Patient Access API usage capture uses three modules, and a fourth to record usage in the CMS trace repository. The following properties show a complete configuration, using the module IDs from the How-to Guides.

# SMART on FHIR Inbound Security: validates the IdP's access tokens
module.smart_auth_pa.type=SECURITY_IN_SMART
module.smart_auth_pa.config.seed_servers.file=classpath:/config_seeding/oidc-servers-pa.json
module.smart_auth_pa.config.callback_script.file=classpath:/scripts/PatientAccessAuthCallback.js

# FHIR Endpoint: serves Patient Access API requests
module.http_patient_access.type=ENDPOINT_FHIR_REST
module.http_patient_access.requires.PERSISTENCE_ALL=persistence
module.http_patient_access.requires.SECURITY_IN_OIC=smart_auth_pa
module.http_patient_access.config.port=8011
module.http_patient_access.config.context_path=/patient-access-fhir
module.http_patient_access.config.security.oic.enabled=true
module.http_patient_access.config.security.http.basic.enabled=false
module.http_patient_access.config.anonymous.access.enabled=false
module.http_patient_access.config.interceptor_bean_types=com.smilecdr.custom.patient.access.PatientAccessTxLogEnrichmentInterceptor

# Transaction Log Broker: publishes Patient Access API events to Kafka
module.tx_broker_patient_access.type=TRANSACTION_LOG_BROKER
module.tx_broker_patient_access.config.broker.channel_name=channel_patient_access_txlog
module.tx_broker_patient_access.config.event_whitelist=http_patient_access.FHIR_REQUEST|*
module.tx_broker_patient_access.config.persist_bodies_in_clustermgr_db=false

# Camel (optional): records Patient Access API events in the CMS trace repository
module.camel_patient_access.type=CAMEL
module.camel_patient_access.config.routes.script.file=classpath:/config_seeding/transaction-log-processor-patient-access.xml
module.camel_patient_access.config.functions.script.file=classpath:/config_seeding/transaction-log-processor-patient-access.js
module.camel_patient_access.config.definitions.spring_context_config.class=cdr.prior.auth.pas.txlog.PatientAccessEnrichmentAppCtx
module.camel_patient_access.config.enable_transaction_log_on_all_routes=false

The Camel module requires the JQ libraries in smilecdr/customerlib, and its enrichment reads the PATIENT_ACCESS_ENRICHMENT_FHIR_BASE_URL, PATIENT_ACCESS_ENRICHMENT_FHIR_USERNAME, and PATIENT_ACCESS_ENRICHMENT_FHIR_PASSWORD environment variables. It posts to the trace endpoint, which is configured separately and shared with other CMS APIs. See CMS Trace Configuration and Record Usage in the Trace Repository.

Values That Must Match

Value	Where It Is Set	Where It Is Used
Endpoint module ID (`http_patient_access`)	FHIR Endpoint module	The `event_whitelist` of the Transaction Log Broker module.
User data keys (`patient_id`, `client_id`, `subject`)	Callback script	Transaction log interceptor, the Patient Access transformer, and the downstream reporting consumer.
Access token claim names (`patient`, `client_id` or `azp`, `sub`)	The payer's IdP	Callback script.
Topic name (`channel_patient_access_txlog`)	Transaction Log Broker module	The `topic` of the Camel route, or the downstream reporting consumer.
Trace endpoint base URL (`http://localhost:8008/trace-fhir`)	Trace FHIR Endpoint module	The `http` URI of the Camel route.
System user (`SYSTEM-USER-TXLOG`) and password (`JS_SYSTEM_USER_PASSWORD`)	The trace endpoint's inbound security module	The `setBasicAuthHeaderTXLOG` function of the Camel module.
Application client ID (`https://smiledigitalhealth.com/credentialmap/oidc/client` identifier)	The application's `Organization` in the payer's FHIR repository	The enrichment lookup of the application's name. Must equal the client ID claim of the access token.

Usage Communication Format