| Sandbox | https://api-pit.carefirst.com/token/v2 | https://api-pit.carefirst.com | fb0bbf9f-9a04-46ce-a473-027706c2e37d/.default |
| Production | https://api.carefirst.com/token/v2 | https://api.carefirst.com | 6e6bd3b4-6922-4d5b-b852-a5ff09bda986/.default |
Important Notes:
- Scope Values: The scope values provided above are current as of this documentation. Always check your application's credentials page for the most up-to-date scope values, as these may change over time.
Help Center
You may get help by using the FAQ, Contact Us, and Documentation pages from the Help Center.
If you have a question or need additional assistance, please reach out to our team by using the Contact Us form located in the Help Center.