403 Forbidden on Practitioner/Read

[david....@commontime.com]

Hi,

I'm trying to find out about the logged in user (portal / portal in this case) so I can read a medical ID but I keep getting a 403 forbidden. 

I see the get request go out to:

https://fhir-ehr.sandboxcerner.com/dstu2/0b8a0111-e8e6-4c26-a91c-5069cbc6b1ca/Practitioner/4464007

My scopes are:

Standard Scopes:

launch

profile

openid

online_access

Patient Scopes:

patient/Condition.read

patient/DiagnosticReport.read

patient/DocumentReference.read

patient/Encounter.read

patient/MedicationOrder.read

patient/MedicationStatement.read

patient/Observation.read

patient/Patient.read

patient/Practitioner.read

patient/Procedure.read

X-Request-Id or CorrelationId: 

X-Request-Id:

83eba1c40f4ae475b3400e32ada570d4

Appreciate the help!

Thanks,

David

[Max Philips (Cerner)]

Hi David,

fhir-ehr is the non-patient-access version of Cerner's sandbox.  In order to make requests against it, you'll need to request user-level scopes, e.g. "user/Practitioner.read".

Conversely, fhir-myrecord is the patient-access version of Cerner's sandbox, patient-level scopes will work there.

Here's some further reading: http://fhir.cerner.com/millennium/dstu2/#secure-sandbox

Thanks,

Max (Cerner)

[Max Philips (Cerner)]

As a follow up: for the Practitioner resource, patient access is not available.  This is noted in our documentation under Authorization Types: http://fhir.cerner.com/millennium/dstu2/individuals/practitioner/#retrieve-by-id

However, other resources in the sandbox are available for patient-access testing, using the fhir-myrecord URL and a patient-level scope.  Resource pages on fhir.cerner.com note which authorization types are supported per resource.

Thanks,

Max (Cerner)