We are using some custom API endpoints to perform certain functions, and need to be able to do things that, for example, a patient shouldnt be able to do, except in this custom API endpoint use-case, and so we need to still retain the full permissions the backend client has, while still saying "this was triggered by X user". Is that a thing, or are we forced to just saying "the system did it" in the audit trail? One use-case is that we want to allow a patient to upload images of insruance cards, but we dont want to give the patient blanket "can upload files" permissions, and so are using a custom api endpoint rather than the medplumProvider etc for THIS functionality.

Hi @oscadev , you might be able to use on behalf of: https://www.medplum.com/docs/auth/methods/on-behalf-of Edit: ah shoot, you mentioned it in your title. I believe you still have to give the patient access via the accesspolicy of the projectmembership. Another option is to create a separate ClientApplication, one that is used just for that endpoint, and give that permission to upload files and call it "Patient-Facing Insurance Uploader" or something like that