At the moment, I am working toward allowing a patient to enter FHIR based data in a user friendly way to keep track of their health. I wanted to add the Condition resource to the app. So essentially the patient would fill out fields that correlated to FHIR fields and then press save. When they press save, I use the medplum.createResource method provided by medplum to try creating the resource. I'm hitting a 403 Forbidden error when I try to do this. I wasn't too sure why this happens to be honest, the only thing I could think of was looking at the access policy I created. So I checked the AccessPolicy I created on medplum and this is what I have currently:

{
  "resourceType": "AccessPolicy",
  "name": "PatientSelfAccessPolicy",
  "compartment": {
    "reference": "Patient/{{patientId}}"
  },
  "resource": [
    {
      "resourceType": "Patient",
      "criteria": "Patient?_id={{patientId}}"
    },
    {
      "resourceType": "MedicationRequest",
      "criteria": "MedicationRequest?subject=Patient/{{patientId}}"
    },
    {
      "resourceType": "Basic",
      "criteria": "Basic?subject=Patient/{{patientId}}"
    },
    {
      "resourceType": "Condition",
      "criteria": "Condition?subject=Patient/{{patientId}}"
    }
  ],
  "id": "(id)",
  "meta": {
    "project": "(project id)",
    "compartment": [
      {
        "reference": "Project/(medplum project id)"
      }
    ],
    "versionId": "version id",
    "lastUpdated": "2025-03-15T08:21:53.163Z",
    "author": {
      "reference": "Practitioner/(# kept secret here)",
      "display": "Zain"
    }
  }
}

Following the docs on open patient registration and access I set the projects default patient access policy to this newly created policy. However, even after I did that, it seems that I still can't save the condition resource. I also tried following the docs that said to write the criteria in the following format for example: "criteria": "Condition?_?_compartment=%patient".

Hi @zainaltaf - can you share the full

AccessPolicy

that shows how you're using the

%patient

variables?

Sorry is this missing the full policy?

@zainaltaf could you also share the REST call you were making to create the Condition? You can find this in your network tab (it should be a POST request to the

/fhir/R4/Condition

url). If using fake data, a screenshot would also be very helpful for debugging.

yeah for sure @rahul1 I can check that out. I believe this is what you're asking for right?

Hi @zainaltaf , thank you for your patience. We're still working on reproducing this

Sounds good thanks