Purpose*

This WS allows to get detailed observation info from Admin panel.

Specification*

Specification

  "Reads a single `Observation` using its globally unique ID and person's mpi id."
  observation(personId: ID!, id: ID!): Observation

Logic*

1. Get observation by id and patient_id

2. Render detailed observation data according to schema

Key points

1. This is a graphQl query used in Administration panel only

2. Only authenticated and authorized NHS employee with appropriate scope can get observation details.

3. Query returns single observation by person (mpi id) and observation identifier.

4. Filtration with forbidden group items not implemented for observations, so it not used here.

5. Query should be invoked only if Justification for monitoring exists for current user and corresponding patient (ABAC rule_-2).

Request structure*

API Paragraph not found

Authorize*

• Verify the validity of access token

  • in case of error - return 401 (“Invalid access token”) in case of validation fails

• Verify that token is not expired

  • in case of error - return 401 (“Invalid access token”)

• Check user scopes in order to perform this action (scope = 'observation:practical_monitor')

  • return 403 (“Your scope does not allow to access this resource. Missing allowances: observation:practical_monitor”) in case of invalid scope(s)

• Check user has access to resource according to @rule_-2 in ABAC

  • return 403 (“Access denied. Justification required“) in case of error

Headers*

API Paragraph not found

Request data validation*

Validate legal entity

• Extract client_id from token.

• Check client scopes in order to perform this action (scope = 'observation:practical_monitor')

  • in case of error - return 403 (“Your scope does not allow to access this resource. Missing allowances: observation:practical_monitor”)

• Check legal entity status (status = ACTIVE)

  • In case of error - return 409 ('client_id refers to legal entity that is not active')

Validate request

• Check required personId submitted.

  • return 404 (“not found“) in case not exist

• Check required observation Id submitted.

  • return 404 (“not found“) in case not exist or not related to person

Processing*

API Paragraph not found

Response structure*

API Paragraph not found

Post-processing processes*

API Paragraph not found

HTTP status codes*

API Paragraph not found