On this page:
   35.30    FHIR Endpoint Conversion 35.32    Interceptors   

35.31FHIR Endpoint Security

 

The FHIR Endpoint Security configuration category includes the following configurable options:

  • Automatically Narrow Search Scope

  • Reject Insufficient Permissions with HTTP 401

35.31.1Property: Automatically Narrow Search Scope

 
Property Name Automatically Narrow Search Scope
Property Key
Property Type BOOLEAN
Description When enabled, the server will automatically try to narrow the scope of searches when the user only has permission to access specific instances or compartments. For example, when a user only has the FHIR_READ_ALL_IN_COMPARTMENT/Patient/123 permission and tries to perform a search for Observation?code=foo, this search will be performed automatically as Observation?subject=Patient/123&code=foo.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (DSTU2)
  • FHIR REST Endpoint (R3)
  • FHIR REST Endpoint (R4)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.automatically_narrow_search_scope = false

35.31.2Property: Reject Insufficient Permissions with HTTP 401

 
Property Name Reject Insufficient Permissions with HTTP 401
Property Key
Property Type BOOLEAN
Description If enabled, an HTTP 401 will be used instead of an HTTP 403 response for unauthorized operations. See Rejecting Unauthorized FHIR Calls for more information.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (DSTU2)
  • FHIR REST Endpoint (R3)
  • FHIR REST Endpoint (R4)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.reject_insufficient_permissions_with_401 = false
   35.30    FHIR Endpoint Conversion 35.32    Interceptors