Connecting to Epic and Oracle Health FHIR APIs from Python

Both expose FHIR R4 production endpoints and neither supports R5 - a position mirrored across the major EHR vendors, as the FHIR versions page explains. Oracle Health (Cerner) deprecated its DSTU2 endpoints in December 2025, so R4 is the only version with continued support on these platforms.

Build on R4 and keep version assumptions out of the code - the connection definition holds the endpoint, the services hold the logic.

SMART on FHIR is OAuth 2.0 with healthcare conventions, and two flows matter. SMART App Launch is the user-facing flow - authorization code with PKCE - for apps that a clinician or patient launches, with the user's session defining what the app may see.

SMART Backend Services is the server-to-server flow - client credentials with a signed JWT assertion - for integration platforms that run without a user, which is the flow an integration layer uses. Your system is registered with the EHR, holds a key pair, and exchanges signed assertions for short-lived access tokens scoped to system-level resources.

Register your application - Epic's vendor programs and Oracle's developer console both issue client credentials for production access. Then define an outgoing FHIR connection with an OAuth security definition - Zato obtains and refreshes the tokens, and the services only ever refer to the connection by name.

# -*- coding: utf-8 -*-

# Zato
from zato.server.service import Service

class ReadVitals(Service):
    name = 'demo.ehr.read-vitals'

    def handle(self) -> 'None':

        # The connection points at the EHR's R4 endpoint,
        # the OAuth definition is attached to it in the Dashboard
        client = self.fhir['FHIR.Epic']

        # Vital signs for one patient, most recent first
        observations = client.resources('Observation').search(
            patient = 'eVgg3Buc6VmvyHU',
            category = 'vital-signs',
        ).sort('-date').limit(20)

        for observation in observations.fetch():
            code_text = observation.get_by_path('code.text')
            value = observation.get_by_path('valueQuantity.value')
            self.logger.info('%s: %s', code_text, value)

The same service works against Oracle Health - only the connection name changes, e.g. self.fhir['FHIR.OracleHealth'], with that connection pointing at the Oracle R4 endpoint and with its own OAuth definition.

Every FHIR server describes itself at the metadata path - which resources it serves, which search parameters it supports, which auth endpoints to use. Reading it is the first request worth making against a new EHR endpoint, and path access pulls the details out of the deeply nested answer.

# The CapabilityStatement describes the server
capability = client.execute(path='metadata', method='get')

# The FHIR version the server declares
fhir_version = capability['fhirVersion']

# The OAuth endpoints, from the SMART security extension
rest = capability.get_by_path(['rest', 0])

self.logger.info('Server is on FHIR %s', fhir_version)

Zato is the FHIR client - it authenticates, reads and writes against the EHR's endpoints and integrates the results with everything else in your landscape. Registering the application is done in Epic's and Oracle's own programs (Epic's vendor services and open.epic, Oracle's Ignite APIs), and Zato does not host a FHIR server of its own - the EHR is the server.