49.48    Resource Providers 49.50    Endpoint Terminology   

49.49.1FHIR Endpoint Security

 

The FHIR Endpoint Security configuration category includes the following configurable options:

  • Allow Searches With Compartment Access

  • Automatically Narrow Search Scope

  • Narrow Conditional URL Search Scope

  • Reject Insufficient Permissions with HTTP 401

  • Watermark Responses Enabled

  • Scopes Supported

49.49.2Property: Allow Searches With Compartment Access

 
Property Name Allow Searches With Compartment Access
Property Key
Property Type BOOLEAN
Description When disabled, the server will proactively reject searches on resource types, even though a resource in the compartment could possibly be in the results. When enabled, the searches will be accepted, but the server will filter the results to only include resources that are in the compartment. Enabling this flag is less secure, as the interceptor may leak the existence of resources that are not in the compartment.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.allow_compartment_searches = false

49.49.3Property: Automatically Narrow Search Scope

 
Property Name Automatically Narrow Search Scope
Property Key
Property Type BOOLEAN
Description When enabled, the server will automatically try to narrow the scope of searches when the user only has permission to access specific instances or compartments. For example, when a user only has the FHIR_READ_ALL_IN_COMPARTMENT/Patient/123 permission and tries to perform a search for Observation?code=foo, this search will be performed automatically as Observation?subject=Patient/123&code=foo. See Block Unless Code in ValueSet for more information. Note that in order to avoid accidental disclosure of non-narrowed resource counts, search total counts will be unavailable if this feature is enabled.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.automatically_narrow_search_scope = false

49.49.4Property: Narrow Conditional URL Search Scope

 
Property Name Narrow Conditional URL Search Scope
Property Key
Property Type BOOLEAN
Description When narrowing search scope, if this setting is enabled the URLs of conditional operations will also be narrowed. For example, the request URL in a Conditional Update operation or the If-None-Exist header in a Conditional Create operation will be narrowed. This setting only applies if Automatically Narrow Search Scope is also enabled.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.automatically_narrow_search_scope.conditional = false

49.49.5Property: Reject Insufficient Permissions with HTTP 401

 
Property Name Reject Insufficient Permissions with HTTP 401
Property Key
Property Type BOOLEAN
Description If enabled, an HTTP 401 will be used instead of an HTTP 403 response for unauthorized operations. See Rejecting Unauthorized FHIR Calls for more information.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.reject_insufficient_permissions_with_401 = false

49.49.6Property: Watermark Responses Enabled

 
Property Name Watermark Responses Enabled
Property Key
Property Type BOOLEAN
Description This setting enables Response Watermarking, which injects an extension into returned resources containing several details about the access path used to retrieve the resource including the Transaction GUID, a timestamp, and the full resource fetch URL. See Response Watermarking for more information.
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
Default Value false
Example Property
module.[MODULE_ID].config.fhir_endpoint_security.watermark_responses.enabled = false

49.49.7Property: Scopes Supported

 
Property Name Scopes Supported
Property Key
Property Type STRING
Description A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
Applies to Modules
  • FHIR Gateway REST Endpoint
  • FHIR REST Endpoint (All FHIR Versions)
  • FHIR REST Endpoint (DSTU2 - Deprecated)
  • FHIR REST Endpoint (R3 - Deprecated)
  • FHIR REST Endpoint (R4 - Deprecated)
  • Hybrid Providers REST Endpoint
  • SMART Inbound Security
  • SMART Outbound Security
Default Value openid fhirUser
Example Property
module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser
   49.48    Resource Providers 49.50    Endpoint Terminology