I was given access to use and test bots within the Medplum platform. Im now trying to deploy a bot to staging via the cli but im getting forbidden. "Error while creating new bot: Error: Forbidden"

Does the bot already exist?

When i run medplum whoami the Project id is the same as the one im using to create the bot. As for if the bot exists. i have a bot that i've deployed from the dashboard but they have different names. In the dash its {"name": "Send to metriport"} and in the cli im using send-to-metriport

can you put the bot id in the CLI and try?

Sorry i realize the confusion, im trying to run this npx medplum bot create and im getting Forbidden

Hm, first, I'm assuming you have changed your medplum.config.json to include your bot and updated it with the right ids (as follows https://github.com/medplum/medplum-demo-bots/blob/main/medplum.config.json) if you run

npm run build

and then

npx medplum deploy-bot send-to-metriport

as per the instructions you should have permissions https://github.com/medplum/medplum-demo-bots#installation - let me know if you want to do a quick zoom

Ah thanks I was able to get it deployed. I was confused by this step in the docs https://www.medplum.com/docs/bots/bots-in-production#creating-your-bot I thought i needed to run that command to add it to the "medplum.config.json"

We should work on that documentation! Thanks for flagging. So the bot-layer is locked down, you can't deploy arbitrary js to the lambda (compliance, sec, perf reasons). However, if you have an SDK you can add it as a dev dependency so that it will get all the type checking etc while writing the bot. See Stripe: https://github.com/medplum/medplum-demo-bots/blob/main/package.json Here's the bot: https://github.com/medplum/medplum-demo-bots/blob/main/src/examples/stripe-bots/stripe-create-invoice.ts

Makes sense I understand, so in order to use our package client once its deployed do we need to merge our code? Or is there another process you have?

as long as it is in npm it should be good and then you can add it to dev dependencies and use it. Because the deployment compiles to raw JS the SDK itself never makes it to Medplum bots

Yes this our package https://www.npmjs.com/package/@metriport/api

nice, you should be able to add it to devDependencies and use it in the bot then

So locally it works for typings but once it deploys and I execute the bot thats when it says it cant find @metriport/api

Hi Reshma, I was following to create a bot by the documentation below and found this thread. https://www.medplum.com/docs/bots/bots-in-production I tried

npm run build

and

npx medplum deploy-bot send-to-metriport

, but keep getting the below error:

could not determine executable to run

I have done this under

medplum/pacakges/server

. Am I doing in the right folder or is that only available under

medplum-demo-bots

for self-hosted community version? (I tried

medplum-demo-bots

in this folder, but still not working)

will you all open source the bot? Very curious!

Hey there, I am posting here because I could not get the Medplum CLI to create a bot because of the Error: Forbidden described in this thread. I tried all the steps in this thread but I could not resolve this issue. My workaround is to create the Bot in the webapp, then copy the data to the

medplum.config.json

. Saving and deploying works from within the CLI, with the same login.

/medplum-bots$ npx medplum bot create mybot <project-id> src/patient-notifier.ts dist/patient-notifier.js 
Error: Forbidden

/medplum-bots$ npx medplum --version
4.3.10-f464854d9

medplum-server: 4.3.3 (self hosted, local Docker) Am I doing something wrong? Thanks so much in advance for your help! Regards from Germany, Max PS: The CLI's verbose output reveals that POST to the

/admin/projects/<id>/ bot

endpoint is Forbidden. When I execute the same request from within the Webapp with the same account it succeeds.

> POST http://localhost:8103/admin/projects/0198ead1-5ad5-73c9-a04d-879a0e78a1ad/bot
> Accept: application/fhir+json, */*; q=0.1
> Authorization: Bearer ey123...
> Content-Type: application/fhir+json
> X-Medplum: extended
< 403 Forbidden

Hi @Max from m-creations how are you authenticating with the CLI? If you are authenticating with Client Credentials, you need to make sure that the corresponding ClientApplication's ProjectMembership has admin set to true.

Hi @finnbergquist, you guessed correctly about me authenticating with Client Credentials and setting the Admin flag in the ClientApplication's ProjectMembership did do the trick. Thank you very much! Kind regards, Max

No problem! Happy to help @Max from m-creations