8 * @link http://www.open-emr.org
9 * @author Matthew Vita <matthewvita48@gmail.com>
10 * @author Jerry Padgett <sjpadgett@gmail.com>
11 * @author Brady Miller <brady.g.miller@gmail.com>
12 * @author Yash Raj Bothra <yashrajbothra786@gmail.com>
13 * @copyright Copyright (c) 2018 Matthew Vita <matthewvita48@gmail.com>
14 * @copyright Copyright (c) 2018-2020 Jerry Padgett <sjpadgett@gmail.com>
15 * @copyright Copyright (c) 2019 Brady Miller <brady.g.miller@gmail.com>
16 * @copyright Copyright (c) 2020 Yash Raj Bothra <yashrajbothra786@gmail.com>
17 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
20 // Lets keep our controller classes with the routes.
22 use OpenEMR\Common\Acl\AccessDeniedException
;
23 use OpenEMR\Common\Http\HttpRestRequest
;
24 use OpenEMR\RestControllers\AllergyIntoleranceRestController
;
25 use OpenEMR\RestControllers\FacilityRestController
;
26 use OpenEMR\RestControllers\VersionRestController
;
27 use OpenEMR\RestControllers\ProductRegistrationRestController
;
28 use OpenEMR\RestControllers\PatientRestController
;
29 use OpenEMR\RestControllers\EncounterRestController
;
30 use OpenEMR\RestControllers\PractitionerRestController
;
31 use OpenEMR\RestControllers\ListRestController
;
32 use OpenEMR\RestControllers\InsuranceCompanyRestController
;
33 use OpenEMR\RestControllers\AppointmentRestController
;
34 use OpenEMR\RestControllers\ConditionRestController
;
35 use OpenEMR\RestControllers\ONoteRestController
;
36 use OpenEMR\RestControllers\DocumentRestController
;
37 use OpenEMR\RestControllers\DrugRestController
;
38 use OpenEMR\RestControllers\ImmunizationRestController
;
39 use OpenEMR\RestControllers\InsuranceRestController
;
40 use OpenEMR\RestControllers\MessageRestController
;
41 use OpenEMR\RestControllers\PrescriptionRestController
;
42 use OpenEMR\RestControllers\ProcedureRestController
;
44 // Note some Http clients may not send auth as json so a function
45 // is implemented to determine and parse encoding on auth route's.
47 // Note that the api route is only for users role
48 // (there is a mechanism in place to ensure only user role can access the api route)
49 RestConfig
::$ROUTE_MAP = array(
50 "GET /api/facility" => function () {
51 RestConfig
::authorization_check("admin", "users");
52 $return = (new FacilityRestController())->getAll($_GET);
53 RestConfig
::apiLog($return);
56 "GET /api/facility/:fuuid" => function ($fuuid) {
57 RestConfig
::authorization_check("admin", "users");
58 $return = (new FacilityRestController())->getOne($fuuid);
59 RestConfig
::apiLog($return);
62 "POST /api/facility" => function () {
63 RestConfig
::authorization_check("admin", "super");
64 $data = (array) (json_decode(file_get_contents("php://input")));
65 $return = (new FacilityRestController())->post($data);
66 RestConfig
::apiLog($return, $data);
69 "PUT /api/facility/:fuuid" => function ($fuuid) {
70 RestConfig
::authorization_check("admin", "super");
71 $data = (array) (json_decode(file_get_contents("php://input")));
72 $return = (new FacilityRestController())->patch($fuuid, $data);
73 RestConfig
::apiLog($return, $data);
76 "GET /api/patient" => function () {
77 RestConfig
::authorization_check("patients", "demo");
78 $return = (new PatientRestController())->getAll($_GET);
79 RestConfig
::apiLog($return);
82 "POST /api/patient" => function () {
83 RestConfig
::authorization_check("patients", "demo");
84 $data = (array) (json_decode(file_get_contents("php://input")));
85 $return = (new PatientRestController())->post($data);
86 RestConfig
::apiLog($return, $data);
89 "PUT /api/patient/:puuid" => function ($puuid) {
90 RestConfig
::authorization_check("patients", "demo");
91 $data = (array) (json_decode(file_get_contents("php://input")));
92 $return = (new PatientRestController())->put($puuid, $data);
93 RestConfig
::apiLog($return, $data);
96 "GET /api/patient/:puuid" => function ($puuid) {
97 RestConfig
::authorization_check("patients", "demo");
98 $return = (new PatientRestController())->getOne($puuid);
99 RestConfig
::apiLog($return);
102 "GET /api/patient/:puuid/encounter" => function ($puuid) {
103 RestConfig
::authorization_check("encounters", "auth_a");
104 $return = (new EncounterRestController())->getAll($puuid);
105 RestConfig
::apiLog($return);
108 "POST /api/patient/:puuid/encounter" => function ($puuid) {
109 RestConfig
::authorization_check("encounters", "auth_a");
110 $data = (array) (json_decode(file_get_contents("php://input")));
111 $return = (new EncounterRestController())->post($puuid, $data);
112 RestConfig
::apiLog($return, $data);
115 "PUT /api/patient/:puuid/encounter/:euuid" => function ($puuid, $euuid) {
116 RestConfig
::authorization_check("encounters", "auth_a");
117 $data = (array) (json_decode(file_get_contents("php://input")));
118 $return = (new EncounterRestController())->put($puuid, $euuid, $data);
119 RestConfig
::apiLog($return, $data);
122 "GET /api/patient/:puuid/encounter/:euuid" => function ($puuid, $euuid) {
123 RestConfig
::authorization_check("encounters", "auth_a");
124 $return = (new EncounterRestController())->getOne($puuid, $euuid);
125 RestConfig
::apiLog($return);
128 "GET /api/patient/:pid/encounter/:eid/soap_note" => function ($pid, $eid) {
129 RestConfig
::authorization_check("encounters", "notes");
130 $return = (new EncounterRestController())->getSoapNotes($pid, $eid);
131 RestConfig
::apiLog($return);
134 "POST /api/patient/:pid/encounter/:eid/vital" => function ($pid, $eid) {
135 RestConfig
::authorization_check("encounters", "notes");
136 $data = (array) (json_decode(file_get_contents("php://input")));
137 $return = (new EncounterRestController())->postVital($pid, $eid, $data);
138 RestConfig
::apiLog($return, $data);
141 "PUT /api/patient/:pid/encounter/:eid/vital/:vid" => function ($pid, $eid, $vid) {
142 RestConfig
::authorization_check("encounters", "notes");
143 $data = (array) (json_decode(file_get_contents("php://input")));
144 $return = (new EncounterRestController())->putVital($pid, $eid, $vid, $data);
145 RestConfig
::apiLog($return, $data);
148 "GET /api/patient/:pid/encounter/:eid/vital" => function ($pid, $eid) {
149 RestConfig
::authorization_check("encounters", "notes");
150 $return = (new EncounterRestController())->getVitals($pid, $eid);
151 RestConfig
::apiLog($return);
154 "GET /api/patient/:pid/encounter/:eid/vital/:vid" => function ($pid, $eid, $vid) {
155 RestConfig
::authorization_check("encounters", "notes");
156 $return = (new EncounterRestController())->getVital($pid, $eid, $vid);
157 RestConfig
::apiLog($return);
160 "GET /api/patient/:pid/encounter/:eid/soap_note/:sid" => function ($pid, $eid, $sid) {
161 RestConfig
::authorization_check("encounters", "notes");
162 $return = (new EncounterRestController())->getSoapNote($pid, $eid, $sid);
163 RestConfig
::apiLog($return);
166 "POST /api/patient/:pid/encounter/:eid/soap_note" => function ($pid, $eid) {
167 RestConfig
::authorization_check("encounters", "notes");
168 $data = (array) (json_decode(file_get_contents("php://input")));
169 $return = (new EncounterRestController())->postSoapNote($pid, $eid, $data);
170 RestConfig
::apiLog($return, $data);
173 "PUT /api/patient/:pid/encounter/:eid/soap_note/:sid" => function ($pid, $eid, $sid) {
174 RestConfig
::authorization_check("encounters", "notes");
175 $data = (array) (json_decode(file_get_contents("php://input")));
176 $return = (new EncounterRestController())->putSoapNote($pid, $eid, $sid, $data);
177 RestConfig
::apiLog($return, $data);
180 "GET /api/practitioner" => function () {
181 RestConfig
::authorization_check("admin", "users");
182 $return = (new PractitionerRestController())->getAll($_GET);
183 RestConfig
::apiLog($return);
186 "GET /api/practitioner/:prid" => function ($prid) {
187 RestConfig
::authorization_check("admin", "users");
188 $return = (new PractitionerRestController())->getOne($prid);
189 RestConfig
::apiLog($return);
192 "POST /api/practitioner" => function () {
193 RestConfig
::authorization_check("admin", "users");
194 $data = (array) (json_decode(file_get_contents("php://input")));
195 $return = (new PractitionerRestController())->post($data);
196 RestConfig
::apiLog($return, $data);
199 "PUT /api/practitioner/:prid" => function ($prid) {
200 RestConfig
::authorization_check("admin", "users");
201 $data = (array) (json_decode(file_get_contents("php://input")));
202 $return = (new PractitionerRestController())->patch($prid, $data);
203 RestConfig
::apiLog($return, $data);
206 "GET /api/medical_problem" => function () {
207 RestConfig
::authorization_check("encounters", "notes");
208 $return = (new ConditionRestController())->getAll();
209 RestConfig
::apiLog($return);
212 "GET /api/medical_problem/:muuid" => function ($muuid) {
213 RestConfig
::authorization_check("encounters", "notes");
214 $return = (new ConditionRestController())->getOne($muuid);
215 RestConfig
::apiLog($return);
218 "GET /api/patient/:puuid/medical_problem" => function ($puuid) {
219 RestConfig
::authorization_check("encounters", "notes");
220 $return = (new ConditionRestController())->getAll($puuid, "medical_problem");
221 RestConfig
::apiLog($return);
224 "GET /api/patient/:puuid/medical_problem/:muuid" => function ($puuid, $muuid) {
225 RestConfig
::authorization_check("patients", "med");
226 $return = (new ConditionRestController())->getAll(['lists.pid' => $puuid, 'lists.id' => $muuid]);
227 RestConfig
::apiLog($return);
230 "POST /api/patient/:puuid/medical_problem" => function ($puuid) {
231 RestConfig
::authorization_check("patients", "med");
232 $data = (array) (json_decode(file_get_contents("php://input")));
233 $return = (new ConditionRestController())->post($puuid, $data);
234 RestConfig
::apiLog($return, $data);
237 "PUT /api/patient/:puuid/medical_problem/:muuid" => function ($puuid, $muuid) {
238 RestConfig
::authorization_check("patients", "med");
239 $data = (array) (json_decode(file_get_contents("php://input")));
240 $return = (new ConditionRestController())->put($puuid, $muuid, $data);
241 RestConfig
::apiLog($return, $data);
244 "DELETE /api/patient/:puuid/medical_problem/:muuid" => function ($puuid, $muuid) {
245 RestConfig
::authorization_check("patients", "med");
246 $return = (new ConditionRestController())->delete($puuid, $muuid);
247 RestConfig
::apiLog($return);
250 "GET /api/allergy" => function () {
251 RestConfig
::authorization_check("patients", "med");
252 $return = (new AllergyIntoleranceRestController())->getAll();
253 RestConfig
::apiLog($return);
256 "GET /api/allergy/:auuid" => function ($auuid) {
257 RestConfig
::authorization_check("patients", "med");
258 $return = (new AllergyIntoleranceRestController())->getOne($auuid);
259 RestConfig
::apiLog($return);
262 "GET /api/patient/:puuid/allergy" => function ($puuid) {
263 RestConfig
::authorization_check("patients", "med");
264 $return = (new AllergyIntoleranceRestController())->getAll(['lists.pid' => $puuid]);
265 RestConfig
::apiLog($return);
268 "GET /api/patient/:puuid/allergy/:auuid" => function ($puuid, $auuid) {
269 RestConfig
::authorization_check("patients", "med");
270 $return = (new AllergyIntoleranceRestController())->getAll(['lists.pid' => $puuid, 'lists.id' => $auuid]);
271 RestConfig
::apiLog($return);
274 "POST /api/patient/:puuid/allergy" => function ($puuid) {
275 RestConfig
::authorization_check("patients", "med");
276 $data = (array) (json_decode(file_get_contents("php://input")));
277 $return = (new AllergyIntoleranceRestController())->post($puuid, $data);
278 RestConfig
::apiLog($return, $data);
281 "PUT /api/patient/:puuid/allergy/:auuid" => function ($puuid, $auuid) {
282 RestConfig
::authorization_check("patients", "med");
283 $data = (array) (json_decode(file_get_contents("php://input")));
284 $return = (new AllergyIntoleranceRestController())->put($puuid, $auuid, $data);
285 RestConfig
::apiLog($return, $data);
288 "DELETE /api/patient/:puuid/allergy/:auuid" => function ($puuid, $auuid) {
289 RestConfig
::authorization_check("patients", "med");
290 $return = (new AllergyIntoleranceRestController())->delete($puuid, $auuid);
291 RestConfig
::apiLog($return);
294 "GET /api/patient/:pid/medication" => function ($pid) {
295 RestConfig
::authorization_check("patients", "med");
296 $return = (new ListRestController())->getAll($pid, "medication");
297 RestConfig
::apiLog($return);
300 "POST /api/patient/:pid/medication" => function ($pid) {
301 RestConfig
::authorization_check("patients", "med");
302 $data = (array) (json_decode(file_get_contents("php://input")));
303 $return = (new ListRestController())->post($pid, "medication", $data);
304 RestConfig
::apiLog($return, $data);
307 "PUT /api/patient/:pid/medication/:mid" => function ($pid, $mid) {
308 RestConfig
::authorization_check("patients", "med");
309 $data = (array) (json_decode(file_get_contents("php://input")));
310 $return = (new ListRestController())->put($pid, $mid, "medication", $data);
311 RestConfig
::apiLog($return, $data);
314 "GET /api/patient/:pid/medication/:mid" => function ($pid, $mid) {
315 RestConfig
::authorization_check("patients", "med");
316 $return = (new ListRestController())->getOne($pid, "medication", $mid);
317 RestConfig
::apiLog($return);
320 "DELETE /api/patient/:pid/medication/:mid" => function ($pid, $mid) {
321 RestConfig
::authorization_check("patients", "med");
322 $return = (new ListRestController())->delete($pid, $mid, "medication");
323 RestConfig
::apiLog($return);
326 "GET /api/patient/:pid/surgery" => function ($pid) {
327 RestConfig
::authorization_check("patients", "med");
328 $return = (new ListRestController())->getAll($pid, "surgery");
329 RestConfig
::apiLog($return);
332 "GET /api/patient/:pid/surgery/:sid" => function ($pid, $sid) {
333 RestConfig
::authorization_check("patients", "med");
334 $return = (new ListRestController())->getOne($pid, "surgery", $sid);
335 RestConfig
::apiLog($return);
338 "DELETE /api/patient/:pid/surgery/:sid" => function ($pid, $sid) {
339 RestConfig
::authorization_check("patients", "med");
340 $return = (new ListRestController())->delete($pid, $sid, "surgery");
341 RestConfig
::apiLog($return);
344 "POST /api/patient/:pid/surgery" => function ($pid) {
345 RestConfig
::authorization_check("patients", "med");
346 $data = (array) (json_decode(file_get_contents("php://input")));
347 $return = (new ListRestController())->post($pid, "surgery", $data);
348 RestConfig
::apiLog($return, $data);
351 "PUT /api/patient/:pid/surgery/:sid" => function ($pid, $sid) {
352 RestConfig
::authorization_check("patients", "med");
353 $data = (array) (json_decode(file_get_contents("php://input")));
354 $return = (new ListRestController())->put($pid, $sid, "surgery", $data);
355 RestConfig
::apiLog($return, $data);
358 "GET /api/patient/:pid/dental_issue" => function ($pid) {
359 RestConfig
::authorization_check("patients", "med");
360 $return = (new ListRestController())->getAll($pid, "dental");
361 RestConfig
::apiLog($return);
364 "GET /api/patient/:pid/dental_issue/:did" => function ($pid, $did) {
365 RestConfig
::authorization_check("patients", "med");
366 $return = (new ListRestController())->getOne($pid, "dental", $did);
367 RestConfig
::apiLog($return);
370 "DELETE /api/patient/:pid/dental_issue/:did" => function ($pid, $did) {
371 RestConfig
::authorization_check("patients", "med");
372 $return = (new ListRestController())->delete($pid, $did, "dental");
373 RestConfig
::apiLog($return);
376 "POST /api/patient/:pid/dental_issue" => function ($pid) {
377 RestConfig
::authorization_check("patients", "med");
378 $data = (array) (json_decode(file_get_contents("php://input")));
379 $return = (new ListRestController())->post($pid, "dental", $data);
380 RestConfig
::apiLog($return, $data);
383 "PUT /api/patient/:pid/dental_issue/:did" => function ($pid, $did) {
384 RestConfig
::authorization_check("patients", "med");
385 $data = (array) (json_decode(file_get_contents("php://input")));
386 $return = (new ListRestController())->put($pid, $did, "dental", $data);
387 RestConfig
::apiLog($return, $data);
390 "GET /api/patient/:pid/appointment" => function ($pid) {
391 RestConfig
::authorization_check("patients", "appt");
392 $return = (new AppointmentRestController())->getAllForPatient($pid);
393 RestConfig
::apiLog($return);
396 "POST /api/patient/:pid/appointment" => function ($pid) {
397 RestConfig
::authorization_check("patients", "appt");
398 $data = (array) (json_decode(file_get_contents("php://input")));
399 $return = (new AppointmentRestController())->post($pid, $data);
400 RestConfig
::apiLog($return, $data);
403 "GET /api/appointment" => function () {
404 RestConfig
::authorization_check("patients", "appt");
405 $return = (new AppointmentRestController())->getAll();
406 RestConfig
::apiLog($return);
409 "GET /api/appointment/:eid" => function ($eid) {
410 RestConfig
::authorization_check("patients", "appt");
411 $return = (new AppointmentRestController())->getOne($eid);
412 RestConfig
::apiLog($return);
415 "DELETE /api/patient/:pid/appointment/:eid" => function ($pid, $eid) {
416 RestConfig
::authorization_check("patients", "appt");
417 $return = (new AppointmentRestController())->delete($eid);
418 RestConfig
::apiLog($return);
421 "GET /api/patient/:pid/appointment/:eid" => function ($pid, $eid) {
422 RestConfig
::authorization_check("patients", "appt");
423 $return = (new AppointmentRestController())->getOne($eid);
424 RestConfig
::apiLog($return);
427 "GET /api/list/:list_name" => function ($list_name) {
428 RestConfig
::authorization_check("lists", "default");
429 $return = (new ListRestController())->getOptions($list_name);
430 RestConfig
::apiLog($return);
433 "GET /api/version" => function () {
434 $return = (new VersionRestController())->getOne();
435 RestConfig
::apiLog($return);
438 "GET /api/product" => function () {
439 $return = (new ProductRegistrationRestController())->getOne();
440 RestConfig
::apiLog($return);
443 "GET /api/insurance_company" => function () {
444 $return = (new InsuranceCompanyRestController())->getAll();
445 RestConfig
::apiLog($return);
448 "GET /api/insurance_company/:iid" => function ($iid) {
449 $return = (new InsuranceCompanyRestController())->getOne($iid);
450 RestConfig
::apiLog($return);
453 "GET /api/insurance_type" => function () {
454 $return = (new InsuranceCompanyRestController())->getInsuranceTypes();
455 RestConfig
::apiLog($return);
458 "POST /api/insurance_company" => function () {
459 $data = (array) (json_decode(file_get_contents("php://input")));
460 $return = (new InsuranceCompanyRestController())->post($data);
461 RestConfig
::apiLog($return, $data);
464 "PUT /api/insurance_company/:iid" => function ($iid) {
465 $data = (array) (json_decode(file_get_contents("php://input")));
466 $return = (new InsuranceCompanyRestController())->put($iid, $data);
467 RestConfig
::apiLog($return, $data);
470 "POST /api/patient/:pid/document" => function ($pid) {
471 $return = (new DocumentRestController())->postWithPath($pid, $_GET['path'], $_FILES['document']);
472 RestConfig
::apiLog($return);
475 "GET /api/patient/:pid/document" => function ($pid) {
476 $return = (new DocumentRestController())->getAllAtPath($pid, $_GET['path']);
477 RestConfig
::apiLog($return);
480 "GET /api/patient/:pid/document/:did" => function ($pid, $did) {
481 $return = (new DocumentRestController())->downloadFile($pid, $did);
482 RestConfig
::apiLog($return);
485 "GET /api/patient/:pid/insurance" => function ($pid) {
486 $return = (new InsuranceRestController())->getAll($pid);
487 RestConfig
::apiLog($return);
490 "GET /api/patient/:pid/insurance/:type" => function ($pid, $type) {
491 $return = (new InsuranceRestController())->getOne($pid, $type);
492 RestConfig
::apiLog($return);
495 "POST /api/patient/:pid/insurance/:type" => function ($pid, $type) {
496 $data = (array) (json_decode(file_get_contents("php://input")));
497 $return = (new InsuranceRestController())->post($pid, $type, $data);
498 RestConfig
::apiLog($return, $data);
501 "PUT /api/patient/:pid/insurance/:type" => function ($pid, $type) {
502 $data = (array) (json_decode(file_get_contents("php://input")));
503 $return = (new InsuranceRestController())->put($pid, $type, $data);
504 RestConfig
::apiLog($return, $data);
507 "POST /api/patient/:pid/message" => function ($pid) {
508 RestConfig
::authorization_check("patients", "notes");
509 $data = (array) (json_decode(file_get_contents("php://input")));
510 $return = (new MessageRestController())->post($pid, $data);
511 RestConfig
::apiLog($return, $data);
514 "PUT /api/patient/:pid/message/:mid" => function ($pid, $mid) {
515 RestConfig
::authorization_check("patients", "notes");
516 $data = (array) (json_decode(file_get_contents("php://input")));
517 $return = (new MessageRestController())->put($pid, $mid, $data);
518 RestConfig
::apiLog($return, $data);
521 "DELETE /api/patient/:pid/message/:mid" => function ($pid, $mid) {
522 RestConfig
::authorization_check("patients", "notes");
523 $return = (new MessageRestController())->delete($pid, $mid);
524 RestConfig
::apiLog($return);
527 "GET /api/immunization" => function () {
528 RestConfig
::authorization_check("patients", "med");
529 $return = (new ImmunizationRestController())->getAll($_GET);
530 RestConfig
::apiLog($return);
533 "GET /api/immunization/:uuid" => function ($uuid) {
534 RestConfig
::authorization_check("patients", "med");
535 $return = (new ImmunizationRestController())->getOne($uuid);
536 RestConfig
::apiLog($return);
539 "GET /api/procedure" => function () {
540 RestConfig
::authorization_check("patients", "med");
541 $return = (new ProcedureRestController())->getAll();
542 RestConfig
::apiLog($return);
545 "GET /api/procedure/:uuid" => function ($uuid) {
546 RestConfig
::authorization_check("patients", "med");
547 $return = (new ProcedureRestController())->getOne($uuid);
548 RestConfig
::apiLog($return);
551 "GET /api/drug" => function () {
552 RestConfig
::authorization_check("patients", "med");
553 $return = (new DrugRestController())->getAll();
554 RestConfig
::apiLog($return);
557 "GET /api/drug/:uuid" => function ($uuid) {
558 RestConfig
::authorization_check("patients", "med");
559 $return = (new DrugRestController())->getOne($uuid);
560 RestConfig
::apiLog($return);
563 "GET /api/prescription" => function () {
564 RestConfig
::authorization_check("patients", "med");
565 $return = (new PrescriptionRestController())->getAll();
566 RestConfig
::apiLog($return);
569 "GET /api/prescription/:uuid" => function ($uuid) {
570 RestConfig
::authorization_check("patients", "med");
571 $return = (new PrescriptionRestController())->getOne($uuid);
572 RestConfig
::apiLog($return);
577 use OpenEMR\Common\Http\StatusCode
;
578 use OpenEMR\Common\Http\Psr17Factory
;
579 use OpenEMR\RestControllers\FHIR\FhirAllergyIntoleranceRestController
;
580 use OpenEMR\RestControllers\FHIR\FhirCareTeamRestController
;
581 use OpenEMR\RestControllers\FHIR\FhirConditionRestController
;
582 use OpenEMR\RestControllers\FHIR\FhirCoverageRestController
;
583 use OpenEMR\RestControllers\FHIR\FhirEncounterRestController
;
584 use OpenEMR\RestControllers\FHIR\FhirExportRestController
;
585 use OpenEMR\RestControllers\FHIR\FhirObservationRestController
;
586 use OpenEMR\RestControllers\FHIR\FhirImmunizationRestController
;
587 use OpenEMR\RestControllers\FHIR\FhirLocationRestController
;
588 use OpenEMR\RestControllers\FHIR\FhirMedicationRestController
;
589 use OpenEMR\RestControllers\FHIR\FhirMedicationRequestRestController
;
590 use OpenEMR\RestControllers\FHIR\FhirOrganizationRestController
;
591 use OpenEMR\RestControllers\FHIR\FhirPatientRestController
;
592 use OpenEMR\RestControllers\FHIR\FhirPersonRestController
;
593 use OpenEMR\RestControllers\FHIR\FhirPractitionerRoleRestController
;
594 use OpenEMR\RestControllers\FHIR\FhirPractitionerRestController
;
595 use OpenEMR\RestControllers\FHIR\FhirProcedureRestController
;
596 use OpenEMR\RestControllers\FHIR\FhirMetaDataRestController
;
598 // Note that the fhir route includes both user role and patient role
599 // (there is a mechanism in place to ensure patient role is binded
600 // to only see the data of the one patient)
601 RestConfig
::$FHIR_ROUTE_MAP = array(
602 "GET /fhir/metadata" => function () {
603 $return = (new FhirMetaDataRestController())->getMetaData();
604 RestConfig
::apiLog($return);
607 "GET /fhir/.well-known/smart-configuration" => function () {
608 $authController = new \OpenEMR\RestControllers\
AuthorizationController();
609 $return = (new \OpenEMR\RestControllers\SMART\
SMARTConfigurationController($authController))->getConfig();
610 RestConfig
::apiLog($return);
613 "POST /fhir/Patient" => function (HttpRestRequest
$request) {
614 RestConfig
::authorization_check("patients", "demo");
615 $data = (array) (json_decode(file_get_contents("php://input"), true));
616 $return = (new FhirPatientRestController())->post($data);
617 RestConfig
::apiLog($return, $data);
620 "PUT /fhir/Patient/:id" => function ($id, HttpRestRequest
$request) {
621 RestConfig
::authorization_check("patients", "demo");
622 $data = (array) (json_decode(file_get_contents("php://input"), true));
623 $return = (new FhirPatientRestController())->put($id, $data);
624 RestConfig
::apiLog($return, $data);
627 "GET /fhir/Patient" => function (HttpRestRequest
$request) {
629 if ($request->isPatientRequest()) {
630 // only allow access to data of binded patient
631 // Note in Patient context still have to return a bundle even if it is just one resource. (ie.
632 // need to use getAll rather than getOne)
633 $params['_id'] = $request->getPatientUUIDString();
634 $return = (new FhirPatientRestController())->getAll($params, $request->getPatientUUIDString());
636 RestConfig
::authorization_check("patients", "demo");
637 $return = (new FhirPatientRestController())->getAll($params);
639 RestConfig
::apiLog($return);
642 // we have to have the bulk fhir export operation here otherwise it will match $export to the patient $id
643 'GET /fhir/Patient/$export' => function (HttpRestRequest
$request) {
644 RestConfig
::authorization_check("admin", "users");
645 $fhirExportService = new FhirExportRestController($request);
646 $return = $fhirExportService->processExport(
649 $request->getHeader('Accept'),
650 $request->getHeader('Prefer')
652 RestConfig
::apiLog($return);
655 "GET /fhir/Patient/:id" => function ($id, HttpRestRequest
$request) {
656 if ($request->isPatientRequest()) {
657 // only allow access to data of binded patient
658 if (empty($id) ||
($id != $request->getPatientUUIDString())) {
659 throw new AccessDeniedException("patients", "demo", "patient id invalid");
661 $id = $request->getPatientUUIDString();
663 RestConfig
::authorization_check("patients", "demo");
665 $return = (new FhirPatientRestController())->getOne($id);
666 RestConfig
::apiLog($return);
669 "GET /fhir/Encounter" => function (HttpRestRequest
$request) {
671 if ($request->isPatientRequest()) {
672 // only allow access to data of binded patient
673 $return = (new FhirEncounterRestController())->getAll($getParams, $request->getPatientUUIDString());
675 RestConfig
::authorization_check("encounters", "auth_a");
676 $return = (new FhirEncounterRestController())->getAll($getParams);
678 RestConfig
::apiLog($return);
681 "GET /fhir/Encounter/:id" => function ($id, HttpRestRequest
$request) {
682 if ($request->isPatientRequest()) {
683 // only allow access to data of binded patient
684 $return = (new FhirEncounterRestController())->getOne($id, $request->getPatientUUIDString());
686 RestConfig
::authorization_check("encounters", "auth_a");
687 $return = (new FhirEncounterRestController())->getOne($id);
689 RestConfig
::apiLog($return);
692 "GET /fhir/Practitioner" => function (HttpRestRequest
$request) {
693 RestConfig
::authorization_check("admin", "users");
694 $return = (new FhirPractitionerRestController())->getAll($_GET);
695 RestConfig
::apiLog($return);
698 "GET /fhir/Practitioner/:id" => function ($id, HttpRestRequest
$request) {
699 RestConfig
::authorization_check("admin", "users");
700 $return = (new FhirPractitionerRestController())->getOne($id);
701 RestConfig
::apiLog($return);
704 "POST /fhir/Practitioner" => function (HttpRestRequest
$request) {
705 RestConfig
::authorization_check("admin", "users");
706 $data = (array) (json_decode(file_get_contents("php://input"), true));
707 $return = (new FhirPractitionerRestController())->post($data);
708 RestConfig
::apiLog($return, $data);
711 "PUT /fhir/Practitioner/:id" => function ($id, HttpRestRequest
$request) {
712 RestConfig
::authorization_check("admin", "users");
713 $data = (array) (json_decode(file_get_contents("php://input"), true));
714 $return = (new FhirPractitionerRestController())->patch($id, $data);
715 RestConfig
::apiLog($return, $data);
718 "GET /fhir/Organization" => function (HttpRestRequest
$request) {
719 RestConfig
::authorization_check("admin", "users");
720 $return = (new FhirOrganizationRestController())->getAll($_GET);
721 RestConfig
::apiLog($return);
724 "GET /fhir/Organization/:id" => function ($id, HttpRestRequest
$request) {
725 RestConfig
::authorization_check("admin", "users");
726 $return = (new FhirOrganizationRestController())->getOne($id);
727 RestConfig
::apiLog($return);
730 "POST /fhir/Organization" => function (HttpRestRequest
$request) {
731 RestConfig
::authorization_check("admin", "super");
732 $data = (array) (json_decode(file_get_contents("php://input"), true));
733 $return = (new FhirOrganizationRestController())->post($data);
734 RestConfig
::apiLog($return, $data);
737 "PUT /fhir/Organization/:id" => function ($id, HttpRestRequest
$request) {
738 RestConfig
::authorization_check("admin", "super");
739 $data = (array) (json_decode(file_get_contents("php://input"), true));
740 $return = (new FhirOrganizationRestController())->patch($id, $data);
741 RestConfig
::apiLog($return, $data);
744 "GET /fhir/PractitionerRole" => function (HttpRestRequest
$request) {
745 RestConfig
::authorization_check("admin", "users");
746 $return = (new FhirPractitionerRoleRestController())->getAll($_GET);
747 RestConfig
::apiLog($return);
750 "GET /fhir/PractitionerRole/:id" => function ($id, HttpRestRequest
$request) {
751 RestConfig
::authorization_check("admin", "users");
752 $return = (new FhirPractitionerRoleRestController())->getOne($id);
753 RestConfig
::apiLog($return);
756 "GET /fhir/AllergyIntolerance" => function (HttpRestRequest
$request) {
758 if ($request->isPatientRequest()) {
759 // only allow access to data of binded patient
760 $return = (new FhirAllergyIntoleranceRestController())->getAll($getParams, $request->getPatientUUIDString());
762 RestConfig
::authorization_check("patients", "med");
763 $return = (new FhirAllergyIntoleranceRestController())->getAll($getParams);
765 RestConfig
::apiLog($return);
768 "GET /fhir/AllergyIntolerance/:id" => function ($id, HttpRestRequest
$request) {
769 if ($request->isPatientRequest()) {
770 // only allow access to data of binded patient
771 $return = (new FhirAllergyIntoleranceRestController())->getOne($id, $request->getPatientUUIDString());
773 RestConfig
::authorization_check("patients", "med");
774 $return = (new FhirAllergyIntoleranceRestController())->getOne($id);
776 RestConfig
::apiLog($return);
779 "GET /fhir/Observation" => function (HttpRestRequest
$request) {
781 if ($request->isPatientRequest()) {
782 // only allow access to data of binded patient
783 $return = (new FhirObservationRestController())->getAll($getParams, $request->getPatientUUIDString());
785 RestConfig
::authorization_check("patients", "med");
786 $return = (new FhirObservationRestController())->getAll($getParams);
788 RestConfig
::apiLog($return);
791 "GET /fhir/Observation/:uuid" => function ($uuid, HttpRestRequest
$request) {
792 if ($request->isPatientRequest()) {
793 // only allow access to data of binded patient
794 $return = (new FhirObservationRestController())->getOne($uuid, $request->getPatientUUIDString());
796 RestConfig
::authorization_check("patients", "med");
797 $return = (new FhirObservationRestController())->getOne($uuid);
799 RestConfig
::apiLog($return);
802 "GET /fhir/Immunization" => function (HttpRestRequest
$request) {
804 if ($request->isPatientRequest()) {
805 // only allow access to data of binded patient
806 $return = (new FhirImmunizationRestController())->getAll($getParams, $request->getPatientUUIDString());
808 RestConfig
::authorization_check("patients", "med");
809 $return = (new FhirImmunizationRestController())->getAll($getParams);
811 RestConfig
::apiLog($return);
814 "GET /fhir/Immunization/:id" => function ($id, HttpRestRequest
$request) {
815 if ($request->isPatientRequest()) {
816 // only allow access to data of binded patient
817 $return = (new FhirImmunizationRestController())->getOne($id, $request->getPatientUUIDString());
819 RestConfig
::authorization_check("patients", "med");
820 $return = (new FhirImmunizationRestController())->getOne($id);
822 RestConfig
::apiLog($return);
825 "GET /fhir/Condition" => function (HttpRestRequest
$request) {
827 if ($request->isPatientRequest()) {
828 // only allow access to data of binded patient
829 $return = (new FhirConditionRestController())->getAll($getParams, $request->getPatientUUIDString());
831 RestConfig
::authorization_check("patients", "med");
832 $return = (new FhirConditionRestController())->getAll($getParams);
834 RestConfig
::apiLog($return);
837 "GET /fhir/Condition/:id" => function ($uuid, HttpRestRequest
$request) {
838 if ($request->isPatientRequest()) {
839 // only allow access to data of binded patient
840 $return = (new FhirConditionRestController())->getOne($uuid, $request->getPatientUUIDString());
842 RestConfig
::authorization_check("patients", "med");
843 $return = (new FhirConditionRestController())->getOne($uuid);
845 RestConfig
::apiLog($return);
848 "GET /fhir/Procedure" => function (HttpRestRequest
$request) {
850 if ($request->isPatientRequest()) {
851 // only allow access to data of binded patient
852 $return = (new FhirProcedureRestController())->getAll($getParams, $request->getPatientUUIDString());
854 RestConfig
::authorization_check("patients", "med");
855 $return = (new FhirProcedureRestController())->getAll($getParams);
857 RestConfig
::apiLog($return);
860 "GET /fhir/Procedure/:uuid" => function ($uuid, HttpRestRequest
$request) {
861 if ($request->isPatientRequest()) {
862 // only allow access to data of binded patient
863 $return = (new FhirProcedureRestController())->getOne($uuid, $request->getPatientUUIDString());
865 RestConfig
::authorization_check("patients", "med");
866 $return = (new FhirProcedureRestController())->getOne($uuid);
868 RestConfig
::apiLog($return);
871 "GET /fhir/MedicationRequest" => function (HttpRestRequest
$request) {
873 if ($request->isPatientRequest()) {
874 // only allow access to data of binded patient
875 $return = (new FhirMedicationRequestRestController())->getAll($getParams, $request->getPatientUUIDString());
877 RestConfig
::authorization_check("patients", "med");
878 $return = (new FhirMedicationRequestRestController())->getAll($getParams);
880 RestConfig
::apiLog($return);
883 "GET /fhir/MedicationRequest/:uuid" => function ($uuid, HttpRestRequest
$request) {
884 if ($request->isPatientRequest()) {
885 // only allow access to data of binded patient
886 $return = (new FhirMedicationRequestRestController())->getOne($uuid, $request->getPatientUUIDString());
888 RestConfig
::authorization_check("patients", "med");
889 $return = (new FhirMedicationRequestRestController())->getOne($uuid);
891 RestConfig
::apiLog($return);
894 "GET /fhir/Medication" => function (HttpRestRequest
$request) {
895 RestConfig
::authorization_check("patients", "med");
896 $return = (new FhirMedicationRestController())->getAll($_GET);
897 RestConfig
::apiLog($return);
900 "GET /fhir/Medication/:uuid" => function ($uuid, HttpRestRequest
$request) {
901 RestConfig
::authorization_check("patients", "med");
902 $return = (new FhirMedicationRestController())->getOne($uuid);
903 RestConfig
::apiLog($return);
906 "GET /fhir/Location" => function (HttpRestRequest
$request) {
907 RestConfig
::authorization_check("patients", "med");
908 $return = (new FhirLocationRestController())->getAll($_GET);
909 RestConfig
::apiLog($return);
912 "GET /fhir/Location/:uuid" => function ($uuid, HttpRestRequest
$request) {
913 RestConfig
::authorization_check("patients", "med");
914 $return = (new FhirLocationRestController())->getOne($uuid);
915 RestConfig
::apiLog($return);
918 "GET /fhir/CareTeam" => function (HttpRestRequest
$request) {
920 if ($request->isPatientRequest()) {
921 // only allow access to data of binded patient
922 $return = (new FhirCareTeamRestController())->getAll($getParams, $request->getPatientUUIDString());
924 RestConfig
::authorization_check("patients", "med");
925 $return = (new FhirCareTeamRestController())->getAll($getParams);
927 RestConfig
::apiLog($return);
930 "GET /fhir/CareTeam/:uuid" => function ($uuid, HttpRestRequest
$request) {
931 if ($request->isPatientRequest()) {
932 // only allow access to data of binded patient
933 $return = (new FhirCareTeamRestController())->getOne($uuid, $request->getPatientUUIDString());
935 RestConfig
::authorization_check("patients", "med");
936 $return = (new FhirCareTeamRestController())->getOne($uuid);
938 RestConfig
::apiLog($return);
941 "GET /fhir/Coverage" => function (HttpRestRequest
$request) {
942 RestConfig
::authorization_check("admin", "super");
943 $return = (new FhirCoverageRestController())->getAll($_GET);
944 RestConfig
::apiLog($return);
947 "GET /fhir/Coverage/:uuid" => function ($uuid, HttpRestRequest
$request) {
948 RestConfig
::authorization_check("admin", "super");
949 $return = (new FhirCoverageRestController())->getOne($uuid);
950 RestConfig
::apiLog($return);
953 "GET /fhir/Person" => function (HttpRestRequest
$request) {
954 RestConfig
::authorization_check("admin", "users");
955 $return = (new FhirPersonRestController())->getAll($_GET);
956 RestConfig
::apiLog($return);
959 "GET /fhir/Person/:uuid" => function ($uuid, HttpRestRequest
$request) {
960 RestConfig
::authorization_check("admin", "users");
961 $return = (new FhirPersonRestController())->getOne($uuid);
962 RestConfig
::apiLog($return);
965 // Bulk FHIR api endpoints
966 'GET /fhir/Document/:id/Binary' => function ($documentId, HttpRestRequest
$request) {
967 // currently only allow users with the same permissions as export to take a file out
968 // this could be relaxed to allow other types of files ie such as patient access etc.
969 RestConfig
::authorization_check("admin", "users");
971 // Grab the document id
972 $docController = new \OpenEMR\RestControllers\FHIR\
FhirDocumentRestController($request);
973 $response = $docController->downloadDocument($documentId, $request->getRequestUserId());
976 'GET /fhir/Group/:id/$export' => function ($groupId, HttpRestRequest
$request) {
977 RestConfig
::authorization_check("admin", "users");
978 $fhirExportService = new FhirExportRestController($request);
979 $exportParams = $_GET;
980 $exportParams['groupId'] = $groupId;
981 $return = $fhirExportService->processExport(
984 $request->getHeader('Accept'),
985 $request->getHeader('Prefer')
987 RestConfig
::apiLog($return);
990 'GET /fhir/$export' => function (HttpRestRequest
$request) {
991 RestConfig
::authorization_check("admin", "users");
992 $fhirExportService = new FhirExportRestController($request);
993 $return = $fhirExportService->processExport(
996 $request->getHeader('Accept'),
997 $request->getHeader('Prefer')
999 RestConfig
::apiLog($return);
1002 // these two operations are adopted based on the documentation used in the IBM FHIR Server
1003 // we'd reference cerner or epic but we couldn't find any documentation about those (Jan 30th 2021)
1004 // @see https://ibm.github.io/FHIR/guides/FHIRBulkOperations/
1005 'GET /fhir/$bulkdata-status' => function (HttpRestRequest
$request) {
1006 RestConfig
::authorization_check("admin", "users");
1007 $jobUuidString = $_GET['job'];
1008 // if we were truly async we would return 202 here to say we are in progress with a JSON response
1009 // since OpenEMR data is so small we just return the JSON from the database
1010 $fhirExportService = new FhirExportRestController($request);
1011 $return = $fhirExportService->processExportStatusRequestForJob($jobUuidString);
1012 RestConfig
::apiLog($return);
1015 'DELETE /fhir/$bulkdata-status' => function (HttpRestRequest
$request) {
1016 RestConfig
::authorization_check("admin", "users");
1017 $job = $_GET['job'];
1018 $fhirExportService = new FhirExportRestController($request);
1019 $return = $fhirExportService->processDeleteExportForJob($job);
1020 RestConfig
::apiLog($return);
1025 // Note that the portal (api) route is only for patient role
1026 // (there is a mechanism in place to ensure only patient role can access the portal (api) route)
1027 RestConfig
::$PORTAL_ROUTE_MAP = array(
1028 "GET /portal/patient" => function (HttpRestRequest
$request) {
1029 $return = (new PatientRestController())->getOne($request->getPatientUUIDString());
1030 RestConfig
::apiLog($return);
1033 "GET /portal/patient/encounter" => function (HttpRestRequest
$request) {
1034 $return = (new EncounterRestController())->getAll($request->getPatientUUIDString());
1035 RestConfig
::apiLog($return);
1038 "GET /portal/patient/encounter/:euuid" => function ($euuid, HttpRestRequest
$request) {
1039 $return = (new EncounterRestController())->getOne($request->getPatientUUIDString(), $euuid);
1040 RestConfig
::apiLog($return);