Smile CDR v2023.11.PRE
On this page:
   43.46    Resource Providers
  • Configuration Categories
  • 43.0 Web Admin Console Settings
  • 43.1 appSphere
  • 43.2 Payer Config
  • 43.3 Initial appSphere Seeding
  • 43.4 Authentication Callback Scripts
  • 43.5 Auth: General for APIs
  • 43.6 User Authentication
  • 43.7 Auth: HTTP Basic
  • 43.8 Auth: OpenID Connect
  • 43.9 Browser Syntax Highlighting
  • 43.10 Camel
  • 43.11 Capability Statement (metadata)
  • 43.12 Care Gaps
  • 43.13 CDA Generation
  • 43.14 CDA Import
  • 43.15 CDA Interceptors
  • 43.16 CDA JavaScript Execution Scripts
  • 43.17 CDA Terminology
  • 43.18 CDS Hooks Definitions
  • 43.19 Channel Import
  • 43.20 Channel Retry
  • 43.21 Kafka
  • 43.22 Cluster Manager Maintenance
  • 43.23 Message Broker
  • 43.24 Cluster Level Security
  • 43.25 CQL
  • 43.26 Credentials
  • 43.27 Cross-Origin Resource Sharing (CORS)
  • 43.28 Database
  • 43.29 Da Vinci Health Record Exchange
  • 43.30 DQM
  • 43.31 DTR
  • 43.32 Email Configuration
  • 43.33 Encounter Start CDS hook configuration
  • 43.34 MDM UI
  • 43.35 ETL Import: CSV Properties
  • 43.36 ETL Import: Source
  • 43.37 FHIR Binary Storage
  • 43.38 FHIR Bulk Operations
  • 43.39 Capability Statement
  • 43.40 FHIR Configuration
  • 43.41 Consent Service
  • 43.42 FHIR Endpoint Conversion
  • 43.43 FHIR Endpoint HFQL Support
  • 43.44 Interceptors
  • 43.45 FHIR Endpoint Partitioning
  • 43.46 Resource Providers
  • 43.47 FHIR Endpoint Security
  • 43.48 Endpoint Terminology
  • 43.49 FHIR Gateway Configuration
  • 43.50 FHIR Interceptors
  • 43.51 LiveBundle Service
  • 43.52 FHIR MDM Server
  • 43.53 FHIR Performance
  • 43.54 FHIR Performance Tracing
  • 43.55 FHIR Realtime Export
  • 43.56 Repository Validation
  • 43.57 FHIR Resource Types
  • 43.58 FHIR REST Endpoint
  • 43.59 FHIR Search
  • 43.60 Custom Resource Types
  • 43.61 IG Support
  • 43.62 MegaScale
  • 43.63 FHIR Storage Module Conditional Updates
  • 43.64 FHIR Storage Module Scheduled Tasks
  • 43.65 FHIR Validation Services
  • 43.66 FHIR Storage Package Registry
  • 43.67 FHIR Storage Partitioning
  • 43.68 Versioned References
  • 43.69 FHIR Subscription Delivery
  • 43.70 FHIR Subscription Persistence
  • 43.71 Amazon HealthLake REST Endpoint
  • 43.72 HL7 v2.x Mapper - Contained Resource
  • 43.73 HL7 v2.x Mapper - DG1
  • 43.74 HL7 v2.x Mapper - Forced Namespace Mode
  • 43.75 HL7 v2.x Mapper - General
  • 43.76 HL7 v2.x Mapper - Medications
  • 43.77 HL7 v2.x Mapper - OBR
  • 43.78 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 43.79 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 43.80 HL7 v2.x Mapper - PID
  • 43.81 HL7 v2.x Mapper - PV1
  • 43.82 Listener Interceptors
  • 43.83 HL7 v2.x Listener Script
  • 43.84 HL7 v2.x MLLP Listener
  • 43.85 HL7 v2.x MLLP Sender
  • 43.86 FHIR to HL7 v2.x Mapper Script
  • 43.87 HL7 v2.x Outbound Mapping
  • 43.88 Da Vinci Health Record Exchange (HRex)
  • 43.89 HTTP Access Log
  • 43.90 HTTP Listener
  • 43.91 HTTP Request Pool
  • 43.92 HTTP Security
  • 43.93 Hybrid Providers Definitions
  • 43.94 Initial User Seeding
  • 43.95 JavaScript Execution Environment
  • 43.96 JSON Web KeySet (JWKS)
  • 43.97 LDAP Authentication
  • 43.98 Smile CDR License
  • 43.99 Lucene FullText Indexing
  • 43.100 MDM
  • 43.101 Narrative Generator
  • 43.102 OpenID Connect Token Validation
  • 43.103 OpenID Connect (OIDC)
  • 43.104 Payer to Payer
  • 43.105 Prior Authorization Coverage Requirement Discovery
  • 43.106 Privacy Security Notice
  • 43.107 Provenance Injection
  • 43.108 Realtime Export
  • 43.109 Endpoint Validation: Request Validating
  • 43.110 Scheduler Configuration
  • 43.111 Search Parameter Seeding
  • 43.112 SAML Provider
  • 43.113 Security Inbound Script
  • 43.114 Inbound SMART on FHIR Authentication
  • 43.115 Inbound SMART on FHIR Endpoints
  • 43.116 OAuth2/OIDC Federation
  • 43.117 SMART Callback Script
  • 43.118 Cross-Organizational Data Access Profile
  • 43.119 SMART Login Skin
  • 43.120 SMART Login Terms of Service
  • 43.121 SMART Authorization
  • 43.122 SMART Definitions Seeding
  • 43.123 Sessions
  • 43.124 Two Factor Authentication
  • 43.125 TLS / SSL (Encryption)
  • 43.126 Transaction Log
  • 43.127 Trusted Client
  • 43.128 User Self Registration
    • 43.48    Endpoint Terminology   
       Table of Contents

    FHIR Endpoint Security

    43.47.1FHIR Endpoint Security

     

    The FHIR Endpoint Security configuration category includes the following configurable options:

    • Allow Searches With Compartment Access

    • Automatically Narrow Search Scope

    • Reject Insufficient Permissions with HTTP 401

    • Watermark Responses Enabled

    • Scopes Supported

    43.47.2Property: Allow Searches With Compartment Access

     
    Property Name Allow Searches With Compartment Access
    Property Key
    Property Type BOOLEAN
    Description When disabled, the server will proactively reject searches on resource types, even though a resource in the compartment could possibly be in the results. When enabled, the searches will be accepted, but the server will filter the results to only include resources that are in the compartment. Enabling this flag is less secure, as the interceptor may leak the existence of resources that are not in the compartment.
    Applies to Modules
    • FHIR Gateway REST Endpoint
    • FHIR REST Endpoint (All FHIR Versions)
    • FHIR REST Endpoint (DSTU2 - Deprecated)
    • FHIR REST Endpoint (R3 - Deprecated)
    • FHIR REST Endpoint (R4 - Deprecated)
    • Hybrid Providers REST Endpoint
    Default Value false
    Example Property 
    module.[MODULE_ID].config.fhir_endpoint_security.allow_compartment_searches = false

    43.47.3Property: Automatically Narrow Search Scope

     
    Property Name Automatically Narrow Search Scope
    Property Key
    Property Type BOOLEAN
    Description When enabled, the server will automatically try to narrow the scope of searches when the user only has permission to access specific instances or compartments. For example, when a user only has the FHIR_READ_ALL_IN_COMPARTMENT/Patient/123 permission and tries to perform a search for Observation?code=foo, this search will be performed automatically as Observation?subject=Patient/123&code=foo. See Block Unless Code in ValueSet for more information. Note that in order to avoid accidental disclosure of non-narrowed resource counts, search total counts will be unavailable if this feature is enabled.
    Applies to Modules
    • FHIR Gateway REST Endpoint
    • FHIR REST Endpoint (All FHIR Versions)
    • FHIR REST Endpoint (DSTU2 - Deprecated)
    • FHIR REST Endpoint (R3 - Deprecated)
    • FHIR REST Endpoint (R4 - Deprecated)
    • Hybrid Providers REST Endpoint
    Default Value false
    Example Property 
    module.[MODULE_ID].config.fhir_endpoint_security.automatically_narrow_search_scope = false

    43.47.4Property: Reject Insufficient Permissions with HTTP 401

     
    Property Name Reject Insufficient Permissions with HTTP 401
    Property Key
    Property Type BOOLEAN
    Description If enabled, an HTTP 401 will be used instead of an HTTP 403 response for unauthorized operations. See Rejecting Unauthorized FHIR Calls for more information.
    Applies to Modules
    • FHIR Gateway REST Endpoint
    • FHIR REST Endpoint (All FHIR Versions)
    • FHIR REST Endpoint (DSTU2 - Deprecated)
    • FHIR REST Endpoint (R3 - Deprecated)
    • FHIR REST Endpoint (R4 - Deprecated)
    • Hybrid Providers REST Endpoint
    Default Value false
    Example Property 
    module.[MODULE_ID].config.fhir_endpoint_security.reject_insufficient_permissions_with_401 = false

    43.47.5Property: Watermark Responses Enabled

     
    Property Name Watermark Responses Enabled
    Property Key
    Property Type BOOLEAN
    Description This setting enables Response Watermarking, which injects an extension into returned resources containing several details about the access path used to retrieve the resource including the Transaction GUID, a timestamp, and the full resource fetch URL. See Response Watermarking for more information.
    Applies to Modules
    • FHIR Gateway REST Endpoint
    • FHIR REST Endpoint (All FHIR Versions)
    • FHIR REST Endpoint (DSTU2 - Deprecated)
    • FHIR REST Endpoint (R3 - Deprecated)
    • FHIR REST Endpoint (R4 - Deprecated)
    • Hybrid Providers REST Endpoint
    Default Value false
    Example Property 
    module.[MODULE_ID].config.fhir_endpoint_security.watermark_responses.enabled = false

    43.47.6Property: Scopes Supported

     
    Property Name Scopes Supported
    Property Key
    Property Type STRING
    Description A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
    Applies to Modules
    • FHIR Gateway REST Endpoint
    • FHIR REST Endpoint (All FHIR Versions)
    • FHIR REST Endpoint (DSTU2 - Deprecated)
    • FHIR REST Endpoint (R3 - Deprecated)
    • FHIR REST Endpoint (R4 - Deprecated)
    • Hybrid Providers REST Endpoint
    • SMART Inbound Security
    • SMART Outbound Security
    Default Value openid fhirUser
    Example Property 
    module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser
       43.46    Resource Providers
  • Configuration Categories
  • 43.0 Web Admin Console Settings
  • 43.1 appSphere
  • 43.2 Payer Config
  • 43.3 Initial appSphere Seeding
  • 43.4 Authentication Callback Scripts
  • 43.5 Auth: General for APIs
  • 43.6 User Authentication
  • 43.7 Auth: HTTP Basic
  • 43.8 Auth: OpenID Connect
  • 43.9 Browser Syntax Highlighting
  • 43.10 Camel
  • 43.11 Capability Statement (metadata)
  • 43.12 Care Gaps
  • 43.13 CDA Generation
  • 43.14 CDA Import
  • 43.15 CDA Interceptors
  • 43.16 CDA JavaScript Execution Scripts
  • 43.17 CDA Terminology
  • 43.18 CDS Hooks Definitions
  • 43.19 Channel Import
  • 43.20 Channel Retry
  • 43.21 Kafka
  • 43.22 Cluster Manager Maintenance
  • 43.23 Message Broker
  • 43.24 Cluster Level Security
  • 43.25 CQL
  • 43.26 Credentials
  • 43.27 Cross-Origin Resource Sharing (CORS)
  • 43.28 Database
  • 43.29 Da Vinci Health Record Exchange
  • 43.30 DQM
  • 43.31 DTR
  • 43.32 Email Configuration
  • 43.33 Encounter Start CDS hook configuration
  • 43.34 MDM UI
  • 43.35 ETL Import: CSV Properties
  • 43.36 ETL Import: Source
  • 43.37 FHIR Binary Storage
  • 43.38 FHIR Bulk Operations
  • 43.39 Capability Statement
  • 43.40 FHIR Configuration
  • 43.41 Consent Service
  • 43.42 FHIR Endpoint Conversion
  • 43.43 FHIR Endpoint HFQL Support
  • 43.44 Interceptors
  • 43.45 FHIR Endpoint Partitioning
  • 43.46 Resource Providers
  • 43.47 FHIR Endpoint Security
  • 43.48 Endpoint Terminology
  • 43.49 FHIR Gateway Configuration
  • 43.50 FHIR Interceptors
  • 43.51 LiveBundle Service
  • 43.52 FHIR MDM Server
  • 43.53 FHIR Performance
  • 43.54 FHIR Performance Tracing
  • 43.55 FHIR Realtime Export
  • 43.56 Repository Validation
  • 43.57 FHIR Resource Types
  • 43.58 FHIR REST Endpoint
  • 43.59 FHIR Search
  • 43.60 Custom Resource Types
  • 43.61 IG Support
  • 43.62 MegaScale
  • 43.63 FHIR Storage Module Conditional Updates
  • 43.64 FHIR Storage Module Scheduled Tasks
  • 43.65 FHIR Validation Services
  • 43.66 FHIR Storage Package Registry
  • 43.67 FHIR Storage Partitioning
  • 43.68 Versioned References
  • 43.69 FHIR Subscription Delivery
  • 43.70 FHIR Subscription Persistence
  • 43.71 Amazon HealthLake REST Endpoint
  • 43.72 HL7 v2.x Mapper - Contained Resource
  • 43.73 HL7 v2.x Mapper - DG1
  • 43.74 HL7 v2.x Mapper - Forced Namespace Mode
  • 43.75 HL7 v2.x Mapper - General
  • 43.76 HL7 v2.x Mapper - Medications
  • 43.77 HL7 v2.x Mapper - OBR
  • 43.78 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 43.79 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 43.80 HL7 v2.x Mapper - PID
  • 43.81 HL7 v2.x Mapper - PV1
  • 43.82 Listener Interceptors
  • 43.83 HL7 v2.x Listener Script
  • 43.84 HL7 v2.x MLLP Listener
  • 43.85 HL7 v2.x MLLP Sender
  • 43.86 FHIR to HL7 v2.x Mapper Script
  • 43.87 HL7 v2.x Outbound Mapping
  • 43.88 Da Vinci Health Record Exchange (HRex)
  • 43.89 HTTP Access Log
  • 43.90 HTTP Listener
  • 43.91 HTTP Request Pool
  • 43.92 HTTP Security
  • 43.93 Hybrid Providers Definitions
  • 43.94 Initial User Seeding
  • 43.95 JavaScript Execution Environment
  • 43.96 JSON Web KeySet (JWKS)
  • 43.97 LDAP Authentication
  • 43.98 Smile CDR License
  • 43.99 Lucene FullText Indexing
  • 43.100 MDM
  • 43.101 Narrative Generator
  • 43.102 OpenID Connect Token Validation
  • 43.103 OpenID Connect (OIDC)
  • 43.104 Payer to Payer
  • 43.105 Prior Authorization Coverage Requirement Discovery
  • 43.106 Privacy Security Notice
  • 43.107 Provenance Injection
  • 43.108 Realtime Export
  • 43.109 Endpoint Validation: Request Validating
  • 43.110 Scheduler Configuration
  • 43.111 Search Parameter Seeding
  • 43.112 SAML Provider
  • 43.113 Security Inbound Script
  • 43.114 Inbound SMART on FHIR Authentication
  • 43.115 Inbound SMART on FHIR Endpoints
  • 43.116 OAuth2/OIDC Federation
  • 43.117 SMART Callback Script
  • 43.118 Cross-Organizational Data Access Profile
  • 43.119 SMART Login Skin
  • 43.120 SMART Login Terms of Service
  • 43.121 SMART Authorization
  • 43.122 SMART Definitions Seeding
  • 43.123 Sessions
  • 43.124 Two Factor Authentication
  • 43.125 TLS / SSL (Encryption)
  • 43.126 Transaction Log
  • 43.127 Trusted Client
  • 43.128 User Self Registration
    • 43.48    Endpoint Terminology