Anonymous
This role must be granted to any user that will be used for anonymous access requests. See Anonymous Access for more information.

FHIR Client
User has permission to access the FHIR services as a client.

FHIR Client (Superuser)
User has permission to perform any standard FHIR client operation. This does not imply superuser status for other parts of the CDR (e.g. user management, FHIR search parameter modification, etc.).

FHIR Client (Read-Only Superuser)
User has permission to perform any standard FHIR client read/fetch operation. This permission allows the user to perform any read, search, history, etc. operation but does not allow the user to perform create, update, etc. This permission does not imply superuser status for other parts of the CDR (e.g. user management, FHIR search parameter modification, etc.).

FHIR Terminology Service Read-Only Client
User is permitted to invoke any terminology read-only operations. In other words, this role includes various capabilities relating to accessing data in the FHIR terminology services. This includes operations such as $lookup and $validate-code, as well as read and search capabilities on ValueSet, CodeSystem, and ConceptMap resources.

Superuser
User has all permissions to do anything. Use this permission with caution since it gives the user access to almost all administrative functions.

Access JSON Admin API Endpoint
User is allowed to invoke operations on the JSON Admin API endpoint. Note that this permission does not give the user the ability to actually perform any of the functions on the API so this permission is generally granted in combination with at least one other.

This permission does not take any arguments.

Admin
User is allowed to log into the Web Admin Console.

This permission does not take any arguments.

Access EasyShare
This permission allows a user to authenticate for EasyShare services and/or web applications. This permission is not typically granted directly, and is instead implied by other specific EasyShare permissions such as EASYSHARE_CREATE_SMART_HEALTH_LINK.

This permission does not take any arguments.

Access FHIRWeb Console
User is allowed to access the FHIRWeb Console, which can be used for testing, building FHIR queries, and exploring data in the database. Note that this permission only allows access to the FHIRWeb Console; the user still needs to have other appropriate permissions for any desired operations or they will be blocked.

This permission does not take any arguments.

FHIR Client
User is allowed to access FHIR services as a client.

This permission does not take any arguments.

appSphere Admin Console (read)
User is permitted to access application information using appSphere Admin Console

This permission does not take any arguments.

appSphere Admin Console (write)
User is permitted to update existing application information using appSphere Admin Console

This permission does not take any arguments.

appSphere Developer Portal (read)
User is permitted to access application information using appSphere Developer Portal

This permission does not take any arguments.

appSphere Developer Portal (write)
User is permitted to add new application information using appSphere Developer Portal

This permission does not take any arguments.

Archive Modules
User is allowed to archive modules.

This permission does not take any arguments.

Import CDA Documents
User is allowed to use the $import-cda operation to import CDA documents

This permission does not take any arguments.

Change Own Launch Contexts
User is allowed to update the SMART launch context(s) associated with their own account.

This permission does not take any arguments.

Change Own Password
User is allowed to change their own password.

This permission does not take any arguments.

Can set own 2FA Key
User is allowed to set up their own 2FA key (as opposed to having one assigned by an administrator).

This permission does not take any arguments.

Control Module
User is allowed to start/stop/restart modules.

This permission does not take any arguments.

Create CDA templates
User is allowed to create (and update existing) CDA document template scripts. Use this permission with caution, as these scripts, when called upon, have the ability to create, view, and modify data without additional permissions.

This permission does not take any arguments.

Create Modules
User is allowed to create new modules.

This permission does not take any arguments.

Create Users
User is allowed to create other users.

This permission does not take any arguments.

Delete CDA templates
User is allowed to delete CDA document template scripts.

This permission does not take any arguments.

DOCREF
User is allowed to use $docref operation

This permission does not take any arguments.

Dqm QPP Build
Transform MeasureReport into QPP format

This permission does not take any arguments.

Create SMART Health Link
User is allowed to create a SMART Health Link using either the EasyShare SHL REST API or the EasyShare SHL Admin Application.

This permission does not take any arguments.

EMPI Admin
User may perform any administrative functions for the EMPI.

This permission does not take any arguments.

EMPI Update Match Rules
User can set/update matching rules for the EMPI.

This permission does not take any arguments.

EMPI VIEW Match Rules
User can view matching rules for the EMPI.

This permission does not take any arguments.

ETL Import / Process File
User is allowed to initiate the processing of an ETL import job. Use this permission with caution, as import jobs have a large amount of flexibility to create and modify data and do not require additional permissions.

This permission does not take any arguments.

Access data in ALL Partitions
User is allowed to access (includes both read and write operations) data in all partitions. Note that this permission does not actually authorize any specific read/write operations, it simply implies access to the partitions.

This permission does not take any arguments.

Access data in Partition
User is allowed to access (includes both read and write operations) data in the given partition. Note that this permission does not actually authorize any specific read/write operations, it simply implies access to the given partition.

Argument
The argument to this permission is a partition name, or a comma separated collection of partition names

FHIR Delete (All)
User is allowed to perform any FHIR delete operation.

This permission does not take any arguments.

FHIR Read (All)
User is allowed to perform any FHIR read/access-to-data operation (e.g. read, search, history, etc.).

This permission does not take any arguments.

FHIR Write (All)
User is allowed to perform any FHIR write/modify operation (e.g. create, update, etc.).

This permission does not take any arguments.

Automatic MDM Expansion
Perform MDM expansion for all search parameters in the Patient compartment, even if the :mdm qualifier is not explicitly provided in the query

This permission does not take any arguments.

FHIR Batch
User is allowed to perform a FHIR Batch. Note that this permission only allows the batch operation to happen; the user still needs to have other appropriate permissions for the operations in the batch or it will be blocked.

This permission does not take any arguments.

FHIR Access Server Capability Statement (metadata)
User is allowed to access the server's capability statement. This permission is often granted to anonymous users.

This permission does not take any arguments.

FHIR Delete (All in Compartment)
User is permitted to delete any resource in the given compartment.

Argument
The argument to this permission is the name of the compartment to which access is being granted.

FHIR Delete (All of Type)
User is allowed to delete any resource of the type specified in the argument (e.g. Patient).

Argument
The argument to this permission is the resource type.

FHIR Delete - Cascading Allowed
User is permitted to perform cascading deletes. See Cascading Deletes for more information.

This permission does not take any arguments.

FHIR Delete and Expunge ($delete-expunge) All Data
User is permitted to invoke the $delete-expunge operation to permanently delete ALL data on the server. This is a dangerous operation, as it causes data to be permanently deleted. Use caution when granting this permission. See deleting data for information on this operation. Note that the ROLE_FHIR_CLIENT_SUPERUSER role does not grant this permission, it must be explicitly enabled.

This permission does not take any arguments.

FHIR Delete (Specific Type in Compartment)
User is permitted to delete any resource of the given type in the given compartment.

Argument
The argument to this permission is the name of the type to allow deletion on, followed by a colon, followed by the name of the compartment to which access is being granted. For example, the argument Observation:Patient/123 means that the user is permitted to delete any Observation resource in the Patient/123 compartment.

DTR User privileges
Can execute any DTR operation

This permission does not take any arguments.

EMPI Administrative privileges
Can execute any EMPI operation.

This permission does not take any arguments.

FHIR Expunge ($expunge) Deleted Resources
User is permitted to invoke the $expunge operation to permanently delete logically deleted resources. This is a dangerous operation, as it causes data to be permanently deleted. Use caution when granting this permission. See [/docs/fhir_repository/deleting_data.html](deleting data) for information on this operation. Note that the ROLE_FHIR_CLIENT_SUPERUSER role does not grant this permission, it must be explicitly enabled.

This permission does not take any arguments.

FHIR Expunge ($expunge) All Data
User is permitted to invoke the $expunge operation to permanently delete ALL data on the server. This is a dangerous operation, as it causes data to be permanently deleted. Use caution when granting this permission. See [/docs/fhir_repository/deleting_data.html](deleting data) for information on this operation. Note that the ROLE_FHIR_CLIENT_SUPERUSER role does not grant this permission, it must be explicitly enabled.

This permission does not take any arguments.

FHIR Expunge ($expunge) Previous Versions
User is permitted to invoke the $expunge operation. This is a dangerous operation, as it causes data to be permanently deleted. Use caution when granting this permission. See [/docs/fhir_repository/deleting_data.html](deleting data) for information on this operation. Note that the ROLE_FHIR_CLIENT_SUPERUSER role does not grant this permission, it must be explicitly enabled.

This permission does not take any arguments.

Extended Operation (Instance Level / Unchecked Response)
User may invoke operation at the instance level on any operation name specified by argument in the form: $fooOperation. When using this permission, the operation response is not validated/authorized in any way, so this authority should only be granted for operations that are known to be appropriate for the user.

Argument
The argument to this permission is the operation name.

Extended Operation (Instance Level / Unchecked Response)
User may invoke operation at the instance level with type and operation name specified by argument in the form: Patient/$fooOperation. When using this permission, the operation response is not validated/authorized in any way, so this authority should only be granted for operations that are known to be appropriate for the user.

Argument
The argument to this permission is the resource type and operation name.

Extended Operation (Server Level / Unchecked Response)
User may invoke operation with name specified by argument (e.g. $fooOperation). When using this permission, the operation response is not validated/authorized in any way, so this authority should only be granted for operations that are known to be appropriate for the user.

Argument
The argument to this permission is the resource type and operation name.

Extended Operation (Type Level / Unchecked Response)
User may invoke operation at the type level with type and name specified by argument in the form: Patient/$fooOperation. When using this permission, the operation response is not validated/authorized in any way, so this authority should only be granted for operations that are known to be appropriate for the user.

Argument
The argument to this permission is the resource type and operation name.

Extended Operation (Server Level / Unchecked Response)
User may invoke any operation except for $expunge and $delete-expunge. When using this permission, the operation response is not validated/authorized in any way, so this authority should only be granted for operations that are known to be appropriate for the user.

This permission does not take any arguments.

FHIR Get Server Resource Counts
User is permitted to call the $get-resource-counts operation, requesting the total counts of resources on the server.

This permission does not take any arguments.

FHIR GraphQL Operation
User may invoke the GraphQL Operation. Note that user must still have additional permissions to see the resources being requested via GraphQL.

This permission does not take any arguments.

FHIR LiveBundle Operations
User is allowed to invoke the $livebundle-watchlist-add, $livebundle-watchlist-delete, $livebundle-watchlist, and $livebundle operations

This permission does not take any arguments.

Manage Partitions
User is allowed to manage (add/update/delete) partition definitions in the system. Note that this permission is not automatically granted via the ROLE_FHIR_CLIENT_SUPERUSER permission and must be granted explicitly.

This permission does not take any arguments.

FHIR Manual Validation
User is allowed to invoke the $validate operation to validate resources.

This permission does not take any arguments.

MDM Administrative privileges
Can execute any MDM operation

This permission does not take any arguments.

Resource Metadata Operations: Superuser
User is allowed to invoke the resource metadata operations ($meta, $meta-add, and $meta-delete) on any resource.

This permission does not take any arguments.

Modify Search Parameters
User is allowed to create, update, and delete search parameters.

This permission does not take any arguments.

Apply
Execute the Apply Operation

This permission does not take any arguments.

FHIR Binary Access Operations (read)
User is allowed to invoke the $binary-access-read operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)

This permission does not take any arguments.

FHIR Binary Access Operations (write)
User is allowed to invoke the $binary-access-write operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)

This permission does not take any arguments.

CR Care Gaps
The care-gaps operation is used to determine gaps-in-care based on the results of quality measures.

This permission does not take any arguments.

CR Collect Data
The effect of invoking this operation is to gather the data required to perform an evaluation of the measure.

This permission does not take any arguments.

CR CQL
Evaluates a CQL expression and returns the results as a Parameters resource.

This permission does not take any arguments.

CR Data Requirements
The effect of invoking this operation is to determine the aggregate set of data requirements and dependencies for the measure.

This permission does not take any arguments.

EMPI Clear Links
Delete all EMPI links, and remove all related Persons

This permission does not take any arguments.

EMPI Duplicate Persons
Request all EMPI Duplicate Persons

This permission does not take any arguments.

Merge to EMPI Person resources
Merge one Person resource into another, copying over fields that are empty in the target, and copying over links that are missing in the target. MANUAL links will overwrite AUTO links. The original Person resource is deleted.

This permission does not take any arguments.

EMPI Query Links
Request matching EMPI Links

This permission does not take any arguments.

EMPI Batch Processing.
Submit Patients/Practitioners for EMPI processing.

This permission does not take any arguments.

EMPI Update Link
Update an EMPI Link

This permission does not take any arguments.

Encounter Fetch ($everything)
User is allowed to search/fetch across the entire encounter (all resources belonging to that patient's compartment).

This permission does not take any arguments.

CR Evaluate
The evaluate operation is used to evaluate cql expressions from a specified library resource and returns it as a Parameters resource.

This permission does not take any arguments.

Evaluate Measure
Execute the CQL Evaluate Measure Operation

This permission does not take any arguments.

Evaluate Measures
Execute the $evaluate-measures Operation, that allows for processing multiple Measure resources to create multiple MeasureReports with the same subject population

This permission does not take any arguments.

Extract
Execute the Extract Operation

This permission does not take any arguments.

Initiate Bulk Export ($export) - All Permissions
User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate any kind of bulk export, so it may be more appropriate to use a more nuanced kind.

Argument
The argument to this permission is an optional space-separated list of allowed resource types, or an empty string to allow all resource types. E.g. 'Patient Encounter Observation'.

Initiate Bulk Export ($export) - Patient Export with no restrictions
User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate a patient-level export with NO restrictions

Argument
There are no arguments for this permission

Initiate Bulk Export ($export) - Group Export
User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate a group-level export.

Argument
The argument to this permission is the ID of the group that the user is authorized to export, optionally followed by a space-separated list of allowed resource types. E.g. 'Group/123' or 'Group/123 Patient Encounter Observation'.

DEPRECATED: Initiate Bulk Export ($export) - Patient Export
Note: Since 2024.05, this permission has been DEPRECATED in favour of FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS and FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS: User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate a patient-level export.

Argument
DEPRECATED: The argument to this permission is the ID of the patient that the user is authorized to export, optionally followed by a space-separated list of allowed resource types. E.g. 'Patient/123' or 'Patient/123 Patient Encounter Observation'.

Initiate Bulk Export ($export) - Patient Export with restrictions on patient IDs and resources
User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate a patient-level export with restrictions on patient IDs and resources.

Argument
The argument to this permission is the comma-separated IDs of the patient that the user is authorized to export, followed either by a * to indicate all resources or a space-separated list of allowed resource types. E.g. 'Patient/123,Patient/456 *' or 'Patient/123,Patient/465 Patient Encounter Observation'.

Initiate Bulk Export ($export) - System Export
User may invoke the $export operation to initiate a FHIR Bulk Export Operation. This permission grants the user permission to initiate a system-level export.

Argument
The argument to this permission is an optional space-separated list of allowed resource types, or an empty string to allow all resource types. E.g. 'Patient Encounter Observation'.

Initiate Bulk Import ($import)
User may invoke the FHIR Bulk Import operation. Note that data being bulk imported is not subjected to any additional authorization checks, so this permission should only be granted to fully trusted users.

This permission does not take any arguments.

MDM Clear Links
Delete all MDM links and remove all related Golden Resources

This permission does not take any arguments.

MDM Create Link
Create an MDM Link

This permission does not take any arguments.

MDM Duplicate Golden Resources
Request all MDM Duplicate Golden Resources

This permission does not take any arguments.

MDM Link History
Request matching Historical MDM Links

This permission does not take any arguments.

Merge two MDM Golden Resources
Merge one Golden Resource into another, copying over fields as determined by the survivorship rules, and copying updating MDM links according to the rules. MANUAL links will overwrite AUTO links. The original Golden Resource is deactivated.

This permission does not take any arguments.

MDM Not Duplicate
Unduplicate MDM Golden Resources

This permission does not take any arguments.

MDM Query Links
Request matching MDM Links

This permission does not take any arguments.

MDM Batch Processing.
Submit target resources for MDM processing

This permission does not take any arguments.

MDM Update Link
Update an MDM Link

This permission does not take any arguments.

Member match
Operation to find a member by patient and coverage information

This permission does not take any arguments.

Package
Execute the Package Operation

This permission does not take any arguments.

Patient Search Chart ($everything)
User is allowed to search/fetch across the entire patient's record (all resources belonging to that patient's compartment).

This permission does not take any arguments.

Patient Fetch ($everything) - Access All
User is allowed to search/fetch across the entire patient's record (all resources that references input Patient, including those outside of patient's compartment).

Argument
The argument to this permission is the ID of the Patient for which user is authorized to execute $everything operation. E.g. 'Patient/123'.

FHIR MDM Match
User may invoke the MDM $match operation either on a server level or on a Patient type

This permission does not take any arguments.

Generate IPS ($summary)
User is allowed to invoke the $summary operation to generate an International Patient Summary document.

This permission does not take any arguments.

Populate
Execute the Populate Operation

This permission does not take any arguments.

Prepopulate
Execute the Prepopulate Operation

This permission does not take any arguments.

FHIR StructureDefinition Snapshot
User may invoke the StructureDefinition $snapshot operation

This permission does not take any arguments.

CR Submit Data
The submit-data operation is used to submit data-of-interest for a measure. There is no expectation that the submitted data represents all the data-of-interest, only that all the data submitted is relevant to the calculation of the measure for a particular subject or population.

This permission does not take any arguments.

FHIR Patch
Note: Since 2024.05, this permission has been DEPRECATED in favour of various WRITE permissions (create, update, patch, etc.). User is allowed to perform a FHIR patch operation. Note that this permission allows a patch to be performed, but the user may need additional permissions in order to be able to write to specific resources.

This permission does not take any arguments.

FHIR Process Message ($process-message)
User is allowed to invoke the $process-message operation on a server that supports it.

This permission does not take any arguments.

FHIR Read ANY in Compartment X
User is allowed to read resources of any type in the given compartment. This permission takes an argument that should take the form of the name of the compartment (e.g. Patient/123).

Argument
The argument to this permission is the name of the compartment to which access is being granted.

FHIR Read ANY of Type
User is allowed to fetch resources (read, search, history, etc.) of the specified type. This permission takes an argument that should be the name of the resource type (e.g. Patient).

Argument
The argument to this permission is the name of the resource type.

FHIR Read Specific Instance
User is allowed to fetch (read, search, history, etc.) the specified instance. This permission takes an argument that should be the ID of the resource instance (e.g. Patient/123).

Argument
The argument to this permission is the ID of the resource instance (e.g. Patient/123).

Read Search Parameters
User is allowed to read/search for search parameters.

This permission does not take any arguments.

FHIR Read (Specific Type in Compartment)
User is permitted to read any resource of the given type in the given compartment.

Argument
The argument to this permission is the name of the type to allow reading from, followed by a colon, followed by the name of the compartment to which access is being granted. For example, the argument Observation:Patient/123 means that the user is permitted to read any Observation resource in the Patient/123 compartment.

FHIR Transaction
User is allowed to perform a FHIR transaction. Note that this permission only allows the transaction operation to happen; the user still needs to have other appropriate permissions for the operations in the transaction or it will be blocked.

This permission does not take any arguments.

FHIR Trigger Subscription
User is permitted to call the $trigger-subscription operation. See Manually Triggering Subscriptions for information on this function.

This permission does not take any arguments.

History Rewrite
User is allowed to update historical versions of a resource without creating new versions. See Rewrite Resource History for more information.

This permission does not take any arguments.

Upload External Terminology
User is permitted to upload external CodeSystems using the $upload-external-code-system operation, as well as by using the Apply Delta operations. See Uploading External Terminologies for more information on this function.

This permission does not take any arguments.

FHIR Write ANY in Compartment X
User is allowed to write (create, update, patch, etc.) resources of any type in the given compartment. This permission takes an argument that should take the form of the name of the compartment (e.g. Patient/123).

Argument
The argument to this permission is the name of the compartment to which access is being granted.

FHIR Write ANY of Type
User is allowed to write resources (create, update, patch, etc.) of the specified type. This permission takes an argument that should be the name of the resource type (e.g. Patient).

Argument
The argument to this permission is the name of the resource.

FHIR Write Specific Instance
User is allowed to write (create, update, patch, etc.) the specified instance. This permission takes an argument that should be the ID of the resource instance (e.g. Patient/123).

Argument
The argument to this permission is the ID of the resource instance (e.g. Patient/123).

FHIR Write (Specific Type in Compartment)
User is permitted to write (create, update, patch, etc.) any resource of the given type in the given compartment.

Argument
The argument to this permission is the name of the type to allow writing to, followed by a colon, followed by the name of the compartment to which access is being granted. For example, the argument Observation:Patient/123 means that the user is permitted to write any Observation resource in the Patient/123 compartment.

Execute HFQL Query
User is allowed to execute HFQL/SQL statements.

This permission does not take any arguments.

CDS Hooks
User can call CDS Hooks

This permission does not take any arguments.

Manage Batch Jobs
User has permission to manage (i.e. modify and control) batch jobs

This permission does not take any arguments.

MDM Admin
User may perform any administrative functions for the MDM.

This permission does not take any arguments.

MDM Update Match Rules
User can set/update matching rules for the MDM.

This permission does not take any arguments.

MDM VIEW Match Rules
User can view matching rules for the MDM.

This permission does not take any arguments.

Module Admin
User is allowed to create, reconfigure, and start/stop modules.

This permission does not take any arguments.

Add OpenID Connect Client with pre-set permissions.
User is allowed to create OpenID Connect clients with pre-set permissions.

Argument
The argument to this permission is the name of permissions (e.g. ACCESS_FHIRWEB).

Add OpenID Connect Client
User is allowed to create OpenID Connect clients.

This permission does not take any arguments.

Add OpenID Connect Server
User is allowed to create OpenID Connect servers.

This permission does not take any arguments.

Edit OpenID Connect Client
User is allowed to edit existing OpenID Connect clients.

This permission does not take any arguments.

Edit OpenID Connect Server
User is allowed to edit existing OpenID Connect servers.

This permission does not take any arguments.

Manage Sessions (Global/All Users)
User is allowed to list and revoke SMART/OIDC sessions for any users in the system. This is an administrative privilege that should only be granted to admin and system users.

This permission does not take any arguments.

View OpenID Connect Client List
User is allowed to view the list of registered OpenID Connect clients. This permission does not give the user the ability to create/edit clients.

This permission does not take any arguments.

View OpenID Connect Server List
User is allowed to view the list of registered OpenID Connect servers. This permission does not give the user the ability to create/edit servers.

This permission does not take any arguments.

Package Registry: Read Operations
User can access data from the package registry.

This permission does not take any arguments.

Package Registry: Write Operations
User can write data to the package registry.

This permission does not take any arguments.

Reinstate Modules
User is allowed to reinstate modules.

This permission does not take any arguments.

Save Users
User is allowed to create/update users.

This permission does not take any arguments.

Start/Stop Modules
User is allowed to start/stop modules and nodes.

This permission does not take any arguments.

Submit Attachment
User is allowed to use the $submit-attachment operation.

This permission does not take any arguments.

Update Module Configuration
User is allowed to modify a module's configuration.

This permission does not take any arguments.

Update Users
User is allowed to update other users.

This permission does not take any arguments.

Generate CDA documents via the templates
User is allowed to create Compositions / Fhir Documents / CDA Documents via the cda template store. Use caution with this permission with severity relative to how much access the scripts themselves allow.

This permission does not take any arguments.

View Audit Log
User is allowed to view the audit log.

This permission does not take any arguments.

View Batch Jobs
User has permission to view batch jobs

This permission does not take any arguments.

View CDA templates
User is allowed to view all CDA templates (including script contents and expected parameters list).

This permission does not take any arguments.

View Metrics
User can access internal metrics API, including thread dump API

This permission does not take any arguments.

View Module Configuration
User is allowed to view (but not change) module configuration information. This does not include database passwords.

This permission does not take any arguments.

View Module Status
User is allowed to view (but not change) status information about modules. This includes running/stopped status, health checks, etc. but does not give access to more sensitive details such as logs.

This permission does not take any arguments.

View Transaction Log
User is allowed to view the overall transaction log.

This permission does not take any arguments.

View Transaction Log Entries
User is allowed to view individual transaction log entries.

This permission does not take any arguments.

View Users
User is allowed to view list of users and individual user details.

This permission does not take any arguments.

Block FHIR Read Unless Code is in ValueSet
When present, this permission indicates that resources of the given type can not be read unless they have a coded field (indicated by a SearchParameter name) is found in the specified ValueSet (indicated by URL). See Block Unless Code in ValueSet for more information.

Argument
The argument for this permission is in the form [resourceType]/[param name]/[ValueSet URL], e.g. "Observation/code/http://hl7.org/fhir/ValueSet/observation-vitalsignresult"

Block FHIR Read Unless Code is not in ValueSet
When present, this permission indicates that resources of the given type can not be read unless they have a coded field (indicated by a SearchParameter name) is not found in the specified ValueSet (indicated by URL). See Block Unless Code in ValueSet for more information.

Argument
The argument for this permission is in the form [resourceType]/[param name]/[ValueSet URL], e.g. "Observation/code/http://hl7.org/fhir/ValueSet/observation-vitalsignresult"