List access policies
- Sandbox: available
- Staging: available
- Production: unknown
Lists the access policies (roles) of a project, each with the practitioners who hold it. Use it to render a roles table.
Auth: Bearer token for a practitioner, project admin or System Owner session. The caller's access policy must grant Practitioner:create, the right to invite users (a project admin who holds no access policy skips this check).
Scope: The caller's project (from the token), or projectId when given. projectId must be the caller's project or a direct child of it.
Behaviour
- Each row is
{ policy, members }.memberslists onlyPractitionermembers, as{ reference, display }. profilekeeps only the policies held by that member, given as a reference such asPractitioner/<id>.sortByis_id(default),_lastUpdatedorname;orderByisASC(default) orDESC. Rows with an empty sort value go last inASCand first inDESC.- Paging is in memory:
page(default0) andcount(default20, 1 to 100).totalcounts the rows after filtering, before paging.
Example
curl -X GET 'https://api.sandbox.ovok.com/v1/slim/policy?sortBy=name&orderBy=ASC&page=0&count=20' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'bearerAuthorizationBearer <JWT>page?string"0"count?string"20"sortBy?string"_id""_id""_lastUpdated""name"orderBy?string"ASC""ASC""DESC"projectId?stringuuidprofile?stringsearch?stringAccess policies retrieved successfully.
application/json- response
total*numberresources*array<>curl -X GET 'https://api.sandbox.ovok.com/v1/slim/policy'{ "total": 0, "resources": [ { "policy": { "resourceType": "AccessPolicy", "id": "string", "name": "string", "resource": [ { "resourceType": "string", "interaction": [ "string" ], "criteria": "string", "readonly": true } ], "meta": { "project": "string", "author": { "reference": "string" }, "lastUpdated": "string" } }, "members": [ { "reference": "string", "display": "string" } ] } ]}Check patient name exists POST
Checks whether a Resident ID (the resident's nickname) is already used in your project. Use it to validate the Resident ID field before you create or rename a resident. **Auth:** Bearer token. The caller must be a practitioner, an admin, a super admin, or hold the "System Owner" access policy. The access policy must grant `Patient:read` (an admin or super admin who holds no access policy skips this check). **Scope:** Residents in the caller's project (from the token). ## Behaviour - Read-only. - Only the `name` entry with `use: "nickname"` is compared. Official and maiden names are ignored. Without a nickname entry the answer is `exists: false`. - A match needs the same `given` tokens in the same order and the same `family` (or no `family` on both sides). Tokens are trimmed and compared case-insensitively. - When you edit an existing resident, pass their id as `excludePatientId` so their own record does not count as a match. - The create and update routes run the same check, so a `true` here means those requests would be refused with a 422. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/slim/patient/check-name-exists' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "name": [{ "use": "nickname", "given": ["Maxi"] }], "excludePatientId": "c3499c27-2973-0a7f-807e-fb8676a92dcb" }' ``` ```json { "exists": false } ```
Create access policy POST
Creates an access policy (role) in your project and assigns it to the listed practitioners. Use it to define a new role. **Auth:** Bearer token for a practitioner, project admin or System Owner session. The caller's access policy must grant `AccessPolicy:create` and `ProjectMembership:update` (a project admin who holds no access policy skips this check). **Scope:** The policy is created in the caller's project (from the token). ## Behaviour - You cannot create a policy above your own rank. Ranks come from the policy name or its `basedOn` display: `System Owner` is the highest, then `Admin`, then every other policy. Project admins rank as System Owner. - Ovok adds interactions the apps rely on: - `Consent`: `read`, `search`, `create`, `update`, always; - `DeviceUseStatement` and `EpisodeOfCare`: `read`, `search`, `create`, `update`, when the policy may create or update `Patient`; - `Provenance` and `AuditEvent`: `read`, `search`, when the policy is named `Admin` or `System Owner`. - `members` are profile references such as `Practitioner/<id>`. Each listed member's membership in your project now points to the new policy, replacing the policy it held before. A member with no membership in your project is skipped. - You cannot list a member whose current role ranks above yours. A member ranks as every policy their membership holds now (`accessPolicy` and any `access` entries), each ranked by its name. A project admin (`admin: true`) ranks as System Owner. - The policy and the membership changes commit together. Past 49 membership changes they are written in two steps. - The policy is then copied by name into each direct child project. A failed copy does not fail the request. - Returns the created policy with its members, as in `GET /v1/slim/policy/{id}`. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/slim/policy' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "policy": { "resourceType": "AccessPolicy", "name": "Night shift", "resource": [{ "resourceType": "Patient", "interaction": ["read", "search"] }] }, "members": [{ "reference": "Practitioner/c3499c27-2973-0a7f-807e-fb8676a92dcb", "display": "Max Mustermann" }] }' ```