Within your Hybrid Provider and CDS-Hooks code, it is a good practice to throw only exceptions that are subclasses of the HAPI FHIR BaseServerResponseException. The HAPI FHIR documentation provides a complete list of available exceptions on this page.
You can specify that an error message is safe to be returned to the client even when Suppress Error Details is enabled by using the setErrorMessageTrusted(boolean) property. In the example below, the message supplied to the exception constructor will be returned to the client even if Suppress Error Details is set.
InternalErrorException exception = new InternalErrorException("Database could not be reached"); exception.setErrorMessageTrusted(true); throw e;