Generic FHIR

DenialOS can negotiate read capabilities from a FHIR R4 CapabilityStatement.

The runtime requires:

• advertised CapabilityStatement;
• FHIR version beginning with 4.0;
• server REST resources;
• read or search-type interaction for requested resources;
• HTTPS endpoints without embedded credentials.

Scope model

The SMART backend path accepts explicit read scopes in the form:

system/<Resource>.r

Only resources that are both requested and advertised are treated as supported.

Canonical boundary

Vendor payloads are converted into source envelopes and canonical records before downstream denial workflows consume the data.