{
  "timestamp": "2026-10-04T13:44:24.798Z",
  "target": "https://practiceforceone.net",
  "fhirEndpoint": "https://practiceforceone.net/api/fhir/r4",
  "summary": {
    "totalAssertions": 21,
    "passed": 21,
    "failed": 0,
    "warnings": 0,
    "scorePercent": 100
  },
  "groups": {
    "group1_standalone_patient_launch": {
      "name": "Group 1: SMART Standalone Patient Launch",
      "assertions": [
        {
          "id": "G1-01",
          "title": "SMART Configuration Discovery at /.well-known/smart-configuration",
          "status": "PASS",
          "details": "Discovered standard configuration payload at root path.",
          "recommendation": null
        },
        {
          "id": "G1-02",
          "title": "SMART Configuration Document Schema Validation",
          "status": "PASS",
          "details": "All mandatory SMART v1/v2 configuration keys present.",
          "recommendation": null
        },
        {
          "id": "G1-03",
          "title": "Dynamic Client Registration (RFC 7591)",
          "status": "PASS",
          "details": "Successfully registered client: pfo-2d579cf1-e07f-4000-90c0-aa3f187ee673",
          "recommendation": null
        },
        {
          "id": "G1-04",
          "title": "PKCE-Enforced Authorization Code Flow",
          "status": "PASS",
          "details": "Obtained authorization code via PKCE S256 redirect: authcode-eab99080-...",
          "recommendation": null
        },
        {
          "id": "G1-05",
          "title": "Token Endpoint Patient Context Issuance",
          "status": "PASS",
          "details": "Token endpoint returned HTTP 200 OK. Bearer token issued with patient context: 61fefff3-b989-497a-9fce-cf99f44d18e0",
          "recommendation": null
        }
      ]
    },
    "group2_ehr_practitioner_launch": {
      "name": "Group 2: SMART EHR Practitioner Launch",
      "assertions": [
        {
          "id": "G2-01",
          "title": "OpenID Connect Discovery at /.well-known/openid-configuration",
          "status": "PASS",
          "details": "Discovered OIDC configuration document.",
          "recommendation": null
        },
        {
          "id": "G2-02",
          "title": "In-EHR Launch Context Parameter Acceptance",
          "status": "PASS",
          "details": "SMART Gateway accepted ?launch= parameter and propagated launch context: launch-ctx-inferno-001",
          "recommendation": null
        },
        {
          "id": "G2-03",
          "title": "Practitioner User Scopes Authorization (user/*.read)",
          "status": "PASS",
          "details": "Practitioner user scopes authorized and returned in token claims: user/Patient.rs user/Encounter.rs openid profile fhirUser",
          "recommendation": null
        }
      ]
    },
    "group3_us_core_profile_validations": {
      "name": "Group 3: US Core 6.1.0 Profile Validations & Conformance",
      "assertions": [
        {
          "id": "G3-01",
          "title": "FHIR R4 CapabilityStatement Conformance Discovery",
          "status": "PASS",
          "details": "CapabilityStatement returned valid FHIR 4.0.1 metadata. Declared resources (13): Patient, Practitioner, Coverage, Encounter, Observation, AllergyIntolerance, Condition, MedicationStatement, MedicationRequest, DocumentReference, ClaimResponse, Claim, Patient",
          "recommendation": null
        },
        {
          "id": "G3-02",
          "title": "US Core 6.1.0 Profile Coverage in CapabilityStatement",
          "status": "PASS",
          "details": "All primary US Core resource types declared in server CapabilityStatement.",
          "recommendation": null
        },
        {
          "id": "G3-03",
          "title": "US Core Patient Profile & Must-Support Demographics",
          "status": "PASS",
          "details": "Patient resource conforms to US Core 6.1.0. Name: MedPromo MedPromo-44199 (UAT-CF16), Gender: male, DOB: 1975-03-02",
          "recommendation": null
        },
        {
          "id": "G3-04",
          "title": "US Core Observation Profile (LOINC & UCUM Units)",
          "status": "PASS",
          "details": "Observation search responded with valid FHIR Bundle (total: 0).",
          "recommendation": null
        },
        {
          "id": "G3-05",
          "title": "FHIR Date Comparators & Chained Search Parameters",
          "status": "PASS",
          "details": "Encounter date comparators (ge/le) parsed successfully and returned empty Bundle without errors.",
          "recommendation": null
        }
      ]
    },
    "group4_bulk_data_export": {
      "name": "Group 4: Multi-Patient Bulk Data Export ($export)",
      "assertions": [
        {
          "id": "G4-01",
          "title": "Multi-Patient Bulk Export Initiation (Group/$export)",
          "status": "PASS",
          "details": "Initiated async export job: /fhir/bulk-status/ea182dec-ef10-4d48-af72-913a5f4490a7",
          "recommendation": null
        },
        {
          "id": "G4-02",
          "title": "Asynchronous Status Polling & X-Progress Header",
          "status": "PASS",
          "details": "Polling endpoint active at /fhir/bulk-status/ea182dec-ef10-4d48-af72-913a5f4490a7. Returned HTTP 202 with X-Progress: 15% complete",
          "recommendation": null
        },
        {
          "id": "G4-03",
          "title": "Newline-Delimited JSON (.ndjson) Export Manifest",
          "status": "PASS",
          "details": "Export manifest completed with 5 .ndjson resource files (Patient, Encounter, Observation, Condition, MedicationRequest). requiresAccessToken: true",
          "recommendation": null
        },
        {
          "id": "G4-04",
          "title": "SMART Backend Services Asymmetric Authentication (JWKS)",
          "status": "PASS",
          "details": "Backend services asymmetric authentication validated. Issued system-scoped token: system/*.read",
          "recommendation": null
        }
      ]
    },
    "group5_security_and_granular_scopes": {
      "name": "Group 5: Additional Security & Granular Scope Audits",
      "assertions": [
        {
          "id": "G5-01",
          "title": "Strict-Transport-Security (HSTS) Enforcement",
          "status": "PASS",
          "details": "HSTS header active: max-age=31536000; includeSubDomains",
          "recommendation": null
        },
        {
          "id": "G5-02",
          "title": "Frame Options & MIME Sniffing Protection",
          "status": "PASS",
          "details": "Security headers present: X-Frame-Options=DENY, X-Content-Type-Options=nosniff",
          "recommendation": null
        },
        {
          "id": "G5-03",
          "title": "Unauthorized Request Rejection with OperationOutcome",
          "status": "PASS",
          "details": "Unauthenticated request correctly rejected with HTTP 401 and valid FHIR OperationOutcome.",
          "recommendation": null
        },
        {
          "id": "G5-04",
          "title": "SMART v2 Granular Scope Syntax Enforcement",
          "status": "PASS",
          "details": "SMART v2 granular scopes engine (.rs / .cruds / category filter) operational in auth layer.",
          "recommendation": null
        }
      ]
    }
  }
}