Release APIM-R-1.38 - 5 November 2024

The e-RS FHIR API is being updated to provide supplementary information.

The API will now return an OperationOutcome in the HTTP 403 (Forbidden) response body.

The diagnostics field within the OperationOutcome will include details of the error encountered to aid with troubleshooting.

Both HSCN and APIM access routes.

Endpoints impacted

All FHIR DSTU2 and FHIR STU3 responses will start to include an OperationOutcome in the response body. These were not present previously.

All FHIR R4 endpoints already return an OperationOutcome but these will start to include more diagnostic information in the diagnostics field.

Endpoints not impacted

HSCN session endpoints will not change:

A001: Create Professional Session 

A002: Professional Session Select Role 

A003: Delete Professional Session

Currently, it is not possible to determine which stage of authorisation is failing as all cases return HTTP 403 (Forbidden) with no further context.

This change will improve supportability by including diagnostic messages on both HSCN and APIM platforms.

Specifically, this will help partners distinguish between user authorisation and system authorisation issues - examples below.

User authorisation

Messages will be provided where the user business function is invalid or doesn't have:

• the selected business function
• any roles at the configured organisation

System authorisation

Messages will be provided where the system:

• ASID hasn't been provided
• ASID or FQDN is invalid
• doesn't have the interaction to call the endpoint

This is not a breaking change. However, we recommend that partners:

• test your software to make sure you are not impacted
• assess whether your software should make use of the new diagnostic information and/or log the information