Page Comparison

Send & Get API-key

All Some clients (all client_typeswhich `access_type` = BROKER) must be send (mandatory) API-key as a attribute `API-key` in HEADER all request.

Example:

curl --include \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer mF_9.B5f-4.1JqM" \
     --header "API-key: d09vQUFlWTZ6Q0RXRDJISldUOVQ3dz09" \
     --data-binary "{
  \"medication_request_request\": { 
....

Manage MIS

broker scope 

For some clients (client_type = MIS) which provide transfer for call API - we need mandatory validate possibility access to API endpoints.

Proposed use new column attribute `validate_broker_scopes` (boolean) in table in JSON object in column `client.priv_typessettings`.

If attribute `broker_scopes` not exist in `client.priv_settings` - we don`t need validate access over broker!

For clients (client_type = MIS) on which we will check access for call API endpoint - we need describe the list `broker_scopes`. 
Proposed manage & store list  `broker_scopes` in attribute `settings` in table `clients`. 

Example:

{
  "allowed_grant_types": [
    	"password",
    	"access_token"
  ],
  "access_type": "direct",
  "broker_scopes": 
  		"legal_entity:read
		 declaration:read
		 employee:read"
}

In case of need complex disconnect MIS for transfer of call API endpoints - we need full clear him `broker_scopes`.
Clear, but not delete!

Validate MIS transfer scope

When MSP call specific API endpoint over (transfer) MIS we need validate possibility to access.

1. Get `client_id` from `token`
2. Read `clients` for `client_id`.   (further in the text - `REQUEST_CLIENT`)
3. Read  `API-key` from  `API-key`from HEADER
4. Validate  `API-key`.
   1. Validate exists `secret` in table `clients`
      1. if invalid - return error  "Not found API-key!" (!!! TBD)
   2. Read `client_types` for REQUEST_CLIENT. Validate `access_over_broker`=TRUE 
      1. If invalid - break validation.
   3. Read `clients` with `secret`(API-key) in header.  (further in the text - `BROKER_CLIENT`)
      Read `client_types` for this BROKER_CLIENT. 
      Validate `validate_broker_scopes`=TRUE 
      1. if invalid - return error  "Incorrect API-key!" (!!! TBD)
5. Get `broker_scopes` from  `settings` in table `clients` for `BROKER_CLIENT`
6. Read needed scopes for call API Endpoint (read from GateWay configuration)
7. Validate exist all needed scopes in `broker_scopes` of `BROKER_CLIENT`.
   1. if invalid - return error "Conflict !" (!!! TBD)