ONC (g)(10) Standardized API requirements.

[Rajkumar P]

Hi Team,

I am Rajkumar and I have recently started working on ONC Certification, specifically the ONC (g)(10) Standardized API requirements.

Currently, I have successfully configured and deployed:
* Keycloak as the Authorization Server
 
* HAPI FHIR Server as the FHIR Resource Server
 
* Apache Tomcat for hosting
 

Both Keycloak and HAPI FHIR Server are up and running.

I have a few questions regarding the next steps in the certification process:

1. When a user accesses the FHIR endpoint, how does the SMART on FHIR authorization flow automatically open the login page or authentication modal?
 
2. How does the redirect URL work between the SMART application and Keycloak?
 
3. After successful login, how is the authorization code returned to the application?
 
4. How is the access token generated and validated by the HAPI FHIR Server?
 
5. What is the complete workflow from FHIR endpoint access to retrieving patient data?
 
6. What are the next implementation steps before starting Inferno G10 testing?
 
7. Is there any step-by-step documentation, architecture diagram, implementation guide, training material, or reference project available for Keycloak + HAPI FHIR + SMART on FHIR + Inferno certification testing?
 

My understanding is:

1. The FHIR endpoint should be the HAPI FHIR Server endpoint, correct?
2. We need to provide the FHIR URL, Client ID, and Client Secret registered in Keycloak.
3. Are the SMART-on-FHIR scopes configured automatically, or do we need to configure them manually in Keycloak?
4. Does the FHIR endpoint need to be registered anywhere in the SMART App Launch testing setup before running the tests?
5. After submitting the configuration, I see a modal popup containing a redirect URL. Should this redirect URL be registered in Keycloak as a valid redirect URI?
6. When I click the redirect URL, token validation occurs and the tests start automatically. Is this the expected behavior?

I also need clarification regarding patient data:

• Where will the patient list come from?
• Will patients be displayed from the HAPI FHIR server data?
• Or will the patient list come from our application?
• Do we need to create/register patient resources in the HAPI FHIR server (for example using Swagger/API endpoints) before running the tests?

I would appreciate any documentation, examples, or guidance that can help me understand the complete flow and prepare for Inferno testing.

Thank you.