Epic FHIR Integration: APIs, Developer Access and Integration Patterns

Epic’s public developer site, Epic on FHIR (fhir.epic.com), lets developers sign up, register client applications and test against a sandbox populated with example data. The companion site open.epic hosts interface specifications, data-sharing playbooks and guidance on connecting apps to organizations that use Epic.

• Sign-up and client registration. You create an account, register your app, choose its audience (for example patients, clinicians or a backend system) and request the FHIR APIs and scopes it needs. Registration produces client IDs for non-production and production use.
• Sandbox. The public sandbox lets you test API calls against synthetic patients. It is a shared test environment, not a copy of any customer’s configuration.
• Optional Vendor Services membership. Epic also offers a Vendor Services program for developers who want additional documentation, an expanded testing sandbox and access to Epic technical guidance. Terms and fees are set by Epic; check its site for the current details.
• Showroom. Epic’s Showroom is a directory where healthcare organizations can discover products that work with Epic. Developers can request a listing.

Epic on FHIR documents APIs across DSTU2, STU3 and R4. New work should target R4, which aligns with US Core and with ONC certification requirements for standardized APIs. Epic’s documentation lists, per resource and version, which interactions are available (read, search and, for a subset, create or update), the search parameters supported and any Epic-specific behaviour.

Beyond core FHIR REST APIs, open.epic also references CDS Hooks, FHIRcast and APIs relevant to the CMS Interoperability and Prior Authorization rule (CMS-0057-F). If your use case touches clinical decision support or context synchronization, check those specifications as well. For background on resources such as Patient, Encounter and Observation, see our FHIR resources guide.

Many production integrations combine FHIR with HL7 v2 interfaces or other Epic interface types for real-time events and orders. Our FHIR API integration guide and SMART on FHIR guide explain the underlying flows.

POST /oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=<signed-JWT>

• Customer-specific enablement. Each healthcare organization controls which apps are activated in its environment and which APIs they may call. Documentation shows what Epic supports, not what a given site has turned on.
• Read is broader than write. Many resources support read and search; create and update are available for a narrower set and may be constrained to specific workflows.
• Configuration differences. Two Epic customers may code the same concept differently or use different departments, flowsheets and document types. Mapping should tolerate this.
• Sandbox is not production. Synthetic data and default configuration will not surface every real-world variation.

• App type: a read-only patient-facing app is typically the simplest; embedded provider apps and write-back add review and testing.
• Whether the APIs you need are available in the sandbox and enabled at your first customer.
• Customer-side capacity for security review, build and testing.
• Whether you also need HL7 v2 or other non-FHIR interfaces.

For budgeting, see FHIR integration cost, which describes cost drivers and illustrative planning ranges.

• Which Epic customers and app types (patient, provider, backend) have you taken to production, and what did activation involve?
• Which of our required workflows can be met with Epic’s FHIR APIs, and which need other interfaces?
• How will you handle configuration differences between customer sites?
• How do you manage client IDs, keys and JWKS rotation for backend apps?
• Who supports the integration through Epic upgrades?

Browse EHR integration vendors and filter by Epic, or use find a vendor to describe your project.