Federal (via primes)

Families you'll use

Family	Fit	Status
Claims in	Core	Built — gated
Data in	Core	Built — gated
Population	Core	Built — gated
Social needs & programmes	Core	Built — gated
Unit readiness	Core	Built — gated
Clinical intelligence	Useful	Built — gated
Enrolment & messaging	Useful	Built — gated
Fitness intelligence	Useful	Built — gated
Enrolment roster	Useful	Built — gated
Care transitions	Useful	Built — gated

Scopes to request

Ask only for what your product uses.

Scope	Allows
`panel.import.write`	Stage, review, commit and discard practice panel imports (FHIR Bulk Data, or a spreadsheet with a saved mapping profile; medical practices with a BAA on file only).
`clinical.panel.read`	Read the practice's ranked panel worklist and start worklist runs (medical practices only).
`population.aggregate.read`	Read aggregate counts for your whole active panel (worklist tiers, rising risk, care gaps); every count below the small-cell minimum is suppressed, no ids (medical practices only).
`population.measures.read`	Read five eCQM-style quality measures and the Million Hearts ABCS as suppressed rates; NOT a certified eCQM calculation (medical practices only).
`population.measures.export`	Download the QRDA Category III file for the 2026 period: TRUE counts, not submission-validated, audited and refused when the audit log is down (medical practices only).
`population.export`	Run asynchronous FHIR Bulk Data exports of your panel, identified (each patient's sharing choices apply) or HIPAA Safe Harbor de-identified; audited per file (medical practices only).
`claims.import.write`	Send claims files (CMS CCLF Part A / B / D, or your plan's claims as CSV / NDJSON in the documented shape): staged with a dry run (match rate, row errors by code), then committed or discarded. MBIs and plan member ids are fingerprinted and never stored (treating practices and programme organisations with a BAA on file).
`claims.read`	Read a member's claims summary (counts by part and setting, dates, top diagnosis categories, CMS-HCC categories only when an official model is loaded) from your imported claims and, when the member shares their medical history with you, their own Medicare Blue Button summary; and whether they connected Blue Button or VA records (read-only).
`claims.risk_adjustment.read`	Read risk-adjustment audit evidence for a member: the diagnosis codes in the claims you imported with the dated claims documenting each, grouped into CMS-HCC categories only when an official model is loaded; never a risk score (treating practices and programme organisations with a BAA on file).
`social_needs.read`	Read a patient's health-related social needs screen (AHC-HRSN core) with the positive domains coded to ICD-10-CM Z-codes and SNOMED CT as Norvya asserts them, and the closed-loop community referrals your practice made, with Gravity-aligned Task status (treating practices only; the patient must share their medical history with you; a positive interpersonal-safety screen never leaves Norvya).
`social_needs.write`	Ask a patient to complete a social needs screen (Norvya's generic push), and create and update closed-loop referrals to community organisations (treating practices only).
`programs.community_care.read`	Read the VA Community Care, IHS Purchased/Referred Care and TRICARE referrals and authorisations your practice recorded in Norvya, with authorised dates, visits used and documentation deadlines; Norvya never authorises care or determines eligibility (treating practices only).
`programs.readiness.read`	Read unit readiness as counts only (physiology, training load, duty status), small cells and dominance suppressed, no individual, no questionnaire or behavioural-health data and never a projection (military unit and first-responder organisations only).
`members.roster.write`	Upload a roster of your eligible members (CSV / NDJSON, or a CMS eligibility / attribution file), review its dry run, then have Norvya invite them in bulk (its own email in each person's language; daily cap, queued not dropped), send reminders and collect phone-only join links. MBIs never stored raw (medical practices / programmes with a BAA only).
`members.roster.read`	Read your rosters and their enrolment report: invited, opened, joined, expired, revoked and declined as small-cell-suppressed counts by cohort, plus the status of each of your roster rows (medical practices / programmes only).

Not callable yet

Fitness intelligence Built — gated
Care transitions Built — gated Gate: A BAA, plus an ADT feed per hospital (or per practice for its own notices); the patient must be linked to the organisation and, for feed notices at a practice, share their medical history.
Enrolment & messaging Built — gated

Before production

Gate: Runs inside the prime's authorized (ATO) environment; Norvya holds no FedRAMP authorization.

Sandbox

Build and test against synthetic members before you touch real data. Ask for the sandbox kind that fits your organisation. What a sandbox holds, its credentials, limits, resets and expiry are in the Sandbox guide. To request one, write to [email protected] with your organisation and market.

Every endpoint for this market

The families this solution uses, filtered to the scopes it requests. Each link opens the endpoint on its family page.

Families you'll use

Scopes to request

Not callable yet

Before production

Sandbox

Every endpoint for this market

Platform Built — gated2

Enrolment roster Built — gated9

Clinical intelligence Built — gated3

Data in Built — gated4

Claims in Built — gated7

Social needs & programmes Built — gated9

Unit readiness Built — gated1

Population Built — gated13