...

1. Verify the validity of access token

   1. Return 401 in case validation fails

2. Check user scopes in order to perform this action (scope = 'merge_request:write')

   1. Return 403 in case invalid scope(s)

Validate request

1. Validate request using schema (TBD)

2. Also, check if process_disclosure_data_consent = true. It means that person confirm to disclose his personal data.

   1. In case of error - return 422 error (Patient should approve disclosure of his personal data).

Validate legal entity

Check that legal entity is active (status = ACTIVE, SUSPENDED)

...