...

1. Verify the validity of access token

   1. in case of error - return 401 (“Invalid access token”) in case of validation fails

2. Verify that token is not expired

   1. in case of error - return 401 (“Invalid access token”)

3. Check user scopes in order to perform this action (scope = 'approval:create ')

   1. return 403 (“Your scope does not allow to access this resource. Missing allowances: approval:create ”) in case of invalid scope(s)

Headers

Наприклад:

• Content-Type:application/json

• Authorization:Bearer d368a4b0-4a0e-457a-b267-32359fa6288f

...

1. If service_request block is presented in request

   1. Get Service_request details (only in active status)

   2. use Response.permitted_resources as resources for approval(could be episode or diagnostic_report).

...

1. if forbidden_group block is presented in request

   if diagnoses_group block is presented in request

   1. Check forbidden group in the request exists and is_active in DB

      1. in case of error return - 404 (not found)

Validate diagnoses_group

1. 1. Check diagnoses_ group in the request exists and is_active in DB

      1. in case of error return - 404 (not found)

Validate patient

1. if patient block is presented in request

   1. Get patient_id from URL:

      1. Check person_id from the request equal to the patient_id from URL

         1. in case of error return - 404 (“Approval for one patient can not be created in another patient’s context”)

      2. exists and is_active in DB

         1. in case of error return - 404 (Person is not found)

Validate block child_resource

1. if child_resource is not empty:

   1. validate that access_level == read

      1. in case of error return - 422 ("$.access_level. value is not allowed in enum")

   2. check that $.child_resource.identifier.value context is equal to $.resource.identifier.value

      1. in case of error return - 422 (Child resource context id is not equal to granted resource id)

   3. validate that service_requests / forbidden_groups / diagnoses_group / patients are not filled

      1. in case of error return - 422 (schema does not allow additional properties)

   4. validate that resources max items = 1

      1. in case of error return - 422 ($.resources.expected a maximum of 1 items but got 2)

Validate person authentication_method

...

Validate authorize_with

The patient can pass the id of his auth_method which he wants to confirm the approval. The necessary auth method can be found by making Get person's auth methods

...

1. All the approvals in status "new" should be deleted 12 hours after creation - env. configuration parameter

2. All approvals with forbidden_group has its own expires_at config parameter - env. configuration parameter

3. All approvals with care_plan has its own expires_at config parameter - env. configuration parameter

4. All approvals with patient has its own expires_at config parameter - env. configuration parameter

5. Approvals with child_resources will be created ON entity which is context of this child_resources

6. For approvals on child_resource with resource and on service_request:

   1. set child resource to block reason

   2. set service_request to block reason

7. Check if for granted_resource and\or for reason there are forbidden groups

   1. if there are items from forbidden group

      1. check type of authentication_method for patient

         1. If type = 'OTP' send SMS (Код <code>: доступ на записи ВІЛ та/або РПП https://bit.ly/nszu1677a)

   2. if there NO forbidden group items 

      1. check type of authentication_method for patient

         1. If type = 'OTP' send SMS (Код авторизації дій в системі eHealth: <code>')

Response structure

See on Apiary

...