Properties of a REST API method document

Purpose

...

Describe the purpose of the API method, add Key points (if necessary)

Logic

Description of the working algorithm of the API method and the interaction of services with each other add Service logic (if necessary)

Configuration parameters

Description of the configuration parameters that are used when processing a request in the system

Dictionaries

Provides a list of links to dictionaries that are available in Confluence

Input parameters

...

This method must be used to recall existing Service Request.

Logic

Відміна направлення (Recalled)

This method must be used to recall existing Service Request. Method receives signed message (pkcs7) that consists of signed content, digital signature and signer public key. All signature fields will be validated (including signer certificate authority)

Important

1. Signed content of service request must be equal to service request stored in DB. See Get Service Request details

2. status_reason and explanatory_letter (optional) must be added to signed content

Please see Service request (Referral) state model and Dummy Recall Service Request for more details

Service logic

1. Save signed content to media storage

2. Update service request status to Recalled (update also updated_at, updated_by)

3. Write record to status history

4. Send SMS to patient (if authentication_method_current == SMS, do NOT send sms in case performer is present in SR)

5. Send SMS to patient (if authentication_method_current == SMS)

   1. Template - TBD

6. Async! Revoke all approvals made by this service request

7. if the service request is based on activity with quantity:

   1. Recalculate and set remaining_quantity for the activity as described at PreQualify Service Request | Validate service request

Configuration parameters

N/A

Dictionaries

N/A

Input parameters

Request structure

See on API-specification (посилання на сторінку з API-специфікацією)

Description of the REST API request structure, example

{
  "signed_data": "ew0KICAicGVyaW9kIjogew0KIC..."
}

Headers

...

Headers

...

Request data validation

...

Mandatory

...

Description

...

Example

...

Content-Type

...

application/json

...

M

...

Тип контенту

...

Content-Type:application/json

...

Authorization

...

Bearer c2778f3064753ea70de870a53795f5c9

...

M

...

Перевірка користувача

...

Authorization:Bearer c2778f3064753ea70de870a53795f5c9

...

Request data validation

Describe the process of checking the input data transmitted in the request for compliance with the given rules and restrictions set in the API

Processing

A list of processes related to receiving, changing or transmitting data according to the logic defined in the REST API

Response structure examples

...

Authorize

• Verify the validity of access token

  • Return (401, 'unauthorized') in case of validation fails

• Verify that token is not expired

  • in case of error - return (401, 'unauthorized')

• Check user scopes in order to perform this action (scope = 'service_request:write')

  1. Return (403, 'invalid scopes') in case of invalid scope(s)

• If BLOCK_UNVERIFIED_PARTY_USERS is true, then check party's data match following condition: verification_status != NOT_VERIFIED or (verification_status = NOT_VERIFIED and updated_at > current_date - UNVERIFIED_PARTY_PERIOD_DAYS_ALLOWED):

  • in case not match - return 403 ("Access denied. Party is not verified")

• If BLOCK_DECEASED_PARTY_USERS is true, check that party is not deceased (party_verification record does not equal to: dracs_death_verification_status = VERIFIED and dracs_death_verification_reason = MANUAL_CONFIRMED):

  • in case of error - return 403 ("Access denied. Party is deceased")

Request to process the request using a token in the headers

Validate legal entity

• Check legal entity type: it has to be in me_allowed_transactions_le_types config parameter, has status = active and nhs_verified = true

  • in case of error return 409 "Action is not allowed for the legal entity"

Validate digital signature

Decode content that is encrypted in an electronic digital signature.
Use Digital signature WS. Method checks digital signature and returns result.
See service specification

1. Ensure that digital signature is valid

1. Validate that requester of service request is a current user

2.1. Get token metadata

• Extract user_id, client_id, client_type

2.2. Determine the party_id associated with this user_id

SELECT pu.party_id FROM party_users pu
WHERE pu.user_id = :user_id;

2.3. Determine employees related to this party_id in current MSP

SELECT e.id FROM employees e WHERE e.party_id = :party_id
AND e.legal_entity_id = :client_id;

2.4 Ensure that $.requester.identifier.value matches with user employees

1. Validate that DS belongs to the requester of encounter

3.1. Determine the party_id associated with requester ($.requester.identifier.value)

SELECT p.tax_id FROM employees e, parties p WHERE e.party_id = p.id
AND e.id = :requester;

Validate request using JSON Schema

Return 422 with the list of validation errors in case validation fails

Validate permission to recall

Only doctor who signed this service request is able to recall this service request

Covered by DS validation (see Validate digital signature p.2)

Validate user

Recalling a Service Request is allowed for user if he has one of the following active and approved employee that:

• is an Employee from legal entity where Service Request is created

  • in case of error - return 409 ("Only an employee from legal entity where service request is created can recall service request")

Validate transition

Only active service request can be recalled

1. Get current service request status

   1. Check that status in ('active')

      1. in case of error - return 409 error ('Service request in status %status% cannot be recalled')

Validate recall reason

1. Validate $.status_reason is a value from eHealth/service_request_recall_reasons dictionary

   1. in case of error - return 422 ("value is not allowed in enum")

Validate content

Signed content must match with service request in DB in order to be recalled

1. Render service request from DB

2. Exclude $.status_reason and $.explanatory_letter from signed content

3. Compare rendered service request and signed content

   1. In case both object doesn't match - return 422 ('Signed content doesn't match with previously created service request')

Processing

N/A

Response structure examples

See on API-specification

{
  "data": {
    "status": "pending",
    "eta": "2018-08-02T10:45:16.000Z",
    "links": [
      {
        "entity": "job",
        "href": "/Jobs/NBXk9EyErUZv1RhXgyvgg"
      }
    ]
  },
  "meta": {
    "code": 202,
    "url": "http://example.com/resource",
    "type": "object",
    "request_id": "req-adasdoijasdojsda"
  }
}

HTTP status codes

Post-processing processes

...

Post-processing processes

N/A

Technical modules where the method is used

List of pages describing technical modules where the method is used

...