Practitioner FHIR User Insufficient_Scope

[Aditya Ayyagari]

We have registered a Sandbox App as below

Client Id: ec1ec9ab-05e5-4e12-b6c1-357cec375ceb
App Id: 654a485f-7e7e-4390-b709-8966654c0b24
SMART Launch URI: https://localhost:44304/SmartClient/
Redirect URI: https://localhost:44304/SMARTArchive/APPID/
App Type: provider
FHIR Spec: dstu2 - "https://fhir-ehr-code.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d"
Authorized: true
Standard Scopes: launch profile fhirUser openid online_access
Patient Scopes: patient/Patient.read
User Scopes: user/Patient.read user/Person.read user/Practitioner.read

As you can see,  it is a provider app, and it has Practioner.read scope.  

It lauches our SMART app without any issues, we are also being given the token response well and trying to get the user information using access token but it resulted in the insufficient_scope error when trying to access the user ID url 

https://fhir-ehr-code.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d/Practitioner/4122622

{

    "resourceType": "OperationOutcome",

    "issue": [

        {

            "severity": "error",

            "code": "forbidden",

            "diagnostics": "Bearer realm=\"fhir-ehr-code.cerner.com\", error=\"insufficient_scope\"",

            "location": [

                "http.Authorization"

            ]

        }

    ]

}

How to fix this error.

[Aaron McGinn (Cerner)]

Per our group guidelines, can you provide the X-Request-Id from the response headers?

-Aaron (Cerner)

[Aditya Ayyagari]

here is the x-request-Id from the response headers 

d0e2e3b2-bb05-467d-b1e2-52632e856aed

[Aditya Ayyagari]

Hope you have an answer to this issue. 

[Aaron McGinn (Cerner)]

In the scopes you provided, you have "user%2F%20Practitioner.read" or "user/ Practitioner.read", so that will be read as two separate scopes. This means you were not authorized for "user/Practitioner.read".

-Aaron (Cerner)

[Aditya Ayyagari]

Thank you and it works now.  Do we get the email address of the Practitioner as part of the Resource field data.? 

[Aaron McGinn (Cerner)]

The email address will return as part of the telecom attribute [1].

[1] https://hl7.org/fhir/r4/practitioner-definitions.html#Practitioner.telecom

-Aaron (Cerner)

[Aditya Ayyagari]

Practitioner.telecom is missing for portal user.  In the production, they would have the data to repond back to this field?

[Aaron McGinn (Cerner)]

For an example, Kristin Carter has an email: /Practitioner/11817978

-Aaron (Cerner)