...

1. Only authenticated and authorized employee with appropriate scope can use this method

2. Method returns all information of Composition that belongs to the specified patient (exclude forbidden groups) context only in case user has access to such Composition aсcording to ABAC rules

3. ABAC rules are used here:

   1. Employee with active declaration (declaration) - @rule_1

   2. Composition created in the employee's MSP (also author and attester) (recorder_legal_entity_id) - @rule_2

   3. Employee can read all the composition data of episodes created in the employee's MSP (also author) (context_episode_id) - @rule_3

   4. Employee with active approval can read all the data (including merged persons/prepersons data) of specified in approval patient - @rule_4

   5. Employee with active approval can read all the data of specified in approval episodes (context_episode_id) - @rule_5

   6. Employee with active approval can read all the data of specified in approval composition - @rule_18

Specification

https://ehealthmedicaleventsapiehealthmedicalevents991v11.docs.apiary.io/#reference/medical-events/composition/get-composition-by-identifier

Authorization

• Verify the validity of access token

  • in case of error - return 401 “Invalid access token” in case of validation fails

• Verify that token is not expired

  • in case of error - return 401 “Invalid access token”

• Check user and client scopes in order to perform this action (scope = 'composition:read')

  • return 403 “Your scope does not allow to access this resource. Missing allowances: composition:read” in case of invalid scope(s)

• Access to the resource is also managed by ABAC module

...