OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Public Resource Access

Delete public resource token

  • Sandbox: available
  • Staging: available
  • Production: unknown
DELETE
/public/{resourceType}/{id}

Removes the public token from a resource, so it can no longer be read with GET /public/{token}. The resource itself is kept.

Auth: bearer token of a project admin.

Behaviour

  • The resource must be in the caller's project or one of its sub-projects. A resource of any other project, the parent project included, answers 403 and is left unchanged; an unknown id answers 404.
  • Removes the meta.extension entry with the URL https://api.ovok.com/fhir/StructureDefinition/public-resource-token. Other extensions are kept.
  • Calling it on a resource without a token succeeds.
  • The response is { token: null, resource } with the updated resource.

Example

curl -X DELETE 'https://api.sandbox.ovok.com/public/DocumentReference/87ea5dfc-8b8e-384d-8489-79496e706390' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Path Parameters

resourceType*string
id*string

Response Body

A null token and the updated resource.

application/json
  1. response
token*null

Always null: the resource no longer has a public token.

resource*

The FHIR resource as stored in Medplum.

Example Request
curl -X DELETE 'https://api.sandbox.ovok.com/public/string/string'
Example Response
{  "token": null,  "resource": {    "resourceType": "string",    "id": "string"  }}

Change public resource token PATCH

Gives a resource a new public token, so it can be read with `GET /public/{token}`. If the resource already has a token, the old one is replaced and stops working. **Auth:** bearer token of a project admin. ## Behaviour - The resource must be in the caller's project or one of its sub-projects. A resource of any other project, the parent project included, answers `403` and is left unchanged; an unknown id answers `404`. - The token is written to the resource's `meta.extension` with the URL `https://api.ovok.com/fhir/StructureDefinition/public-resource-token`. Other extensions are kept. - The response is `{ token, resource }`: the new token and the updated resource. ## Example ```bash curl -X PATCH 'https://api.sandbox.ovok.com/public/DocumentReference/87ea5dfc-8b8e-384d-8489-79496e706390' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ``` ```json { "token": "...", "resource": { "resourceType": "DocumentReference", "id": "87ea5dfc-8b8e-384d-8489-79496e706390", "meta": { "extension": [ { "url": "https://api.ovok.com/fhir/StructureDefinition/public-resource-token", "valueString": "..." } ] }, ... } } ```

Send reset password email POST

Sends a password reset email to a Patient, a RelatedPerson (carer) or a Practitioner. The answer is the same whether or not an account exists, so the route cannot be used to find out which emails are registered. **Auth:** none. **Scope:** for a Patient or RelatedPerson, the project that owns `clientId`. For a Practitioner, the account is found by email across projects. ## Behaviour - `type` is `Patient`, `RelatedPerson` or `Practitioner`. `clientId` is required when `type` is `Patient` or `RelatedPerson` and is ignored for a Practitioner. - The response is always a FHIR `OperationOutcome` saying "If the user exists, a password reset email has been sent." It is returned for unknown emails, unknown client IDs and accounts that could not be mailed. - When the account exists, Ovok creates a reset request, which replaces any earlier open reset request for the user, and emails the user. Patients and RelatedPersons get the `PATIENT_RESET_PASSWORD` template and Practitioners the `RESET_PASSWORD` template. - The email carries a link `<app URL>/setpassword/<id>/<secret>` plus the request `id` and `secret`. The app URL is the project's patient app URL for a Patient or RelatedPerson, and its practitioner app URL for a Practitioner; if none is set, the request's `Origin` is used when it is an allowed one. - A Practitioner who is a member of more than one project gets a link to the Ovok platform app instead of a project's app URL. - If no app URL can be found, the email still goes out, without a link. The `id` and `secret` in it can be sent to `POST /v2/auth/reset-password/process`. - If a Practitioner has several accounts, the first one found is used. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v2/auth/reset-password' \ -H 'Content-Type: application/json' \ -d '{ "email": "max.mustermann@example.com", "clientId": "c3499c27-2973-0a7f-807e-fb8676a92dcb", "type": "Patient" }' ```