Public surface / Reference and test servers
Firely public test server
This endpoint answers publicly but declares little about itself.
Observed surface
- Base URL
https://server.fire.ly- Category
- Reference and test servers
- Availability
- answered 58 of the last 58 daily checks (100%)
- Last answered
- 2026-10-03 (answered on this run)
- Vantage agreement
- reachable from all 3 vantages, which are 3 hosts on one network (github-actions): one network's view sampled 3 times, not 3 independent networks
What each vantage saw
| Vantage | Result | What it saw | Condition |
|---|---|---|---|
github-actions/macos-latest | reached | answered in 6191 ms | HTTP 200 |
github-actions/ubuntu-latest | reached | answered in 9670 ms | HTTP 200 |
github-actions/windows-latest | reached | answered in 1468 ms | HTTP 200 |
Vantages on one network are one network’s view sampled several times. A rule applied to that network’s address space reaches every one of them at once and reads exactly like agreement.
Interpretation
A grade describes two public discovery documents at one point in time. It does not inspect patient data, authenticated behavior, or clinical quality.
Read the scoring method →This endpoint's full report: what was observed, what was not, and what would change it →
What its CapabilityStatement declares, resource by resource →
Findings
- Pass: /metadata answers with HTTP 2xx over HTTPS: reachable from all 3 vantages, which are 3 hosts on one network (github-actions): one network's view sampled 3 times, not 3 independent networksR1Spec ↗
- Needs attention: /metadata responded in 6191 ms (median across 3 reachable vantages on one network)R2Spec ↗
Declared capability changes
- 2026-09-08: declared profiles: 215 -> 217
- 2026-09-24: software_version: '6.9.1+e4f2e63c5e20f326898f61339c3b3fcd48017201' -> '6.10.0+85497ec0fbbebba6d026fcb7f8ca70efc9955b69'
Declarations this endpoint returns to
This address has served a declaration, moved away from it, and served it again. That usually means one hostname in front of more than one backend rather than a publisher changing anything, so each return is counted here once instead of being reported as a fresh capability change every time a probe lands on the other backend.
- 2026-09-09 to 2026-09-17: returned 2 times to a declaration first observed 2026-08-05 (declared profiles: 217 -> 215) - counted, not recorded as a new change each time
- 2026-09-16: returned once to a declaration first observed 2026-09-08 (declared profiles: 215 -> 217) - counted, not recorded as a new change each time
Declared app-to-server access
What the endpoint's own documents declare about app-to-server access, observed on this run. Nothing here was requested or exercised, and none of it is graded. An absent field is reported as absent, not as a refusal: a document that does not mention a field has not said anything about it.
| Question | Answer | What the document says | Where it is declared |
|---|---|---|---|
| Declares private_key_jwt client authentication at the token endpoint | not retrieved on this run | the SMART discovery document was requested and not served on this run | SMART discovery: token_endpoint_auth_methods_supported |
| Declares the client_credentials grant, which SMART Backend Services uses | not retrieved on this run | the SMART discovery document was requested and not served on this run | SMART discovery: grant_types_supported |
| Declares the client-confidential-asymmetric capability | not retrieved on this run | the SMART discovery document was requested and not served on this run | SMART discovery: capabilities |
| Declares system-level scopes | not retrieved on this run | the SMART discovery document was requested and not served on this run | SMART discovery: scopes_supported |
| Declares an export operation | declared | export is declared on Group, the whole server | CapabilityStatement: rest.operation and rest.resource.operation |
| Instantiates the Bulk Data Access implementation guide | declared | instantiates http://hl7.org/fhir/uv/bulkdata/CapabilityStatement/bulk-data|2.0.0 | CapabilityStatement: instantiates |
Registry provenance
How this entry was verified
live CapabilityStatement fetch; publisher confirmed via software 'Firely Server' (recorded 2026-08-04). Re-checked 2026-08-19: live CapabilityStatement re-fetch from the davis-ca residential vantage; fhirVersion 4.0.1, 146 resource types, publisher 'Firely', software 'Firely Server 6.9.1+e4f2e63c5e20f326898f61339c3b3fcd48017201'.
Share this endpoint's grade
Link the badge back to this evidence page so readers can inspect the current findings.
<a href="https://fhir.chelseakr.com/endpoint/firely-public/">
<img src="https://fhir.chelseakr.com/badge/firely-public.svg"
alt="FHIR Scorecard: grade C"></a>This is an observational snapshot of a public, unauthenticated surface. It is not an audit, a ranking of care quality, or a statement about anyone's regulatory compliance. See how we grade.
Every observation on record for this endpoint, with the dates it answered and the dates it did not.