Single-endpoint report

Blue Cross and Blue Shield of North Carolina Patient Access API: endpoint report

Everything this project observed about this one endpoint, everything it did not observe, and what would change the result. Free to read, link, print and hand on; there is nothing here behind a sign-in and nothing to buy.

Built to print. Use your browser’s print or “Save as PDF” to keep a dated copy; the page carries its own address and observation date.

What was observed, and what was not

This report covers 9 checks. 9 ran. 0 were asked from every reporting vantage and answered by none. 0 were never asked, because nothing was retrieved for them to read. The three are different facts and none of them is a zero: a check that did not run publishes no number, no mark against this endpoint, and nothing below to act on.

What would change this

Ordered by the points each would recover. Every item below comes from a check that actually ran on this run; nothing derived from a check that did not run appears here. The three dimensions are weighted, so recovering points does not guarantee a different letter — how we grade gives the weights.

1. Publish .well-known/smart-configuration at the base URL, carrying at least authorization_endpoint and token_endpoint.

   Worth up to 35 of the 100 points in Interop readiness.

   This run observed: SMART .well-known/smart-configuration absent or incomplete

   I2: what this check isSpec ↗

2. Declare what is running, in software.name and software.version. Both are needed; one without the other does not pass.

   Worth up to 20 of the 100 points in Capability transparency.

   This run observed: software name/version missing

   T2: what this check isSpec ↗

If this does not match what you see

Every number here describes two public documents at one moment, read from the vantages listed above. If it does not match what you serve, the difference is worth knowing.

Correct or dispute this record. There is no sign-in, no fee, and nothing to buy: this report is free to read, link, print and hand on, and this project collects nothing about the people who read it.

Where this came from

base URL printed as host plus basePath in the OpenAPI definition rendered on the plan's own developer-portal API reference (developer.bcbsnc.com), reached from bcbsnc.com/policies-best-practices/api-access. Issuer identity confirmed by the definition's own x-ibm-name. Registration and OAuth are required to retrieve member data, but the production base URL itself is printed publicly. Live CapabilityStatement retrieved (recorded 2026-09-04). No later re-check is recorded, so the date above is the last time anyone checked this entry against the live endpoint.

The same run, as data: this endpoint's JSON, what its CapabilityStatement declares, resource by resource, and every observation on record for it, with the dates it answered and the dates it did not.