Hello medplum team! I am self hosting in AWS. In this case, how do I create a bot for any project as a super admin? I used the following command: npx medplum bot create The bot was successfully created. However, the project id for the bot is not the project_id I provided. Instead, it used the admin project id. Because of this, I was not able to subscribe this bot to capture data changes in non-admin projects. My guess for why this happens is that it’s always using the project id from the auth context rather than the provided project id to create a bot: https://github.com/medplum/medplum/blob/a5af81e91ece5537fd08cbfab42ef7cf7ea61d4c/packages/server/src/admin/project.ts#L64 How do I get around this? Thank you!

It is recommended to use the Project Admin level access to do operations of this kind. So this is by design if I'm understanding correctly. Do you want to $clone a project instead? That might be the better way to create a bot for a specific project. https://www.medplum.com/docs/self-hosting/super-admin-cli#project-management

Thank you @reshma ! Just for my own understanding, is it not possible to create bots that run in non-admin projects? I have a multi-tenant structure where each project sets the resource boundary. I would like bots to run in these non-admin projects too. Is there a way to achieve this? Thanks!

Each project can have it's own bots! You'll need to enable bots for the project (log in as Super Admin, and add the "bots" feature to the /Project resource. Then you should be able to deploy and execute bots isolated to any project with bots enabled

@reshma Gotcha! I have tried turning on "bots" feature for the non-admin project but bot doesn't seem to execute. Interestingly, the same bot would execute in the admin project, just not in non-admin projects that have the "bots" feature turned on. Any other pointer on what could cause this?

When you are logged into Medplum app and into an account in a specific project - can you execute from Medplum App?

No. The bot still didn't execute

Yes, create and execute the bot as a regular user, not a Super Admin - here is a short tutorial https://share.descript.com/view/JWMqRaCBq6Z

@reshma Thank you for the tutorial! When I navigate to the bot page in non-admin project, I am not able to create a new bot. Here is what I see on the bots page:

Can you show your sidebar? Is the user you are logged in as an admin for this project?

@reshma Here is the sidebar. The user logged in is not an admin for this project. Do I need to set the user as admin?

Indeed you do! User creating/running bot should be admin of the Project (not super admin)

@reshma Thank you for the clarification! I got this to work as admin of the project finally. Is there a way to create a bot using CLI instead of doing it in the medplum app? I followed https://www.medplum.com/docs/bots/bots-in-production and set .env to

MEDPLUM_CLIENT_ID

and

MEDPLUM_CLIENT_SECRET

using the client application of the actual project but got "Forbidden" when running

medplum bot create

command. I was only able to run

npx medplum bot create <bot-name> <project-id> <source-file> <dist-file>

as the super admin. Is there something I am missing?

the CLI should definitely work - if you remove the .env and run

medplum login

from the command line? Then log in with your admin account and try again? Here's the bot deploy guide https://www.medplum.com/docs/bots/bots-in-production#deploying-your-bot

@reshma Thank you for the pointer! I apologize that I had to ask so many dumb questions. So I removed both

.env

and

~/.medplum/default.json

, ran

medplum login

using an admin account but still got "Forbbiden". The admin account is not a super admin account. The same account can create, deploy and execute bot on using the app UI.

Interesting - if you have a consistent repro on the clear profile scenario, we would appreciate an issue on that front

My assumption is that client credential should be able to deploy bots too. It would be super helpful in CI pipelines. Is this intended design that client credential can't create bot?

Yeah, it should - though sometimes there might be some cached state interfereing. If you start a new terminal and do the following commands in terminal right before deploy - does it work? `export MEDPLUM_CLIENT_ID= export MEDPLUM_CLIENT_SECRET= '

@reshma I still got "Forbidden". Here are the steps I took: instead of running

medplum login

, I only set client id, client secret and base url in a new terminal. Then running

bot create

would turn into this error.

Hi @shuying42 you will need to make sure your

ClientApplication

also has admin privileges. You can got to the client admin page here, click on your client, and the click the "Admin" checkbox https://app.medplum.com/admin/clients

@rahul1 Oh gotcha! Thanks for the pointer!