# API Explorer 2.0: a test bench for OpenEMR's FHIR, SMART and OAuth2 APIs **URL:** \ **Category:** OpenEMR Development\ **Created:** [October 2, 2026, 10:18pm UTC](https://community.open-emr.org/t/api-explorer-2-0-a-test-bench-for-openemrs-fhir-smart-and-oauth2-apis/27084 "2026-10-02T22:18:26Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![sjpadgett](https://community.open-emr.org/user_avatar/community.open-emr.org/sjpadgett/32/21623_2.png) [@sjpadgett](https://community.open-emr.org/u/sjpadgett)\ **Post date:** [October 2, 2026, 10:18pm UTC](https://community.open-emr.org/t/api-explorer-2-0-a-test-bench-for-openemrs-fhir-smart-and-oauth2-apis/27084/1 "2026-10-02T22:18:26Z")
Hi all, Two announcements that go together. **FHIR writes are coming in OpenEMR 8.5.0** Until now the FHIR API has been read-only, apart from Patient, Practitioner and Organization. In 8.5.0 you’ll be able to create and update 21 resources over FHIR: AllergyIntolerance, Appointment (create only), CarePlan, CareTeam, Condition, Coverage, Device, Encounter, Goal, Immunization, Medication, MedicationRequest, Organization, Patient, Person, Practitioner, PractitionerRole, Questionnaire, QuestionnaireResponse, RelatedPerson and ServiceRequest. The scopes to go with them are there too: - `user/.write` for provider-facing apps - `system/.write` for backend services - SMART v2 equivalents (`.cud`) alongside the v1 scopes Still in review, and aimed at the same release: - Observation writes for vital signs (PR #14217) - A fix so the consent screen keeps the write when an app asks for a v2 read and a v1 write on the same resource (PR #14317) **The API Explorer** I’ve rebuilt my API Explorer and I’m donating it to the community. It’s a browser tool that sits inside a development OpenEMR and lets you see the API working, or find out exactly where it isn’t. > **[GitHub - sjpadgett/oe-module-api-explorer](https://github.com/sjpadgett/oe-module-api-explorer)** > > Contribute to sjpadgett/oe-module-api-explorer development by creating an account on GitHub. What it does: - **Registers its own clients.** One click creates a key pair and four clients: confidential, public (PKCE), JWT client credentials and SMART EHR launch. - **Walks every grant type** and shows the raw responses. - **FHIR writes workbench.** POST, PUT and read-back for every writable resource, with bodies taken from OpenEMR’s own test fixtures. It can run the whole set in one pass and can create the patient, encounter and other records it needs on an empty install. - **Write stress test.** Fires many writes at once and reports timings, failures and duplicate ids. - **Scope Lab.** Checks that a client is granted the scopes it asked for and that the API enforces exactly those, across SMART v1, v2 and mixed scope sets. It exports a summary you can paste into an issue. - **Bulk export and SMART launch.** Group `$export` with polling, and a workspace that shows the launch context when OpenEMR launches it as a SMART app. Getting started takes a few minutes: 1. Clone it into `devtools/oe-module-api-explorer` under your OpenEMR root. 2. Turn on the REST and FHIR APIs in Admin → Config → Connectors. 3. Open `oeApiExplorer.php` and click Register Clients. Your own server list goes in a `config.local.php` that git ignores, so pulling updates never touches your settings. It works against older servers too: registration skips any scope your server doesn’t offer. One caution: this is a development tool. It skips the OpenEMR login and keeps client secrets on disk, so use it on a dev install with test data and never on a production server. The README and SECURITY.md cover the details. If you’re building an app against OpenEMR, I hope this saves you some time. If you’re working on the API itself, the write suite and the Scope Lab make good regression checks. Issues and pull requests are welcome. Definitely need your help testing the FHIR writes currently on our dev master. Jerry