Wanted to give everyone a quick heads up about a defect correction that began deploying to our non-production Millennium environments circa August 2nd:
In brief, a routine internal review revealed that the Authorization Server's Token Refresh workflow was unintentionally and inappropriately returning excess fields (such as id_token, patient, and encounter). These fields are not (were never) a documented part of our response [1], nor are they required by the SMART specification [2]. With the next release of the Authorization Server, the actual behavior will now match the documented behavior.
[1] https://docs.oracle.com/en/industries/health/millennium-platform-apis/fhir-authorization-framework/#using-refresh-tokens
[2] https://hl7.org/fhir/smart-app-launch/1.0.0/