REST API method / Метод REST API (настанова) (remove the link block before publishing the document)

• Properties of a REST API method document

• Purpose

• Logic

• Configuration parameters

• Dictionaries

• Input parameters

• Request structure

• Headers

• Request data validation

• Processing

• Response structure examples

• HTTP status codes

• Post-processing processes

• Technical modules where the method is used

Properties of a REST API method document

Purpose

This WS is designed to change some personal information in cabinet by patient. Method receives signed message (pkcs7) including signed content, digital signature and signer public key. All signature fields will be validated (including signer certificate authority).

Overview

• patient could change only its own information

• patient should sign changes to mpi with DS. Signed content should be saved to storage

• the payload for upload mpi should be the same as for sign-up

• on get mpi by id we do not show "process_disclosure_data_consent", but sign it with DS and save it to the storage with all data

• Only patients that made sign-in to cabinet with DS has scope "person:write", otherwise only person:read. 

Logic

Open

Configuration parameters

N/A

Dictionaries

• GENDER

• DOCUMENT_TYPE

• ADDRESS_TYPE

• COUNTRY

• SETTLEMENT_TYPE

• STREET_TYPE

• PHONE_TYPE

• AUTHENTICATION_METHOD

• PREFERRED_WAY_COMMUNICATION

Input parameters

Request structure

See on API-specification

Headers

Headers

Request data validation

Authorize

• Verify the validity of access token

  • Return 401 in case validation fails

Validate client type

• Check client_type = cabimet

  • in case error return 403 forbidden

Validate token

Only patients that made sign-in to cabinet with DS has scope "person:write", othewise only person:read. 

• Extract user_id from token.

• Check if users.person_id=$.persons.id

  • in case error return 403

• Check scopes person:write

  • in case error return 403 - "Your scope does not allow to access this resource. Missing allowances: person:write"

Validate MPI

• Check mpi.persons.status = 'active'

  • in case error return 409

Sign MPI 

All mpi that are saved to DB should be signed by digital signature. Signed fields for update person should be the same as signed fields for create person.

Sign fields

Validate request

• Validate request using JSON schema

  • in case error return - 422

• Check authentication number in verification DB

  • in case error return 422 - authentication number is not verified

• Check last_name, first_name, tax_id was not changed

  • in case error return 403 - forbidden "fields last_name, first_name, tax_id could not be changed from cabinet"

• Check $.gender in dictionaries.GENDER

  • in case error return 422 - value is not allowed in enum

• Check $.documents.type in dictionaries.DOCUMENT_TYPE

  • in case error return 422 - value is not allowed in enum

• Check person age < 14 and DOCUMENT_TYPE = BIRTH_CERTIFICATE

  • in case error return 422  - Must contain required item BIRTH_CERTIFICATE.

• Check $.phones.type in dictionaries.PHONE_TYPE

  • in case error return 422 - value is not allowed in enum

• Check authentication_methods

  • $.authentication_methods in dictionaries.AUTHENTICATION_METHOD 

    • in case error return 422 - value is not allowed in enum

  • $.authentication_methods=OPT

    • in case error return 422 - OFFLINE method could not be used in cabinet 

• Check adresses

  • $.addresses.type in dictionaries.ADDRESS_TYPE

  • $.addresses.settlement_type in dictionaries.SETTLEMENT_TYPE

  • $.addresses.street_type in dictionaries.STREET_TYPE

    • in case error return 422 - value is not allowed in enum

  • $.settlement = uaddresses.settlements.name and $.settlement_id = uaddresses.settlements.id

    • in case error return 422- invalid settlement value

Validate DS

Extract party from token

Extract tax_id from DS

• Check if user.tax_id = DS.tax_id = person.tax_id = $.tax_id

  • in case error return 409 (Person that loged in, person that is changed and person that sign should be the same)

Processing

Update data in DB, save signed content to media storage

Response structure examples

See on API-specification

HTTP status codes

Post-processing processes

N/A

Technical modules where the method is used