Enterprise SSO
OIDC or SAML for approved organizations, with tenant policy, MFA expectations, and immutable access review evidence.
CUBE API
Build healthcare apps with CUBE API
OAuth 2.0, OpenAPI 3.1, and HIPAA and PHI safeguards. Ship eligibility, FHIR, telehealth and integrations in days, not quarters.
- OpenAPI 3.1
- OAuth 2.0
- FHIR R4
Identity & access
Developer onboarding without exposing PHI
Workspace identities can help approve partner developers, but production API access remains OAuth-scoped, tenant-bound, audit-logged, and separated from patient data until contractual and compliance gates are complete.
GitHub developer access
Useful for technical partners and API reviewers. GitHub identity can gate docs and sandbox workspaces, not PHI workflows.
Slack partner access
Useful for partner channels, support escalation, and launch rooms. Access stays least-privilege and auditable.
Portal-safe access policy
Use the right identity for the right surface
GitHub and Slack can make developer onboarding faster, but they do not authorize PHI access or production API transactions by themselves. Every path is scoped to the user, tenant, environment, contract status, and audit controls.
Enterprise SSOProvider, admin, and approved developer workspaces for covered entities, business associates, and enterprise partners.
- Allowed
- OIDC or SAML with verified organization ownership, tenant role mapping, MFA policy, and session controls.
- Blocked
- No PHI workspace access until BAA, security review, tenant policy, and role approval are complete.
- Evidence
- SSO configuration, login events, MFA posture, SCIM or roster review, and role-change audit logs.
GitHubDeveloper docs, sandbox apps, SDK review, issue triage, and non-PHI technical collaboration.
- Allowed
- GitHub identity can gate docs, sandbox keys, sample projects, and developer review queues.
- Blocked
- No patient data, no live tenant admin access, and no production API scope granted from GitHub alone.
- Evidence
- Developer approval record, repository or org membership, sandbox key issuance, and API activity logs.
SlackPartner launch rooms, support escalation, implementation coordination, and non-PHI operational updates.
- Allowed
- Slack identity can speed partner collaboration and route users into approved support or onboarding spaces.
- Blocked
- No PHI discussion, no credential delivery, no production actions, and no policy override through Slack.
- Evidence
- Workspace approval, channel purpose, access roster, support ticket links, and retention policy notes.
Patient identityPatient portal and kiosk flows where identity proofing, consent, privacy, and accessibility matter first.
- Allowed
- Email, passkey, phone, or verified identity flows when the tenant policy supports them and consent is explicit.
- Blocked
- No casual social login for PHI access unless legal, privacy, consent, and audit controls approve the exact flow.
- Evidence
- Consent trail, identity verification outcome, device/session risk, and patient-facing disclosure acceptance.
Production APIServer-to-server integrations, embedded widgets, webhooks, and approved partner automation.
- Allowed
- OAuth client_credentials, tenant scopes, webhook signing, rate limits, key rotation, and least privilege.
- Blocked
- No human social login can mint production API authority without SuperAdmin approval and scoped credentials.
- Evidence
- Client registration, scope approval, token events, webhook delivery logs, and access-review attestations.
Enterprise SSO
Provider, admin, and approved developer workspaces for covered entities, business associates, and enterprise partners.
- Allowed
- OIDC or SAML with verified organization ownership, tenant role mapping, MFA policy, and session controls.
- Blocked
- No PHI workspace access until BAA, security review, tenant policy, and role approval are complete.
- Evidence
- SSO configuration, login events, MFA posture, SCIM or roster review, and role-change audit logs.
GitHub
Developer docs, sandbox apps, SDK review, issue triage, and non-PHI technical collaboration.
- Allowed
- GitHub identity can gate docs, sandbox keys, sample projects, and developer review queues.
- Blocked
- No patient data, no live tenant admin access, and no production API scope granted from GitHub alone.
- Evidence
- Developer approval record, repository or org membership, sandbox key issuance, and API activity logs.
Slack
Partner launch rooms, support escalation, implementation coordination, and non-PHI operational updates.
- Allowed
- Slack identity can speed partner collaboration and route users into approved support or onboarding spaces.
- Blocked
- No PHI discussion, no credential delivery, no production actions, and no policy override through Slack.
- Evidence
- Workspace approval, channel purpose, access roster, support ticket links, and retention policy notes.
Patient identity
Patient portal and kiosk flows where identity proofing, consent, privacy, and accessibility matter first.
- Allowed
- Email, passkey, phone, or verified identity flows when the tenant policy supports them and consent is explicit.
- Blocked
- No casual social login for PHI access unless legal, privacy, consent, and audit controls approve the exact flow.
- Evidence
- Consent trail, identity verification outcome, device/session risk, and patient-facing disclosure acceptance.
Production API
Server-to-server integrations, embedded widgets, webhooks, and approved partner automation.
- Allowed
- OAuth client_credentials, tenant scopes, webhook signing, rate limits, key rotation, and least privilege.
- Blocked
- No human social login can mint production API authority without SuperAdmin approval and scoped credentials.
- Evidence
- Client registration, scope approval, token events, webhook delivery logs, and access-review attestations.
Compliance guardrail: No external workspace identity bypasses BAAs, consent, tenant isolation, role review, scoped API credentials, encryption, or immutable audit logging.
OpenAPI 3.1 first
Every endpoint we ship is registered against a single curated spec. SDK generators, mocks and Postman collections all derive from it.
OAuth 2.0 client credentials
Self-serve credentials in the SuperAdmin console. Token issuance at api.cubeonecare.com/oauth/token. Per-tenant scopes baked in.
HIPAA and PHI safeguards
Audit logging, BAA verification, encryption at rest, and synthetic documentation examples. Live PHI is outside this portal's intended documentation scope.