Skip to content
OpesCare Developers
EN FR
Get API keys

Architecture and flows

Health ID QR verification

The Health ID QR lets anyone at a counter confirm a credential is genuine and current. The answer is always one of four clear states, never a bare error.

The flow

Scroll through the steps below the diagram, or hover a step, to highlight it in the diagram.

Health ID QR verification A verifier scans the patient Health ID QR and opescare.com answers with one of four states; a successful scan is recorded. Show Health ID QR Patient Scan, open /verify/qr/{token} Verifier Check token state opescare.com Record successful scan Verification log Invalid unknown token Revoked the card was replaced Expired show a fresh code Verified genuine and current shows valid Person or device Stored data Decision Outcome: done Outcome: refused Request Response Refusal or failure
  1. Show Health ID QR The patient opens the Health ID card in Presentation Mode.
  2. Scan, open /verify/qr/{token} Any camera opens the verification page on opescare.com.
  3. Check token state The token is looked up and checked for expiry and revocation.
  4. Verified, expired, revoked or invalid The page shows exactly one of the four states.
  5. Record successful scan A successful verification is stored as a verification event.
How this diagram is verified 21 of 21 checks pass

The picture, the steps, the PDF and the JSON are generated from one specification. An automated test proves the graph and checks every reference below against the running application.

  • Every card has a unique id
  • Every card has a known kind
  • Every arrow joins two existing cards
  • Exactly one starting point (a person, device or partner)
  • Every card is reachable from the start
  • Every card leads to an outcome (no dead ends)
  • No cycles except declared retry loops
  • Every numbered step follows real arrows
  • Outcomes end the flow
  • No two cards share a grid cell
  • Every card names its evidence
  • Every route, class, method and setting exists
  • Every icon is from the Lucide set
  • Every icon fits its card kind
  • Every label exists in English and French
  • Every label fits its card
  • No arrow crosses a card
  • No two unrelated arrows run on top of each other
  • No arrow label covers a card or another label
  • Every arrowhead is visible
  • Connected cards of different kinds never share a colour
CardEvidence in the code
Show Health ID QR route:portals.patient.health-id-card method:App\Services\Identity\QrTokenService::generateToken
Scan, open /verify/qr/{token} route:verify.qr
Check token state method:App\Http\Controllers\MedicalId\VerifyController::qr method:App\Services\Identity\QrTokenService::verifyToken method:App\Services\Identity\QrTokenService::failureState
Record successful scan class:App\Models\HealthIdVerificationEvent
Invalid method:App\Services\Identity\QrTokenService::failureState
Revoked method:App\Services\Identity\QrTokenService::revokeToken
Expired class:App\Models\HealthIdQrToken
Verified route:verify.qr

All flows as JSON

What this guarantees

  • The QR carries a token, not medical data.
  • Every answer is one of four states a person can act on.
  • Successful verifications are recorded.

Where it lives in the code

  • route:portals.patient.health-id-card
  • method:App\Services\Identity\QrTokenService::generateToken
  • route:verify.qr
  • method:App\Http\Controllers\MedicalId\VerifyController::qr
  • method:App\Services\Identity\QrTokenService::verifyToken
  • method:App\Services\Identity\QrTokenService::failureState
  • class:App\Models\HealthIdVerificationEvent
  • method:App\Services\Identity\QrTokenService::revokeToken
  • class:App\Models\HealthIdQrToken