Hi! I have an endpoint where I receive data from and EHR, I request patient.everything and create new records in medplum, or update them for recurring visitors This week I updated the api to the latest version and is returning 403 in many endpoints where it wasn’t. I realized that it started enforcing something about access policy, and was able to do most operations except for patient.everything Is there a way I can authorize it? Is there a way to better understand access policy and scopes? We’re getting ready to onboard more users and wanna make sure they’re safe

We would recommend setting up a staging environment and upgrading it first, if that makes sense. Do these guides on Authentication https://www.medplum.com/docs/authand Authorization https://www.medplum.com/docs/access provide any insight?

Thanks @reshma Ya it was on my dev environment Production was safe 😅 I’ll check those guides. I found the commit where my code stops working and reverted my deploy, I’ll try a couple of things and circle back if something Is there an access policy example collection? Or which value I need to use to allow everything ? tried different things and kept getting 403

Phew! :). Here are the sample access policies: https://www.medplum.com/docs/access/access-policies#examples