HTTPS and Transport Layer Security

HTTPS is required for all API calls to endpoints. Unencrypted HTTP API calls do not work. An HTTPS API call is a regular HTTP call done over a connection secured by Transport Layer Security(TLS) — previously known as Secure Socket Layer (SSL) — is the process of securing communication over a computer network by encrypting traffic. Encrypting traffic helps prevent eavesdropping, tampering, and man-in-the-middle attacks.

Cross-Origin Resource Sharing

This API features Cross-Origin Resource Sharing (CORS) implemented in compliance with W3C spec. And that allows cross-domain communication from the browser. All responses have a wildcard same-origin which makes them completely public and accessible to everyone, including any code on any site.

Content Types

FHIR resources

The formal MIME-type, including Accept header for a client requests, for FHIR API resources is application/fhir+json.

Non-FHIR resources

The following resources are not FHIR compliant and use generic mime types:

• /users - application/json
• /Ccda - application/xml

Authentication

Bearer authentication (also called token authentication) is an HTTP authentication scheme that involves security tokens called bearer tokens. The name “Bearer authentication” can be understood as “give access to the bearer of this token.” The bearer token is a cryptic string, usually generated by the server in response to a login request. The client application must send this token in the Authorization header when making requests to protected resources:

Authorization: Bearer <token>

To access protected FHIR API resources the client application should provide the following header parameters:

• Authorization: Bearer <token> - the<token> can be obtained as a result of the successful user login flow by calling users login endpoint.
• Mi-Customer-Id: <string> - represents a unique customer identification string, must be provided by MedInformatix.
• Mi-Ext-Application-Id: <string>- represents a unique customer's application identification string, must be provided by MedInformatix.