FHIR R6 Subscription OCI Vault Secret Extension
Use the DDFS FHIR R6 extension to reference an OCI Vault secret whose value is sent as the outbound Authorization header for REST-hook handshake and event-notification requests.
This topic defines the extension. For the complete notification sequence, see FHIR R6 Subscription Workflow.
Extension definition
| Property | Value |
|---|---|
| Canonical URL | https://docs.oracle.com/iaas/device-data-fhir/StructureDefinition/subscription-oci-vault-secret.json |
| FHIR version | 6.0.0-ballot4 |
| Context | Root Subscription resource |
| Cardinality | 0..1 |
| Value | Required valueString containing an OCI Vault secret OCID when the extension is present |
The extension is optional. DDFS resolves the referenced secret for each REST-hook handshake and event-notification request and sends the resolved value verbatim as the outbound Authorization header. Inbound calls that create or update the Subscription still require the normal DDFS FHIR API access token and scopes.
Secret value and access policy
Store the complete value expected by the receiving endpoint in the OCI Vault secret. For example, for bearer authorization, store Bearer <token>. When you create a secret, select Manual secret generation to provide the secret value.
Before creating a Subscription that uses the extension, grant the DDFS instance permission to read the specific secret. See Grant DDFS Access to a Subscription Authorization Secret.
Operational behavior
DDFS resolves and applies the secret when it prepares each REST-hook request, after the synchronous create or update response. A successful Subscription create response does not confirm that DDFS can read the secret or complete the handshake.
If DDFS cannot read or apply the secret for the handshake request, the handshake fails and the Subscription status becomes error. If the secret cannot be read or applied for a later event notification, that event notification is a delivery failure.
Subscription.parameter can include supported custom HTTP headers. Restricted headers include Authorization, Proxy-Authorization, Content-Type, Content-Length, Cookie, Host, Forwarded, and headers beginning with X-Forwarded-. Use this extension when DDFS must send an outbound Authorization header.
Extension example
Add the extension at the root of a FHIR R6 Subscription resource:
(application/fhir+json)
{
"extension": [
{
"url": "https://docs.oracle.com/iaas/device-data-fhir/StructureDefinition/subscription-oci-vault-secret.json",
"valueString": "ocid1.vaultsecret.oc1.<region>.<unique-id>"
}
]
}
For the Subscription endpoint and base request structure, see Create Subscription. For a complete request that uses this extension, see Create a Subscription.