Access you can explain to an auditor
Documents carry protected health information, so every screen and every API call asks the same question in the same vocabulary: can this person, team or key do this action, here? The answer comes from one permission model, and every change to it is logged.
Roles, teams
and queue scope
Permissions are module and action pairs. Built-in roles cover owner, admin, manager, reviewer and viewer, and custom roles start from any of them. Grant a role across the workspace or inside chosen queues, to a person or a whole team, and the rail, the pages and the API all follow.
Clinical reviewer
Nurses who review prior authorizations and referrals. Can approve, cannot export or delete.
| When | Actor | Action | Target | |
|---|---|---|---|---|
| 2 minutes ago | DADana Alvarez | document.approved | aetna-pa-whitfield.pdf | |
| 9 minutes ago | Fax gateway | document.uploaded | fax_20260918_0912.tif | |
| 1 hour ago | MWMarcus Webb | role.updated | Clinical reviewer | |
| 3 hours ago | PRPriya Raman | automation.updated | Auto-approve clean prior auths | |
| yesterday | MWMarcus Webb | apiKey.created | Epic interface engine | |
| yesterday | DADana Alvarez | member.invited | j.okafor@northwindhealth.org |
Keys that can only
narrow
An API key holds its creator's permissions intersected with its own scopes, re-checked on every request, and it can never manage members, teams, roles, other keys or the workspace. Revoking one takes effect on the next call.
| Name | Key | Scopes | Limit | Last used |
|---|---|---|---|---|
| Epic interface engine | dfk_live_7Hq2•••••••• | 3 scopes | 1200/min | a few seconds ago |
| Fax gateway | dfk_live_Pz81•••••••• | 2 scopes | 600/min | 2 minutes ago |
| Warehouse nightly export | dfk_live_c0Wm•••••••• | 2 scopes | 120/min | 9 hours ago |
Access for Fax gateway
A key can do what its creator can do, narrowed to these scopes. It never holds members, roles or other keys.
Included
Bring the forms your team still retypes
A working session on your own documents: one queue, your fields, your rules, and a count of what would have gone straight through.