DDFS FHIR API Documentation Reference

Public FHIR Surface

• FHIR resources are exposed under /api/fhir/r4 and /api/fhir/r6-ballot4, depending on the supported resource family.
• The FHIR metadata interaction remains the public discovery surface for capability information.
• DDFS does not expose SMART authorization endpoints, including /smart/authorize, /smart/token, or /api/fhir/{r4,r6-ballot4}/.well-known/smart-configuration.
• Subscriptions and SubscriptionTopics are available for FHIR R6.
• Custom administrative purge behavior is exposed through FHIR custom operations, not standard FHIR delete semantics.

OAuth Scope Forms

• DDFS uses OCI Identity Domains for OAuth access token issuance and JWT/JWKS checks.
• The supported authorization model uses OAuth 2.0 scopes issued by OCI Identity Domains.
• Supported FHIR resource grants are defined on the DDFS resource server without the client-facing ddfs prefix, such as system/Device.rs.
• Client application grants and token requests use the fixed ddfs-prefixed form, such as ddfssystem/Device.rs. The issued token contains the corresponding canonical scope, such as system/Device.rs.
• Token validation checks the access token's aud claim independently of FHIR resource scopes.
• DDFS does not support SMART launch context, SMART patient context, patient/... scopes, or user/... scopes for FHIR resource authorization.

Custom Administrative Operations

DDFS exposes custom operations for permanently removing deleted resources:

POST /api/fhir/{r4|r6-ballot4}/{Resource}/{id}/$hardDelete
POST /api/fhir/{r4|r6-ballot4}/{Resource}/$purgeDeleted

• Standard FHIR delete logically deletes a resource.
• $hardDelete permanently removes one deleted resource, and $purgeDeleted permanently removes eligible deleted resources of a requested type.
• For $purgeDeleted, send before and optional limit in a FHIR Parameters request body using valueDateTime and valueInteger.
• Both operations require the canonical DDFS hard-delete scope and a matching resource delete scope for the target resource.
• Example client grant/token-request scopes: ddfssystem/Patient.d and ddfshttps://docs.oracle.com/iaas/device-data-fhir/scopes/hard-delete. The issued token contains system/Patient.d and https://docs.oracle.com/iaas/device-data-fhir/scopes/hard-delete.