Your APIs May Be Ready for 2027. But Can You Trust Who’s Connecting? 

The January 1, 2027  CMS-0057 deadline is approaching, and health plans are racing to get their APIs into production. But an API that’s technically ready isn’t necessarily ready to operate at scale. 

As payer-to-payer exchange, provider access and prior authorization workflows expand, health plans will be connecting with organizations they may never have worked with before. Every new relationship introduces a fundamental challenge: How do you verify who’s requesting data, whether they’re authorized to act on behalf of their organization, and whether access should be granted? 

If establishing that trust still depends on manual verification and one-off onboarding processes, the API may be ready, but the organization isn’t prepared to scale. 

The challenge doesn’t end when the API goes live 

Consider payer-to-payer exchange. Before sharing member data, a health plan needs confidence in the requesting organization’s identity, its authority to act, the applicable member permissions and whether the requested access is appropriate. 

Today, establishing those relationships can involve manual verification, onboarding and individual agreements. That becomes increasingly difficult as the number of connections grows. 

As health plans work toward continuous CMS compliance, the challenge isn’t simply securing more connections. It’s establishing trust without rebuilding it manually for every new relationship. 

Secure connections aren’t the same as trusted organizations 

Standards such as OAuth and the HL7 FAST Security Implementation Guide provide important mechanisms for authentication, authorization and secure API exchange. 

But securing a connection doesn’t necessarily answer every question about the organization behind it. Who is the legal entity making the request? Who has authority to act on its behalf? Can that authority be independently verified? These questions become harder as intermediaries, such as regional or national networks are involved in an exchange. 

Verifying organizational identity doesn’t automatically authorize access to healthcare information. The data holder must still evaluate the request against applicable policies, permissions, and regulatory requirements. 

The opportunity is to make the evidence supporting those decisions verifiable and reusable. 

Putting verifiable organizational identity into practice 

That’s what Onyx and healthKERI recently demonstrated in the first implementation of HL7 FAST Security combining UDAP with verifiable Legal Entity Identifier (vLEI) credentials, with participation from DirectTrust, the CARIN Alliance and GLEIF. 

The approach brings cryptographically verifiable organizational identity and delegated authority into established healthcare API security workflows. 

A requesting organization presents its credentials. Onyx validates that evidence alongside the request’s role and stated purpose. The data holder retains control over access approval, after which the requesting system completes UDAP dynamic client registration. 

Rather than replacing existing security standards, this approach strengthens the trust framework around them. 

The demonstration also aligns with broader industry efforts, including the DirectTrust and GLEIF initiative to support wider adoption of verifiable organizational identity in U.S. healthcare. 

What health plans should be asking now 

With the 2027 deadline approaching, API readiness shouldn’t be measured solely by whether an endpoint is operational. 

Health plans also need to consider how they’ll verify organizations requesting access, manage delegated authority and scale onboarding as new relationships emerge. 

CMS-0057 doesn’t require vLEI, and there isn’t one trust architecture that fits every organization. But the operational challenge is very real. 

At Onyx, we’re focused on making interoperability secure, scalable and sustainable, not simply getting APIs live for a compliance deadline. 

Our work with healthKERI and DirectTrust demonstrates a practical standards-based approach to doing exactly that. As organizations consider the opportunities afforded by establishing, or joining, a CMS-Aligned Network, the ability to embed verifiable Trust at scale in the network fabric is both desirable and achievable.  

As health plans prepare for expanded exchange in 2027, now is the time to examine whether their trust and onboarding processes are ready to scale.