# ovok_sdk.config

Canonical page: https://docs.ovok.com/python-sdk/reference/config

Client options, checked once when the client is constructed.

## MachineClient [#machineclient]

```python
MachineClient(client_id: str, client_secret: str)
```

A machine client's OAuth credentials.

**Attributes**

| Name | Type | Description |
| --- | --- | --- |
| `client_id` | `str` | The client's ID. |
| `client_secret` | `str` | The client's secret; never shown in `repr`. |

## UnauthenticatedReason [#unauthenticatedreason]

```python
UnauthenticatedReason(status: int, type: str = REFRESH_REJECTED)
```

Why the user was signed out; passed to the `on_unauthenticated` callback.

**Attributes**

| Name | Type | Description |
| --- | --- | --- |
| `status` | `int` | HTTP status of the refused token refresh. |
| `type` | `str` | Kind of sign-out; always `"refresh-rejected"` today. |

## OvokSettings [#ovoksettings]

```python
OvokSettings(
    base_url: str,
    tenant_code: str,
    fhir_path: str,
    storage: OvokStorage,
    transport: Transport,
    timeout: float,
    max_network_retries: int,
    client_id: str | None,
    machine_client: MachineClient | None,
    on_unauthenticated: OnUnauthenticated,
)
```

The client's checked options; see `Ovok` for what each one means.

**Attributes**

| Name | Type | Description |
| --- | --- | --- |
| `base_url` | `str` | API base URL, ending in `/`. |
| `tenant_code` | `str` | Tenant every request is scoped to. |
| `fhir_path` | `str` | Path of the FHIR API under `base_url`, without slashes at either end. |
| `storage` | `OvokStorage` | Where the session is kept. |
| `transport` | `Transport` | Sends the HTTP requests. |
| `timeout` | `float` | Request timeout in seconds. |
| `max_network_retries` | `int` | Retries for safe requests that fail on the network. |
| `client_id` | `str \| None` | App client ID, if one was given. |
| `machine_client` | `MachineClient \| None` | Machine credentials, when a client secret was given. |
| `on_unauthenticated` | `OnUnauthenticated` | Called when the user is signed out. |

## read_settings() [#read_settings]

```python
read_settings(
    base_url: str,
    tenant_code: str,
    *,
    fhir_path: str = DEFAULT_FHIR_PATH,
    storage: OvokStorage | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    transport: Transport | None = None,
    timeout: float = DEFAULT_TIMEOUT_SECONDS,
    max_network_retries: int = DEFAULT_MAX_NETWORK_RETRIES,
    on_unauthenticated: OnUnauthenticated | None = None,
) -> OvokSettings
```

Checks every option up front, so a bad one fails at construction, not on the first request.

Takes the same arguments as `Ovok`.

**Returns**

- `OvokSettings`: The checked settings, with defaults filled in.

**Raises**

- `OvokConfigError`: An option is missing or invalid.