Patient Login

Authenticate Patient

POST /smart-auth/authenticate-patient
Content-Type: application/json

Request

{
  "email": "patient@email.com",
  "password": "your-password"
}

Response

Same flow as staff login — single org returns token directly, multiple orgs require selection via /select-organization.

The JWT for patients includes patient_id instead of practitioner:

{
  "access_token": "eyJhbGciOiJFUzI1NiIs...",
  "patient_id": "ZCT_patient_001",
  "patient_reference": "Patient/ZCT_patient_001",
  "org_id": "org-uuid",
  "roles": ["patient"]
}

Register Patient

Self-registration for new patients:

POST /smart-auth/register-patient
Content-Type: application/json

Request

{
  "email": "new.patient@email.com",
  "password": "secure-password",
  "given_name": "Jan",
  "family_name": "Novak",
  "birth_date": "1985-03-15",
  "gender": "male",
  "phone": "+421901234567",
  "organization_id": "org-uuid"
}

Response

{
  "message": "Registration successful",
  "patient_id": "new-patient-resource-id",
  "status": "self-registered"
}

Registration Status Flow

self-registered → patient → verified → (inactive)

Status	Description
`self-registered`	Just registered, pending verification
`patient`	Active patient
`verified`	Identity verified
`inactive`	Deactivated

Notes

Patient authentication is a wholly separate path from staff — different membership records, different endpoint, different token issuance
Patient detection in code: !!claims.patient_id
Patient tokens do NOT have practitioner or practitioner_reference claims