Restrict operations on resource type

This article shows how to create an access policy with restricted set of operations on Patient resource

Create a patient

POST /Patient

id: pt-1
resourceType: Patient
  - given:
      - John

Create an access policy

Create an access policy which allows only [Fhir]Read operation on Patient.

POST /AccessPolicy

engine: matcho
      $enum: [Read, FhirRead]
    resource/type: Patient

Try it


We won't be able to create new patient because we're not allowed to use [Fhir]Create operation

POST /Patient

id: pt-2
resourceType: Patient
  - given:
      - Jane


[Fhir]Read operation works as expected and you are able to read previously created patient

GET /Patient/pt-1

What's going on here

When you make a query

GET /{resource-type}/{resource-id}

Aidbox router stores data in the request object:

  • Reference to the Read operation in the operation property.

  • Resource type Patient from the url to the params.recource/type property.

Access policy engine evaluates request object. And here it checks that property contains either Read or FhirRead string.

You can inspect request object using __debug query parameter.

Last updated