Dashboard

Scopes

Scopes control what data your credential can access. When creating an API key or OAuth2 credential, select only the scopes your application needs.

Available Scopes

Read Scopes (Lookup APIs)

Read scopes grant access to single-item lookup and batch lookup endpoints.

ScopeDescription
ndc.readLook up NDC drug data
npi.readLook up NPI provider data
rxnorm.readLook up RxNorm data
loinc.readLook up LOINC codes
icd10.readLook up ICD-10 codes
cvx.readLook up CVX vaccine codes
mvx.readLook up MVX manufacturer codes
fda-label.readLook up FDA drug labels
snomed.readLook up SNOMED CT concepts and mappings
connectivity.readLook up provider connectivity, FHIR endpoints, and SMA directory
claims.readLook up CMS claims data (NCCI, MUE, PFS/RVU, coverage)
hcc.readLook up CMS HCC risk adjustment crosswalk data
opcs4.readLook up OPCS-4 UK procedure classification codes
dmd.readLook up dm+d UK medicines and devices
ucum.readLook up UCUM units of measure
rxclass.readLook up RxClass drug classifications
hcpcs.readLook up HCPCS Level II codes
msdrg.readLook up MS-DRG codes
pos.readLook up Place of Service codes
jcode.readLook up J-Code/NDC crosswalk
ddi.readLook up drug-drug interaction reference data

Search Scopes (Search APIs)

Search scopes grant access to full-text search endpoints. These are separate from read scopes because search operations are more resource-intensive.

ScopeDescription
ndc.searchSearch NDC drug products
npi.searchSearch NPI providers
rxnorm.searchSearch RxNorm drugs
loinc.searchSearch LOINC codes
icd10.searchSearch ICD-10 codes
cvx.searchSearch CVX vaccine codes
mvx.searchSearch MVX manufacturer codes
fda-label.searchSearch FDA drug labels
snomed.searchSearch SNOMED CT IPS concepts
hcc.searchSearch CMS HCC risk adjustment crosswalk data
opcs4.searchSearch OPCS-4 UK procedure classification codes
dmd.searchSearch dm+d UK medicines and devices
ucum.searchSearch UCUM units of measure
rxclass.searchSearch RxClass drug classifications
hcpcs.searchSearch HCPCS Level II codes
msdrg.searchSearch MS-DRG codes

How Scopes Work

  • Lookup endpoints (e.g., GET /v1/ndc/:code) require the corresponding .read scope
  • Search endpoints (e.g., GET /v1/ndc/search) require the corresponding .search scope
  • If your credential lacks a required scope, the API returns a 403 Forbidden error with the required scope
  • New credentials include both read and search scopes by default
  • You can create credentials with specific scopes in the Dashboard

Recommendations

  • Use minimal scopes — Only request the scopes your application actually needs
  • Separate credentials per service — If you have multiple services, give each its own credential with only the scopes it requires
  • Audit regularly — Review your credentials and remove any that are no longer in use