Insufficient scope for Location in secured fhir

[Peter Grazaitis]

I can confirm other queries for resources are working and I see the oAuth is including user/Location.read

I confirmed the apps configuration in the sandbox also specifies user/Location.read.

X-Request-Id: 76fb9256-4de0-46b6-8d85-edc461a373db

GET https://fhir-ehr-code.cerner.com/r4/ec2458f2-1e24-41c8-b71b-0e701af7583d/Location?_id=21304876

Thanks,

-Pete G

[Jenni Syed (Cerner)]

Hi Pete,

It looks like the application is requesting some conflicting scopes: 

patient/Location.read patient/Patient.read patient/Person.read profile user/Appointment.read user/Appointment.write user/Location.read user/Patient.read user/Person.read user/Practitioner.read

Can the application be changed to only use a single scope for each resource? IE: having both patient/Patient.read AND user/Patient.read for the same token are conflicting. In addition, Location isn't a patient-focused resource, so you will want to request only user/Location.read for that, just like was done for Practitioner above (the others should be chosen based on the app workflow).

Regards,

Jenni