The CMS-0057-F Prior Authorization Sandbox

What you'll see in five minutes

1. Sign up with your work email — a magic link, no password, gets you a bearer token and a synthetic patient in under a minute.
2. Run a CRD hook against a scenario fixture and get back a card flagging that prior authorization is required.
3. Fetch the DTR questionnaire the CRD card pointed at — pre-filled from the fixture's US Core data, with the rest left for the clinician.
4. Submit the PAS request and get back approved, denied with a reason, or pended.
5. Poll the pended one for a status update, the same way your product would instead of picking up a phone.

What it looks like

Try a request

The sandbox requires a bearer token — no live payer lets untrusted code near production either, so this one doesn't pretend to. Run this first, before you have a token, and you'll get this back — the live server's actual response to an unauthenticated call, captured 5 September 2026:

# No token yet — verified live response:
$ curl -s https://fhir-sandbox.greenice.net/api/crd/scenarios/prior-auth-required/hooks/order-sign

{"resourceType":"OperationOutcome","issue":[{"severity":"error","code":"login",
"diagnostics":"Missing bearer token. Get one at /signup."}]}

Sign up below for a token (free, under a minute), then run these three requests — CRD hook, then the DTR questionnaire it points at, then the PAS submission. Each one feeds the next:

# after signup:
export TOKEN=<your token, from the dashboard>
export BASE=https://fhir-sandbox.greenice.net

# 1) CRD: does this order need prior auth?
curl -s "$BASE/api/crd/scenarios/prior-auth-required/hooks/order-sign" \
  -H "Authorization: Bearer $TOKEN" -o hook-request.json
curl -s -X POST "$BASE/cds-services/order-sign-crd" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d @hook-request.json | tee crd-response.json

# 2) DTR: fetch the questionnaire package the CRD response pointed at
curl -s "$BASE/api/dtr/scenarios/prior-auth-required/variants/prior-auth-required-canonical" \
  -H "Authorization: Bearer $TOKEN" -o dtr-request.json
curl -s -X POST "$BASE/fhir/Questionnaire/\$questionnaire-package" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/fhir+json" \
  -d @dtr-request.json | tee dtr-response.json

# 3) PAS: submit, see the decision
curl -s "$BASE/api/pas/scenarios/prior-auth-required/variants/prior-auth-required-initial" \
  -H "Authorization: Bearer $TOKEN" -o pas-request.json
curl -s -X POST "$BASE/fhir/Claim/\$submit" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/fhir+json" \
  -d @pas-request.json | tee pas-response.json

Response shape, per the CDS Hooks / Da Vinci CRD spec — the sandbox's actual card text, summary and links will differ by scenario, and every call you make is logged in full in the request inspector:

{
  "cards": [
    {
      "summary": "<card summary, e.g. whether prior auth is required>",
      "indicator": "<info | warning | critical>",
      "source": { "label": "<payer label>" },
      "links": [
        { "label": "<DTR launch link, if documentation is required>", "type": "smart", "url": "..." }
      ]
    }
  ]
}

Prefer to click instead of copy-paste exact ids? The scenario catalog below has a run-in-browser button for every module, and every call still shows up in the inspector.

Limits

Get a token

Scenario catalog

Every module is a fixed coverage rule you can pick, run, and inspect — filterable by outcome:

• Cardiology Consultation Appointment — denied, referral capture and network guidance
• Documentation Required — pended, a CDex attachments workflow
• Excluded Services — denied, experimental/investigational procedure
• Home Oxygen Therapy Dispatch — pended, DME supplier verification
• Home Health Service Assessment — pended, coverage determination at order signing
• Experimental Neurostimulator Implant — denied, an invented procedure code for testing unknown-code handling

Plus more modules covering the rest of the approval / denial / pended / docs-needed matrix — the full, current list is in the catalog itself once you're signed in.