https://medplum.com logo
Join Discord
Powered by
403: Forbidden error when updating `Practitioner`
# support
m
have a general question on either graphql update mutations or the updateResource MedplumClient method. Are these applicable towards updating a Practitioner resource, like a name of the practitioner, or address, or any peice of info on the Practitioner resource in general. Im trying to setup basic edit functionality for a Practitioner and so far im getting Uncaught (in promise) Error: Forbidden for the updateResource method, and a null response for the graphql mutation whenever trying to do it for a Practitioner, but for a Patient it works. Would love to get some insight on this to move forward. As an example, ill atattch a scenario where i use the graphql approach.
r
@mikee6290 I believe the issue is that you're trying to modify the 
id
field of the Practitioner. The Medplum server actually handles all id assignment for resources, and currently doesn't allow clients to overwite ids
Would it be possible to send a link from app.medplum.com to that practitioner?
m
Are you referring to line 6? Also is it just not possible to build out a update request like this for just changing a name or something simple like that?
r
Yep line 6.
So the FHIR spec mandates that a PUT request is a whole resource update You can also use the PATCH semantics to update just a single field (https://www.medplum.com/docs/sdk/classes/MedplumClient#patchresource)
However, patch is not yet well specified for graphQL
j
So if we want to do piecewise updates to resources, we have to use REST API PATCH, or we have to do a whole resource overwrite via mutations?
m
I am also getting a forbidden error with the medplum.patchResource() method.
Specifically for updating a Practitioner resource, for a Patient resource it works fine, same with the updateResource() method.
It looks like the reason for the failure is an Authorization failure since im getting the 'Forbidden' error.
r
@jasonwa.ng That's right. The HL7 organization is currently working on a specification for GraphQL patch semantics, and we're looking forward to implementing the standard they develop
@mikee6290 I was able to look at our logs, and I see that there is an access policy set on your client. It seems that there is an access policy set on your client that disallows write access to the 
Practitioner
resource. If you'd like the client to write 
Practitioners
, you just need to remove the "readonly" flag from your current policy
Copy code
{
      "resourceType": "Practitioner",
      "readonly": true
    },
m
I was actually looking through that and suspected it may be the issue too, I'll go ahead and fix that, thanks for pointing me in the right direction!
r
Sounds good. Let me know if that fixes your issue
b
@rahul1 catching up on the conversation here, we were planning on implementing an auto-save mechanism using graphql mutations for our questionnaire response. It sounds like if we're overwriting everything for every graphql mutation it might not make sense to use your graphql API? Correct me if I'm wrong.
r
@boogiecoco. You still could. You just need to need keep the latest state of the response on the client. That's actually what we do in our 
QuestionnaireForm
component https://github.com/medplum/medplum/blob/main/packages/react/src/QuestionnaireForm/QuestionnaireForm.tsx#L51
Both GraphQL mutations and our 
updateResource
function wrap a FHIR PUT request takes the full resource as a param https://www.hl7.org/fhir/http.html#update
The spec does allow for targetted updates with PATCH (https://www.hl7.org/fhir/http.html#patch), but unfortunately there isn't a FHIR GraphQL patch specification yet
b
Is there any benefit your team noticed to using graphql patch mutations versus the updateResource method for autosaving? Seems like it will be extra engineering work for client side so trying to weigh if its worth the additional effort.
r
> graphql patch mutations Sorry, I think I misunderstand. Unfortunately, PATCH is only available as part of the REST API (https://www.medplum.com/docs/sdk/classes/MedplumClient#patchresource) The GraphQL update mutation (https://www.medplum.com/docs/graphql/mutations#update-mutation) is equivalent to 
medplum.updateResource
(https://www.medplum.com/docs/sdk/classes/MedplumClient#updateresource). Both require sending the fully updated resource
b
Got it that makes sense, thank you.
r
My pleasure! Just me know if I can help you think through the design tradeoffs for your frontend. We're actively working with the FHIR community to understand what PATCH in GraphQL could look like
158 Views
PreviousNext
Powered by