Uploaded image for project: 'FHIR Specification Feedback'
  1. FHIR Specification Feedback
  2. FHIR-35173

Does a server must support all status codes?

    XMLWordPrintableJSON

Details

    • Icon: Change Request Change Request
    • Resolution: Not Persuasive with Modification
    • Icon: Highest Highest
    • International Patient Access (FHIR)
    • 0.1.0
    • Patient Care
    • International Patient Access Server CapabilityStatement
    • 13.1.3.1
    • Hide

      Yes, a server is required to support these http statuses, but is also empowered to return statuses as appropriate to not leak sensitive information.

      1. We will remove 410 as a requirement, because IPA doesn't address deleted FHIR resources at all.

      Show
      Yes, a server is required to support these http statuses, but is also empowered to return statuses as appropriate to not leak sensitive information. 1. We will remove 410 as a requirement, because IPA doesn't address deleted FHIR resources at all.
    • Isaac Vetter / John D'Amore: 7-0-0
    • Enhancement
    • Non-compatible

    Description

      This section states that

      The IPA Server SHALL:
Return the following response classes:
* (Status 400): invalid parameter
* (Status 401/4xx): unauthorized request
* (Status 403): insufficient scope
* (Status 404): unknown resource
* (Status 410): deleted resource.

      Does that mean a server shall support all these codes?
      What if a server does not support some code for security concern? Example: http://build.fhir.org/security.html#AccessDenied

      Attachments

        Activity

          People

            Unassigned Unassigned
            yunwwang Yunwei Wang
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: