Public surface / Provider and health system APIs
VA Lighthouse Patient Health API (production)
This endpoint declares a complete, interoperable public surface.
Observed surface
- Base URL
https://api.va.gov/services/fhir/v0/r4- Category
- Provider and health system APIs
- Availability
- answered 58 of the last 58 daily checks (100%)
- Last answered
- 2026-10-03 (answered on this run)
- Vantage agreement
- reachable from all 3 vantages, which are 3 hosts on one network (github-actions): one network's view sampled 3 times, not 3 independent networks
What each vantage saw
| Vantage | Result | What it saw | Condition |
|---|---|---|---|
github-actions/macos-latest | reached | answered in 404 ms | HTTP 200 |
github-actions/ubuntu-latest | reached | answered in 188 ms | HTTP 200 |
github-actions/windows-latest | reached | answered in 328 ms | HTTP 200 |
Vantages on one network are one network’s view sampled several times. A rule applied to that network’s address space reaches every one of them at once and reads exactly like agreement.
Interpretation
A grade describes two public discovery documents at one point in time. It does not inspect patient data, authenticated behavior, or clinical quality.
Read the scoring method →This endpoint's full report: what was observed, what was not, and what would change it →
What its CapabilityStatement declares, resource by resource →
Findings
Observed since 2026-08-05; no changes to declared capability recorded.
Declared app-to-server access
What the endpoint's own documents declare about app-to-server access, observed on this run. Nothing here was requested or exercised, and none of it is graded. An absent field is reported as absent, not as a refusal: a document that does not mention a field has not said anything about it.
| Question | Answer | What the document says | Where it is declared |
|---|---|---|---|
| Declares private_key_jwt client authentication at the token endpoint | not declared: the field is absent | the document has no token_endpoint_auth_methods_supported | SMART discovery: token_endpoint_auth_methods_supported |
| Declares the client_credentials grant, which SMART Backend Services uses | not declared: the field is absent | the document has no grant_types_supported | SMART discovery: grant_types_supported |
| Declares the client-confidential-asymmetric capability | not listed | capabilities lists 8 and not client-confidential-asymmetric | SMART discovery: capabilities |
| Declares system-level scopes | not listed | none of 20 scopes_supported is a system/ scope | SMART discovery: scopes_supported |
| Declares an export operation | not listed | 0 operations are declared and none is named export | CapabilityStatement: rest.operation and rest.resource.operation |
| Instantiates the Bulk Data Access implementation guide | not listed | 1 canonicals are instantiated and none is Bulk Data's | CapabilityStatement: instantiates |
Registry provenance
How this entry was verified
live CapabilityStatement fetch on the VA's api.va.gov domain; implementation description 'FHIR R4 Health APIs.'; sourced from developer.va.gov (recorded 2026-08-05). Re-checked 2026-08-19: live CapabilityStatement re-fetch from the davis-ca residential vantage; fhirVersion 4.0.1, 19 resource types, publisher 'Department of Veterans Affairs', software 'health-api-fhir-r4'.
Share this endpoint's grade
Link the badge back to this evidence page so readers can inspect the current findings.
<a href="https://fhir.chelseakr.com/endpoint/va-lighthouse/">
<img src="https://fhir.chelseakr.com/badge/va-lighthouse.svg"
alt="FHIR Scorecard: grade A"></a>This is an observational snapshot of a public, unauthenticated surface. It is not an audit, a ranking of care quality, or a statement about anyone's regulatory compliance. See how we grade.
Every observation on record for this endpoint, with the dates it answered and the dates it did not.