docs: UDAP B2B identity, PAS 2.1.0 semantics, data-export scopes, Developer Portal split#20
Merged
Merged
Conversation
Interop now resolves requesting/provider payer identity from the UDAP HL7 B2B Authorization Extension organization_id claim in the access token (extensions.hl7-b2b.organization_id, <system-uri>#<value>), not from Client.details.identifier NPI. NPI is just one identifier system that can ride through the claim. Aidbox emits the extension on issued tokens automatically, so no extra configuration is needed. - authentication.md: drop NPI-from-Client block; add "HL7 B2B authorization extension (UDAP)" section with claim shape, spec link, and the operations that read it. - payer-to-payer.md: add caller-identity row; update $bulk-member-match 403 rejection wording. - davinci-data-export.md: note payertopayer gates on the claim; add 403 error row. - bulk-member-match.md: claim-based identity in Auth, output prose, consent persistence, and 403/409 errors. - provider-member-match.md: caller identified by the claim.
The interop app now enforces server-side scope on $davinci-data-export kick-off (interop commits bdd04b3, 0e6f97c, 4204cd7), so the "not yet enforced" hints were stale. Update reference + pillars to match impl: - exportType values: mark provider-download and payertopayer as the only translated types; provider-delta / provider-snapshot return 422. - Document server-applied filters: opt-out/opt-in consent params, pharmacy (drug claim + drug PA) _typeFilter exclusion, payertopayer 5-year service-date floor on EOB, and the money-field _elements strip on ExplanationOfBenefit / Coverage (needs Aidbox nested-elements setting). - Fix the payertopayer auth gate status: 401 (login), not 403. - Add missing 400 diagnostics (exportType required, bad _outputFormat, caller EOB _typeFilter) and the interop 422 deferred-exportType row. - Note the remaining gaps: denied PAs not filtered; filtered resources carry SUBSETTED rather than CARIN BB Non-Financial Basis profiles. Payer-to-Payer and Provider Access pillars: flip the "not enforced" hints to enforced-with-gaps, cross-linking the reference filters section.
…laim $submit links the persisted Claim to its ClaimResponse via a claim-response-reference extension, so the id rides along in change notifications and consumers correlate without a separate lookup. Add a ClaimResponse correlation section to the Claim/$submit reference and cross-reference it from Event Notifications.
…lution $inquire walks Claim.related backward to the chain root and returns that Claim's ClaimResponse — under 2.1.0 updates/cancels carry none of their own. Note prior/replaces relationship codes and that an update $submit returns the original Claim's ClaimResponse.
…ces pages Developer Portal page becomes a hub (account signup, client-type choice). Add SMART App and Backend Services child pages, each self-contained with its own registration, submission, and status. Backend Services documents the JWKS-URI vs client-secret auth choice, system scopes, and sandbox vs production. Update SUMMARY nav, redirects for moved anchors, and releases links.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs batch:
hl7-b2btoken claim across$bulk-member-match,$provider-member-match, Payer-to-Payer, Provider Access, and Authentication.$davinci-data-export: document enforced scope filters.Claim; ClaimResponse-on-original update-chain resolution ($submit/$inquire).