Calls made at Consent. Taught at /rail/stops/Consent.
Ask for an authentication. The rail decides and executes the factor; you get a resource back, and a URL to embed when the factor is one the member has to be present for.
Ask for an authentication. The rail decides and executes the factor; you get a resource back, and a URL to embed when the factor is one the member has to be present for.
Keep from the response: authentication_id, collection.url
Taught in: 03 · Consent
path Parameters
unique_patient_idunique patient id
Headers
X-Facility-IdThe facility this call is made from.
X-Facility-Id-TypeHow to read X-Facility-Id: mfl, license-number, fr-code, registration-number or fid.
Ask for an authentication. The rail decides and executes the factor; you get a resource back, and a URL to embed when the factor is one the member has to be present for. › Request Body
networkpurposeagent_idcallback_urlselection_refAsk for an authentication. The rail decides and executes the factor; you get a resource back, and a URL to embed when the factor is one the member has to be present for. › Responses
Returns authentication_id, collection.url.
authentication_idstatusnext_actionpurposenetworkexpires_atRead the authentication. Poll this as the safety net; the callback is the primary path.
Read the authentication. Poll this as the safety net; the callback is the primary path.
Keep from the response: status, expires_at
Taught in: 03 · Consent
path Parameters
unique_patient_idunique patient id
authentication_idauthentication id
Headers
X-Facility-IdThe facility this call is made from.
X-Facility-Id-TypeHow to read X-Facility-Id: mfl, license-number, fr-code, registration-number or fid.
Read the authentication. Poll this as the safety net; the callback is the primary path. › Responses
Returns status, expires_at.
authentication_idstatusfactorpurposenetworkverified_atexpires_atSend the passcode for the launched authentication. Part of the hosted surface: a form post that answers with an HTML fragment, not JSON. Every field is required — the surface re-runs the consent decision on each swap, so the launch context travels with each post.
Send the passcode for the launched authentication. Part of the hosted surface: a form post that answers with an HTML fragment, not JSON. Every field is required — the surface re-runs the consent decision on each swap, so the launch context travels with each post.
Keep from the response: the re-rendered verify slot
Taught in: 03 · Consent
Headers
X-Csrf-TokenThe value of the hie_csrf cookie, echoed back. Without it the surface answers 403. The hie_session and hie_csrf cookies are minted by GET /api/v1/ui/launch and are scoped to the UI mount path, gateway prefix included.
Send the passcode for the launched authentication. Part of the hosted surface: a form post that answers with an HTML fragment, not JSON. Every field is required — the surface re-runs the consent decision on each swap, so the launch context travels with each post. › Request Body
authentication_idcontact_idunique_patient_idpurposeselection_refcallback_urlSend the passcode for the launched authentication. Part of the hosted surface: a form post that answers with an HTML fragment, not JSON. Every field is required — the surface re-runs the consent decision on each swap, so the launch context travels with each post. › Responses
An HTML fragment, swapped into the surface by htmx. Failures come back 200 as well, with the message inside the fragment, so a caller driving this directly cannot branch on the status code.
Check the passcode the member read back. Answers with the receipt fragment on success, and with the executor's own message on a refusal.
Check the passcode the member read back. Answers with the receipt fragment on success, and with the executor's own message on a refusal.
Keep from the response: the receipt fragment
Taught in: 03 · Consent
Headers
X-Csrf-TokenThe value of the hie_csrf cookie, echoed back. Without it the surface answers 403. The hie_session and hie_csrf cookies are minted by GET /api/v1/ui/launch and are scoped to the UI mount path, gateway prefix included.
Check the passcode the member read back. Answers with the receipt fragment on success, and with the executor's own message on a refusal. › Request Body
authentication_idcontact_idunique_patient_idpurposeselection_refcallback_urlotpCheck the passcode the member read back. Answers with the receipt fragment on success, and with the executor's own message on a refusal. › Responses
An HTML fragment, swapped into the surface by htmx. Failures come back 200 as well, with the message inside the fragment, so a caller driving this directly cannot branch on the status code.