45 CFR 156.221(a) — Da Vinci PDex IG · US Core STU 3.1.1 · SMART on FHIR v2 (patient launch)
/api/auth/token and sends it as a Bearer header. The API returns 401 without one. Production adds real patient identity: the member signs in at the payer portal and authorizes a third-party app (e.g., Apple Health, CommonHealth).