Hi all, we're building a multi-tenant practice platform on hosted Medplum (one project, one Organization per clinic, AccessPolicies parameterised on %organization, per the multi-tenant access docs). A few questions before we move to Production:
Public endpoints: our public booking page, calendar (.ics) feeds, unsubscribe links and inbound webhooks (SMS replies, email bounces) need to work without a login. Do public webhook bots work on hosted Medplum, on which plan, and with what rate limits? If not, is a small proxy of ours holding narrowly scoped client credentials the recommended pattern?
Bots before Production: can bots run on a non-production project, so we can test reminders and notices before go-live?
AccessPolicy count: we use three policies (staff, supervisor, patient portal), each parameterised per Organization. Does a parameterised policy count once toward the plan limit, however many memberships use it?
AuditEvent: our current project holds no AuditEvent records. Does Production store them, searchable by patient and by organization?
Project email via our SES: can Production send Medplum's own emails (invites, password resets, MFA) through our Amazon SES, from our domain?
Thanks!