Production Access

Eligible organizations must get credentials from their model-specific systems to access enrollee claims data.

1. Authorize your model entity

   Your access to BCDA starts with getting authorized to create and manage API credentials. Create and manage credentials by logging in to your model-specific system.

   ACOs in the Medicare Shared Savings Program

   • System to use for BCDA production credentials - ACO Management System (ACO-MS)

   • Who creates credentials - ACO-MS users who are assigned the Credential Delegate role

   REACH ACOs, KCEs in the KCC Model, and IOTA Participants

   • System to use for BCDA production credentials - 4innovation (4i)

   • Who creates BCDA credentials - 4i users who are assigned one of the following roles:

     • Executive Contact
     • Entity Primary Contact
     • Entity Secondary Contact
     • DUA Requestor
     • DUA Custodian

   GUIDE and ACCESS Participants

   • System to use for BCDA production credentials - Request access to API Credentials Management - BCDA application from the CMS Enterprise Portal

   • Who creates BCDA credentials - View the Enterprise Portal User Guide to learn more

   Contact the CMS Application Help Desk for support with ACO-MS, 4i, and Enterprise Portal.

2. Manage BCDA production credentials

   In ACO-MS and 4i

   1. Visit the API Credentials page in your model-specific system.
   2. Choose the BCDA Credentials tab, then select Create New API Credentials.
   3. Add a public, static IP address for every system, including those owned by vendors, that will use the API (up to 8). It may take up to an hour for the Allow List to update.

   In CMS Enterprise Portal

   1. Visit My Applications.
   2. Open the API Credentials Management - BCDA application tile.
   3. Add a public, static IP address for every system, including those owned by vendors, that will use the API (up to 8). It may take up to an hour for the Allow List to update.

   Rotate (renew) credentials every 90 days

   BCDA credentials expire after 90 days. Renew your credentials in your model-specific system to ensure you can continue to access BCDA.

   Revoke (deactivate) credentials if compromised

   Treat your BCDA credentials as sensitive information. If you suspect your credentials have been compromised, revoke the credentials from your model-specific system and email our team at bcapi@cms.hhs.gov to review recent API activity for suspicious requests.

3. Access production claims data

   The sandbox and production environments support the same workflow, endpoints, and resource types. Follow similar steps as you did in the sandbox to get a bearer token and retrieve claims data.

   Visit Support or join the Google Group if you have questions. Do not share Personally Identifiable Information (PII) like tokens, credentials, or claims data.