403 Forbidden error for R4 Coverage PATCH request

278 views
Skip to first unread message
Assigned to Fenil....@cerner.com by me

Shradha Devarkar

unread,
May 28, 2021, 11:57:57 AM5/28/21
to Cerner FHIR Developers
Hi Team, 

I am constantly getting 403 error for R4 Coverage PATCH request. Used below request:

Authorization - Bearer+' '+token (authorization token is successfully getting generated for same environment)
Accept - application/fhir+json
Content-Type - application/json-patch+json
If-Match - W/148-0
body - [
  {
    "op": "replace",
    "path": "/class/0/value",
    "value": "729825"
  },
  {
    "op": "replace",
    "path": "/class/1/value",
    "value": "456"
  },
  {
    "op": "replace",
    "path": "/class/1/name",
    "value": "Miscellaneous Commercial Health Plan"
  },
  {
    "op": "replace",
    "path": "/dependent",
    "value": "9816564"
  },
  {
    "op": "replace",
    "path": "/period",
    "value": {
      "start": "2014-09-05T14:30:12.000Z",
      "end": "2015-09-05T14:30:12.000Z"
    }
  },
  {
    "op": "replace",
    "path": "/relationship",
    "value": {
      "coding": [
        {
          "code": "parent"
        }
      ]
    }
  },
  {
    "op": "replace",
    "path": "/subscriberId",
    "value": "4655446"
  },
  {
    "op": "replace",
    "path": "/subscriber",
    "value": {
      "reference": "Patient/1626016"
    }
  }
]

Getting below response :
{
    "resourceType": "OperationOutcome",
    "issue": [
        {
            "severity": "error",
            "code": "forbidden",
            "diagnostics": "Bearer realm=\"fhir-ehr.sandboxcerner.com\", error=\"insufficient_scope\"",
            "expression": [
                "http.Authorization"
            ]
        }
    ]
}
Attaching screen-shot of header. Please help, we have tried this multiple times but unable to get success response.

Thank you
PATCH error.png

Jagmohan

unread,
May 28, 2021, 8:09:49 PM5/28/21
to cerner-fhir...@googlegroups.com
Check for the Scope values

--
You received this message because you are subscribed to the Google Groups "Cerner FHIR Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cerner-fhir-devel...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/eb8ac537-3002-4226-93d6-3f90adff8958n%40googlegroups.com.


--
Thanks & Regards
Jagmohan Bodra

Shradha Devarkar

unread,
May 29, 2021, 1:04:30 AM5/29/21
to cerner-fhir...@googlegroups.com
Thanks for your reply. Are you talking about  '623884-674012' these values? Please elaborate. Same error I am getting for 'GET coverage' request as well.
Request - GET
and body as - grant_type=client_credentials&scope=system%2FPatient.read%20system%2FPatient.write%20system%2FRelatedPerson.read%20system%2FContract.read%20system%2FMedicationStatement.read%20system%2FProvider.read%20system%2FAppointment.read%20system%2FMedicationOrder.read%20system%2FAppointment.read%20system%2FPractitioner.read%20system%2FEncounter.read%20system%2FDevice.read%20system%2FAllergyIntolerance.read%20system%2FCondition.read%20system%2FImmunization.read%20system%2FSchedule.read%20system%2FSlot.read%20user%2FAppointment.write%20system%2FAppointment.write

Let me know if you need more details.

Thanks in advance,
Shradha Devarkar 

You received this message because you are subscribed to a topic in the Google Groups "Cerner FHIR Developers" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/cerner-fhir-developers/Z4uyjWAFEB4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cerner-fhir-devel...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/CALjO0XZv_oiofZy%3DfF_6DcF0fJNHxVRLo3vErh7vBqgEoYXCWQ%40mail.gmail.com.

Jagmohan

unread,
May 29, 2021, 2:24:15 AM5/29/21
to cerner-fhir...@googlegroups.com
I am talking about the User Scopes . 
The ResourceType you are using needs to be there in your scope parameter.

In your case Coverage is the scope. Configure it with your App if not, also add in scope variable with the authorization request.

To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/CAKb95CSpnCu63gP9PerzDOi8EXPAvBHRru3SVkJsMPvRxH04mA%40mail.gmail.com.

Shradha Devarkar

unread,
May 29, 2021, 3:58:57 PM5/29/21
to cerner-fhir...@googlegroups.com
Added Coverage at the end for getting authorization token request, still getting 403 error, am I missing anything here?

grant_type=client_credentials&scope=system%2FPatient.read%20system%2FPatient.write%20system%2FRelatedPerson.read%20system%2FContract.read%20system%2FMedicationStatement.read%20system%2FProvider.read%20system%2FAppointment.read%20system%2FMedicationOrder.read%20system%2FAppointment.read%20system%2FPractitioner.read%20system%2FEncounter.read%20system%2FDevice.read%20system%2FAllergyIntolerance.read%20system%2FCondition.read%20system%2FImmunization.read%20system%2FSchedule.read%20system%2FSlot.read%20user%2FAppointment.write%20system%2FAppointment.write%20system%2FCoverage.read%20system%2FCoverage.write
X -request-id for SEARCH Request - 884e7219-3801-4b36-bc16-c6b89c57ab0c
X-request-id for PATCH request - ccea4d92-af25-445e-807f-0dd30ea78b88

It would be helpful if you send sample POSTMAN request for SEARCH or PATCH.

To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/CALjO0XbNV-7GAMJG3cL3A%2BtE%2BWkvLH5WzEHwukZ30UYNA4qp2A%40mail.gmail.com.

Jagmohan

unread,
May 30, 2021, 5:36:53 AM5/30/21
to cerner-fhir...@googlegroups.com
Did you add this in the "My Apps" code Cerner?
Check for the Scopes in the app settings, the desired scope is checked or not.
( User Scopes/ Patient Scopes)

To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/CAKb95CSoW%2Bw7m%3DQwZTzenxG81v4FXYX02wq3uqhyj40YRETsxA%40mail.gmail.com.

Fenil Desani (Cerner)

unread,
May 30, 2021, 10:54:56 AM5/30/21
to Cerner FHIR Developers
Hello,

Your Application does not have the Coverage read/write scopes enabled. To update scopes for your App associated with Non-Prod domains, please ask the Health System to log a ticket to Cerner.

Thanks,
Fenil (Cerner)

Shradha Devarkar

unread,
Jun 2, 2021, 10:53:48 AM6/2/21
to Cerner FHIR Developers
Hi,

Can you check this ticket no. - 436825570 and enable read/write coverage scopes. Let me know if anything else is pending from our side.

Thanks,
Shradha Devarkar

Fenil Desani (Cerner)

unread,
Jun 3, 2021, 12:41:18 AM6/3/21
to Cerner FHIR Developers
Thanks for the information. Our support team is in contact and will make the relevant changes.
Once the scopes are added, please re-test. 

Shradha Devarkar

unread,
Jun 4, 2021, 6:19:50 AM6/4/21
to Cerner FHIR Developers

Hi,

Now system/coverage.read and system/coverage.write scopes are added to the Banner: Salesforce CRM Integration FHIR application in sandbox auth server. So when I am trying for SEARCH or PATCH call, I am getting "500 Internal Server Error" every time.

1. Below is the request I am using for getting authorization token: 
Body: grant_type=client_credentials&scope=system%2FCoverage.read%20system%2FCoverage.write%20system%2FPatient.read%20system%2FPatient.write%20system%2FMedicationStatement.read%20system%2FProvider.read%20system%2FAppointment.read%20system%2FMedicationOrder.read%20system%2FAppointment.read%20system%2FPractitioner.read%20system%2FEncounter.read%20system%2FDevice.read%20system%2FAllergyIntolerance.read%20system%2FCondition.read%20system%2FImmunization.read%20system%2FSchedule.read

2. In authorization response I am getting below scopes: system/Coverage.read system/Coverage.write system/Patient.read system/Patient.write system/MedicationStatement.read system/Appointment.read system/MedicationOrder.read system/Practitioner.read system/Encounter.read system/Device.read system/AllergyIntolerance.read system/Condition.read system/Immunization.read system/Schedule.read

3. X-Request-Id for PATCH: fd94ca37-a2d5-4e60-8f1a-142899298aa6 (If-Match header set as - W/"10", let me know if this is correct)

4. X-Request-Id for SEARCH: 5d7103a8-268a-4627-a8d9-fa2f666acd7d

for both requests getting response as:
{
    "resourceType": "OperationOutcome",
    "issue": [
        {
            "severity": "fatal",
            "code": "exception",
            "details": {
                "text": "Internal server error"
            }
        }
    ]
}

Kindly let us know how to proceed further ASAP as we are unable to make any successful COVERAGE API calls.

Thanks,
Shradha Devarkar

Shradha Devarkar

unread,
Jun 4, 2021, 10:36:39 AM6/4/21
to Cerner FHIR Developers
Hi Team,

Also I have one query in addition to above mail. Can we update multiple coverages at a time or only one coverage can be updated at a time?

Thanks,
Shradha Devarkar

Fenil Desani (Cerner)

unread,
Jun 4, 2021, 12:07:16 PM6/4/21
to Cerner FHIR Developers
Coverage scope has been enabled, however coverage service is not enabled in your PROD/Non-prod domain.
I would suggest logging a new ticket to Cerner 'Ignite APIs for Millennium' and asking them to enable Coverage Services in your domain.

Shradha Devarkar

unread,
Jun 8, 2021, 1:36:05 PM6/8/21
to cerner-fhir...@googlegroups.com
Hi Team,

Getting 500 Internal Server Error for CREATE COVERAGE request:

X- request- Id : b0335d61-7ec1-4726-9707-5fb68bdfd653
Body: [{
  "resourceType": "Coverage",
  "status": "active",
  "subscriber": {
    "reference": "Patient/48902818"
  }
}]
Let us know what is missing in this request, not able to create coverage records.

Thanks,
Shradha Devarkar

To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/5f8b1336-0e54-4239-b761-0d54c3e552edn%40googlegroups.com.

Shradha Devarkar

unread,
Jun 9, 2021, 5:23:16 AM6/9/21
to Cerner FHIR Developers
Hi,

I am still facing issue for CREATE and PATCH Coverage requests, kindly help us to resolve this issue at the earliest.

1. PATCH request - 404 Not Found
X-Request-Id : 8578b5a0-212c-4987-8092-cd31f72cc15b

2. CREATE request - 500 Internal Server Error
X-Request-Id : b047f7a7-bbb2-4cd0-b6fe-8d18c6540982 (Error from cloudfront)

We are not able to get success response for above two requests, any help would be highly appreciated. Please reply.

Also let me know which id need to be used after "https://fhir-ehr.sandboxcerner.com/r4/7b05fdc7-a9fe-4664-862c-08120b9114ba/Coverage/:id"     in PATCH request?
Sending results of SEARCH request is as follows:
{
    "resourceType": "Bundle",
    "id": "b28ec941-5cce-4433-ba06-6ba1dce83f22",
    "type": "searchset",
    "total": 1,
    "link": [
        {
            "relation": "self",
        }
    ],
    "entry": [
        {
            "resource": {
                "resourceType": "Coverage",
                "id": "48902818-3355175258-3355175258",
                "meta": {
                    "versionId": "0-0",
                    "lastUpdated": "2021-06-08T20:51:42.000Z"
                },
                "text": {
                    "status": "generated",
                    "div": "<div xmlns=\"http://www.w3.org/1999/xhtml\"><p><b>Coverage</b></p><p><b>Status</b>: Active</p><p><b>Subscriber</b>: BFHIR, TESTCONSUMERONE</p><p><b>Subscriber Id</b>: W123456789</p><p><b>Beneficiary</b>: BFHIR, TESTCONSUMERONE</p><p><b>Dependent Number</b>: W123456789</p><p><b>Relationship</b>: Self</p><p><b>Coverage Start Date</b>: Jun  8, 2021  7:00 A.M. UTC</p><p><b>Payor</b>: BANNER AETNA EMPLOYEE PLANS</p><p><b>Class</b>:</p><dl><dt>Plan</dt><dd><b>Value</b>: 106307208</dd><dd><b>Name</b>: BANNER AETNA CHOICE PLUS</dd><dt>Group</dt><dd><b>Value</b>: 28573105500001</dd></dl></div>"
                },
                "status": "active",
                "subscriber": {
                    "reference": "Patient/48902818",
                    "display": "BFHIR, TESTCONSUMERONE"
                },
                "subscriberId": "W123456789",
                "beneficiary": {
                    "reference": "Patient/48902818",
                    "display": "BFHIR, TESTCONSUMERONE"
                },
                "dependent": "W123456789",
                "relationship": {
                    "coding": [
                        {
                            "system": "http://terminology.hl7.org/CodeSystem/subscriber-relationship",
                            "code": "self",
                            "display": "Self",
                            "userSelected": false
                        }
                    ],
                    "text": "Self"
                },
                "period": {
                    "start": "2021-06-08T07:00:00.000Z"
                },
                "payor": [
                    {
                        "reference": "Organization/37434873",
                        "display": "BANNER AETNA EMPLOYEE PLANS"
                    }
                ],
                "class": [
                    {
                        "type": {
                            "coding": [
                                {
                                    "system": "http://terminology.hl7.org/CodeSystem/coverage-class",
                                    "code": "plan"
                                }
                            ]
                        },
                        "value": "106307208",
                        "name": "BANNER AETNA CHOICE PLUS"
                    },
                    {
                        "type": {
                            "coding": [
                                {
                                    "system": "http://terminology.hl7.org/CodeSystem/coverage-class",
                                    "code": "group"
                                }
                            ]
                        },
                        "value": "28573105500001"
                    }
                ]
            }
        }
    ]
}

Shradha Devarkar

unread,
Jun 9, 2021, 12:31:45 PM6/9/21
to Cerner FHIR Developers
Hi Team,

Please reply to trail mail ASAP, we are actually blocked in making PATCH and CREATE COVERAGE requests work since last 2 weeks.

Thanks & Regards,
Shradha Devarkar

Fenil Desani (Cerner)

unread,
Jun 9, 2021, 4:49:31 PM6/9/21
to Cerner FHIR Developers
Can you share the body of your request?

Shradha Devarkar

unread,
Jun 9, 2021, 7:35:31 PM6/9/21
to cerner-fhir...@googlegroups.com
Hi Fenil,

Thanks for your reply.

Body of PATCH request:
If-match : W/"0" X-request-Id: 28002aba-daf7-400d-a9f7-c8ad42c877da
[
  
  {
    "op": "replace",
    "path": "/class/1/value",
    "value": "456"
  },
  {
  "op": "replace",
  "path": "/period",
  "value": {
 
    "end": "2021-10-10T14:30:12.000Z"
  }
}
]

Body of CREATE request: Now getting 400 Bad request Error)
X-request-Id: 5c825a61-f7d1-44e8-8ae3-85d4d8ad4d2c Patient with 48902818 Id is present in B1805
{
  "resourceType": "Coverage",
  "status": "active",
  "subscriber": {
    "reference": "Patient/48902818"
  },
  "subscriberId": "123",
  "beneficiary": {
    "reference": "Patient/48902818"
  },
  "relationship": {
    "coding": [
      {
        "code": "other"
      }
    ]
  },
  "period": {
    "start": "2021-09-05T14:30:12.000Z",
    "end": "2021-09-05T14:30:12.000Z"
  },
  "payor": [
    {
      "reference": "Organization/643847",
      "display": "Aetna Missouri POS - Open"
    }
  ],
  "class": [
    {
      "type": {
        "coding": [
          {
            "system": "http://hl7.org/fhir/ValueSet/coverage-class",
            "code": "plan"
          }
        ],
        "text": "plan"
      },
      "value": "729827",
      "name": "Aetna Missouri POS Open"
    },
    {
      "type": {
        "coding": [
          {
            "system": "http://hl7.org/fhir/ValueSet/coverage-class",
            "code": "group"
          }
        ],
        "text": "group"
      },
      "value": "729839",
      "name": "Aetna Missouri POS Open group"
    }
  ]
}

To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/043b1ce9-6efe-4870-a740-1ba931dd3c02n%40googlegroups.com.

Fenil Desani (Cerner)

unread,
Jun 10, 2021, 9:03:23 AM6/10/21
to Cerner FHIR Developers
For Patch - Can you make sure this is the correct ID - Coverage/623884-674012 ?

For Create -  The health plan with id [729827] could not be found

Shradha Devarkar

unread,
Jun 10, 2021, 9:17:52 AM6/10/21
to cerner-fhir...@googlegroups.com
Hi Fenil,

1. Which Id we are supposed to pass in PATCH request after Coverage/  ?  Please let me know, I tried a combination of subscriber ID and dependent but not getting results.
2. For CREATE - I have tried using '106307208' this ID too, which is present as we got this ID in SEARCH results as well but still getting 500 Internal Server Error. Can you check at your end?

SEARCH response for your reference:
{
    "resourceType": "Bundle",
    "id": "d5b62648-e257-4e45-a038-a5b098775acb",

Thanks & Regards,
Shradha Devarkar
To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/0f69f224-285a-43d0-ba5e-70a6713b8f16n%40googlegroups.com.

Fenil Desani (Cerner)

unread,
Jun 10, 2021, 11:37:21 AM6/10/21
to Cerner FHIR Developers
PATCH - The Id should be the same as retrieved from the GET in resource.id
Create - I was able to post coverage successfully using

{
"resourceType": "Coverage",
"status": "active",
"subscriber": {
"reference": "Patient/48902818"
},
"subscriberId": "123",
"beneficiary": {
"reference": "Patient/48902818"
},
"relationship": {
"coding": [
{
"code": "other"
}
]
},
"period": {
"start": "2021-09-05T14:30:12.000Z",
"end": "2021-09-05T14:31:12.000Z"
},
"payor": [
{
"reference": "Organization/643847",
"display": "Aetna Missouri POS - Open"
}
],
"class": [
{
"type": {
"coding": [
{
"code": "plan"
}
],
"text": "plan"
},
"value": "106307208",
"name": "Aetna Missouri POS Open"
},
{
"type": {
"coding": [
{
"code": "group"
}
],
"text": "group"
},
"value": "106307208",
"name": "Aetna Missouri POS Open group"
}
]
}

Shradha Devarkar

unread,
Jun 10, 2021, 12:13:51 PM6/10/21
to cerner-fhir...@googlegroups.com
Hi Fenil,

Thank you for your explanation but I have tried all ids which we get from GET request: Getting 404 error. X-request-ID: 63bc0535-c14b-4151-9fb1-f758d1b1c4e2
For PATCH request, with PERSON_ID 48902818, we have three resource ids as follows. These Ids we got from GET request in B1805 environment. Let me know if I am missing anything here.
48902818-3355175258-3355175258
48902818-3355183361-3355183361
48902818-3355183367-3355183367

image.png
Thanks in advance,
Shradha Devarkar
To view this discussion on the web visit https://groups.google.com/d/msgid/cerner-fhir-developers/68786d36-03f9-4120-9a9f-a7a86e294b07n%40googlegroups.com.

Shradha Devarkar

unread,
Jun 10, 2021, 1:30:50 PM6/10/21
to cerner-fhir...@googlegroups.com
Hi Fenil,

Body for PATCH request is as follows:  Getting 404 error. X-request-ID: 63bc0535-c14b-4151-9fb1-f758d1b1c4e2
Tried these 3 IDs, below sending 1 example:
48902818-3355175258-3355175258
48902818-3355183361-3355183361
48902818-3355183367-3355183367

[
  {
    "op": "replace",
    "path": "/class/0/value",
    "value": "106307208"

  },
   {
    "op": "replace",
    "path": "/period",
    "value": {
      "end": "2022-09-05T14:30:12.000Z"
    }
  },
    {
    "op": "replace",
    "path": "/subscriber",
    "value": {
      "reference": "Patient/48902818"
    }
  }
 
]

Endpoint: https://fhir-ehr.sandboxcerner.com/r4/7b05fdc7-a9fe-4664-862c-08120b9114ba/Coverage/48902818-3355175258-3355175258

Headers:
Accept : application/fhir+json
Content-Type: application/json-patch+json
If-Match : W/"0"
Authorization : Bearer+” ”+token

Fenil Desani (Cerner)

unread,
Jun 10, 2021, 3:27:53 PM6/10/21
to Cerner FHIR Developers
That is a private Patient level coverage.

Search
  • Public Healthcare represents an insurance policy funded by a public health system such as a provincial or national health plan. If there are any public coverages, they will return with an id prefixed with ‘PH’ or ‘PHP’ and will be returned in the payload with the rest of the coverages (private coverages).
PATCH
  • For Private Coverages, only Encounter-level Coverages may be patched.
  • For Public Coverages, both Encounter-level and Patient-level Coverages may be patched, with the caveat of only supporting the /period and /class/0/value operations.
Reply all
Reply to author
Forward
0 new messages