HSAAP Special Authority FHIR Implementation Guide
0.1.1 - draft
HSAAP Special Authority FHIR Implementation Guide
0.1.1 - draft
HSAAP Special Authority FHIR Implementation Guide - Local Development build (v0.1.1) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions
| Draft as of 2026-10-15 |
<CapabilityStatement xmlns="http://hl7.org/fhir">
<id value="SpecialAuthorityFHIRAPICapabilityStatement"/>
<meta>
<profile
value="https://fhir-ig.digital.health.nz/hnz-digital-tooling/StructureDefinition/hnz-capability-statement"/>
</meta>
<text>
<status value="extensions"/>
<div xmlns="http://www.w3.org/1999/xhtml"><p class="res-header-id"><b>Generated Narrative: CapabilityStatement SpecialAuthorityFHIRAPICapabilityStatement</b></p><a name="SpecialAuthorityFHIRAPICapabilityStatement"> </a><a name="hcSpecialAuthorityFHIRAPICapabilityStatement"> </a><div style="display: inline-block; background-color: #d9e0e7; padding: 6px; margin: 4px; border: 1px solid #8da1b4; border-radius: 5px; line-height: 60%"><p style="margin-bottom: 0px"/><p style="margin-bottom: 0px">Profile: <a href="file:///home/runner/work/fhir-ig-builder/fhir-ig-builder/hnz-digital-tooling/output/StructureDefinition-hnz-capability-statement.html">Capability Statement profile for use with the Health New Zealand Te Whatu Ora OpenAPI spec converter</a></p></div><h2 id="title">Special Authority FHIR Server Capability Statement</h2><ul><li>Implementation Guide Version: 0.1.1 </li><li>FHIR Version: 4.0.1 </li><li>Supported Formats: <code>application/fhir+json</code></li><li>Published on: 2026-10-15 </li><li>Published by: Health New Zealand | Te Whatu Ora </li></ul><blockquote class="impl-note"><p><strong>Note to Implementers: FHIR Capabilities</strong></p><p>Any FHIR capability may be 'allowed' by the system unless explicitly marked as 'SHALL NOT'. A few items are marked as MAY in the Implementation Guide to highlight their potential relevance to the use case.</p></blockquote><h2 id="rest">FHIR RESTful Capabilities</h2><div class="panel panel-default"><div class="panel-heading"><h3 id="mode1" class="panel-title">Mode: <code>server</code></h3></div><div class="panel-body"><div><p>All token searches on identifiers SHALL be system-qualified (system|value). All requests require a validated access token and a validated signed Request-Context header.</p>
</div><div class="lead"><em>Security</em></div><div class="row"><div class="col-lg-6">Enable CORS: no</div><div class="col-lg-6">Security services supported: <code>SMART-on-FHIR</code></div></div><blockquote><div><p>OAuth 2.0 client credentials flow and signed Request-Context header, per the Health NZ Digital Services Hub onboarding process. The authenticated requester identity is never taken from the FHIR payload.</p>
</div></blockquote></div></div><h3 id="resourcesCap1">Capabilities by Resource/Profile</h3><h4 id="resourcesSummary1">Summary</h4><p>The summary table lists the resources that are part of this configuration, and for each resource it lists:</p><ul><li>The relevant profiles (if any)</li><li>The interactions supported by each resource (<b><span class="bg-info">R</span></b>ead, <b><span class="bg-info">S</span></b>earch, <b><span class="bg-info">U</span></b>pdate, and <b><span class="bg-info">C</span></b>reate, are always shown, while <b><span class="bg-info">VR</span></b>ead, <b><span class="bg-info">P</span></b>atch, <b><span class="bg-info">D</span></b>elete, <b><span class="bg-info">H</span></b>istory on <b><span class="bg-info">I</span></b>nstance, or <b><span class="bg-info">H</span></b>istory on <b><span class="bg-info">T</span></b>ype are only present if at least one of the resources has support for them.</li><li><span>The required, recommended, and some optional search parameters (if any). </span></li><li>The linked resources enabled for <code>_include</code></li><li>The other resources enabled for <code>_revinclude</code></li><li>The operations on the resource (if any)</li></ul><div class="table-responsive"><table class="table table-condensed table-hover"><thead><tr><th><b>Resource Type</b></th><th><b>Profile</b></th><th class="text-center"><b title="GET a resource (read interaction)">R</b></th><th class="text-center"><b title="GET all set of resources of the type (search interaction)">S</b></th><th class="text-center"><b title="PUT a new resource version (update interaction)">U</b></th><th class="text-center"><b title="POST a new resource (create interaction)">C</b></th><th><b title="Required and recommended search parameters">Searches</b></th><th><code><b>_include</b></code></th><th><code><b>_revinclude</b></code></th><th><b>Operations</b></th></tr></thead><tbody><tr><td><a href="#Claim1-1">Claim</a></td><td><a href="StructureDefinition-sa-claim.html">https://fhir-ig.digital.health.nz/special-authority/StructureDefinition/sa-claim</a><br/><em>Additional supported profiles:</em><br/> <a href="StructureDefinition-sa-claim.html">SA Claim</a></td><td class="text-center"/><td class="text-center">y</td><td class="text-center"/><td class="text-center"/><td>identifier, patient, requestor, application-status, created</td><td><code>Claim:patient</code>, <code>Claim:requestor</code>, <code>Claim:supportinginfo</code></td><td/><td><code>$submit</code></td></tr><tr><td><a href="#ClaimResponse1-2">ClaimResponse</a></td><td>Supported Profiles<br/> <a href="StructureDefinition-sa-application-claimresponse.html">SA Application ClaimResponse</a><br/> <a href="StructureDefinition-sa-approval-claimresponse.html">SA Approval ClaimResponse</a></td><td class="text-center"/><td class="text-center">y</td><td class="text-center"/><td class="text-center"/><td>identifier, request, patient, requestor, approval-status, approval-valid-on, approval-expiring, approval-provider-id, approval-version-state, _elements</td><td><code>ClaimResponse:request</code></td><td/><td/></tr></tbody></table></div><hr/><div class="panel panel-default"><div class="panel-heading"><h4 id="Claim1-1" class="panel-title"><span style="float: right;">Resource Conformance: unspecified </span>Claim</h4></div><div class="panel-body"><div class="container"><div class="row"><div class="col-lg-6"><span class="lead">Base System Profile</span><br/><a href="StructureDefinition-sa-claim.html">SA Claim</a></div><div class="col-lg-3"><span class="lead">Profile Conformance</span><br/><b>SHALL</b></div><div class="col-lg-3"><span class="lead">Reference Policy</span><br/></div></div><p/><div class="row"><div class="col-6"><span class="lead">Supported Profiles</span><p><a href="StructureDefinition-sa-claim.html">SA Claim</a></p></div><div class="col-lg-6"><span class="lead">Interaction summary</span><br/><ul><li>Supports <br/><code>search-type</code><div><p>Search Applications, or retrieve a submitted Application by Application Number with _include. Search results are summary representations: referenced resources are only resolved via _include.</p>
</div></li></ul></div></div><p/><div class="row"><div class="col-12"><span class="lead">Documentation</span><blockquote><div><p>Special Authority Applications. Submitted with $submit; enquired with search.</p>
</div></blockquote></div></div><div class="row"><div class="col-lg-7"><span class="lead">Search Parameters</span><table class="table table-condensed table-hover"><thead><tr><th>Conformance</th><th>Parameter</th><th>Type</th><th>Documentation</th></tr></thead><tbody><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claim.html#search">identifier</a></td><td><code>token</code></td><td><div><p>Application Number. SHALL be system-qualified.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claim.html#search">patient</a></td><td><code>reference</code></td><td><div><p>Supports the chained form patient.identifier=nhi-system|NHI only.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-claim-requestor.html">requestor</a></td><td><code>reference</code></td><td><div><p>Supports requestor:Practitioner.identifier with the HPI CPN system or an NZ registration authority system.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-application-status.html">application-status</a></td><td><code>token</code></td><td><div><p>SUBMITTED | PENDING_REVIEW | CANCELLED | DONE</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claim.html#search">created</a></td><td><code>date</code></td><td><div><p>Submission date range: ge and le map to submittedFrom and submittedTo.</p>
</div></td></tr></tbody></table></div><div class="col-lg-5"> </div></div><div class="row"><div class="col-12"><span class="lead">Extended Operations</span><table class="table table-condensed table-hover"><thead><tr><th>Conformance</th><th>Operation</th><th>Documentation</th></tr></thead><tbody><tr><td><b>SHALL</b></td><td><a href="OperationDefinition-sa-claim-submit.html">$submit</a></td><td><div/></td></tr></tbody></table></div></div></div></div></div><div class="panel panel-default"><div class="panel-heading"><h4 id="ClaimResponse1-2" class="panel-title"><span style="float: right;">Resource Conformance: unspecified </span>ClaimResponse</h4></div><div class="panel-body"><div class="container"><div class="row"><div class="col-lg-4"><span class="lead">Core FHIR Resource</span><br/><a href="http://hl7.org/fhir/R4/claimresponse.html">ClaimResponse</a></div><div class="col-lg-4"><span class="lead">Reference Policy</span><br/></div><div class="col-lg-4"><span class="lead">Interaction summary</span><br/><ul><li>Supports <code>search-type</code>.</li></ul></div></div><p/><div class="row"><div class="col-6"><span class="lead">Supported Profiles</span><p><a href="StructureDefinition-sa-application-claimresponse.html">SA Application ClaimResponse</a><br/><a href="StructureDefinition-sa-approval-claimresponse.html">SA Approval ClaimResponse</a></p></div></div><p/><div class="row"><div class="col-12"><span class="lead">Documentation</span><blockquote><div><p>Application outcomes (searched by request.identifier) and Approvals (searched by Approval Number, NHI or practitioner). An Approval search SHALL supply at least one of identifier, patient.identifier or requestor:Practitioner.identifier. approval-valid-on and approval-expiring are mutually exclusive.</p>
</div></blockquote></div></div><div class="row"><div class="col-lg-7"><span class="lead">Search Parameters</span><table class="table table-condensed table-hover"><thead><tr><th>Conformance</th><th>Parameter</th><th>Type</th><th>Documentation</th></tr></thead><tbody><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claimresponse.html#search">identifier</a></td><td><code>token</code></td><td><div><p>Approval Number. SHALL be system-qualified.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claimresponse.html#search">request</a></td><td><code>reference</code></td><td><div><p>Supports the chained form request.identifier=application-number-system|applicationNumber.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claimresponse.html#search">patient</a></td><td><code>reference</code></td><td><div><p>Supports the chained form patient.identifier=nhi-system|NHI only.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="http://hl7.org/fhir/R4/claimresponse.html#search">requestor</a></td><td><code>reference</code></td><td><div><p>Supports requestor:Practitioner.identifier with the HPI CPN system or an NZ registration authority system.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-approval-status.html">approval-status</a></td><td><code>token</code></td><td><div><p>ACTIVE | CANCELLED | REVOKED</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-approval-valid-on.html">approval-valid-on</a></td><td><code>date</code></td><td><div><p>Approvals valid on the supplied date.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-approval-expiring.html">approval-expiring</a></td><td><code>date</code></td><td><div><p>Approvals expiring within a date range.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-approval-provider-id.html">approval-provider-id</a></td><td><code>token</code></td><td><div><p>Provider - pharmacy - on the Approval. SHALL be system-qualified.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td><a href="SearchParameter-approval-version-state.html">approval-version-state</a></td><td><code>token</code></td><td><div><p>LATEST - default - or PREVIOUS or ALL.</p>
</div></td></tr><tr><td><b>SHALL</b></td><td>_elements</td><td><code>special</code></td><td><div><p>Supported for Retrieve Application Outcome: _elements=extension,preAuthRef.</p>
</div></td></tr></tbody></table></div><div class="col-lg-5"> </div></div></div></div></div></div>
</text>
<extension
url="https://fhir-ig.digital.health.nz/hnz-digital-tooling/StructureDefinition/resource-metadata-extension">
<extension url="licenseURL">
<valueUri
value="https://www.tewhatuora.govt.nz/assets/Our-health-system/Digital-health/Digital-Service-Hub/API-Access-and-Use-Agreement.docx"/>
</extension>
<extension url="externalDocs">
<valueUri value="https://fhir-ig.digital.health.nz/special-authority"/>
</extension>
<extension url="licenseName">
<valueString
value="Health New Zealand Digital Services Hub API Access and Use Agreement"/>
</extension>
<extension url="globalHeaders">
<extension
url="https://fhir-ig.digital.health.nz/hnz-digital-tooling/StructureDefinition/custom-headers-extension">
<extension url="key">
<valueString value="Request-Context"/>
</extension>
<extension url="value">
<valueUri
value="https://raw.githubusercontent.com/tewhatuora/schemas/main/openapi-definitions/Request-Context.json"/>
</extension>
<extension url="required">
<valueBoolean value="true"/>
</extension>
<extension url="documentation">
<valueString
value="Signed Request-Context header asserting the authenticated user, organisation and facility. Validated on every request."/>
</extension>
</extension>
<extension
url="https://fhir-ig.digital.health.nz/hnz-digital-tooling/StructureDefinition/custom-headers-extension">
<extension url="key">
<valueString value="X-Correlation-Id"/>
</extension>
<extension url="value">
<valueUri
value="https://raw.githubusercontent.com/tewhatuora/schemas/main/shared-care/Correlation-Id.json"/>
</extension>
<extension url="required">
<valueBoolean value="false"/>
</extension>
<extension url="documentation">
<valueString
value="Optional client-supplied correlation id, returned in the response and recorded in audit events."/>
</extension>
</extension>
</extension>
</extension>
<url
value="https://fhir-ig.digital.health.nz/special-authority/CapabilityStatement/SpecialAuthorityFHIRAPICapabilityStatement"/>
<version value="0.1.1"/>
<name value="SpecialAuthorityFHIRAPICapabilityStatement"/>
<title value="Special Authority FHIR Server Capability Statement"/>
<status value="draft"/>
<experimental value="false"/>
<date value="2026-10-15"/>
<publisher value="Health New Zealand | Te Whatu Ora"/>
<contact>
<name value="Health New Zealand | Te Whatu Ora"/>
<telecom>
<system value="url"/>
<value value="https://www.tewhatuora.govt.nz/"/>
</telecom>
<telecom>
<system value="email"/>
<value value="integration@tewhatuora.govt.nz"/>
</telecom>
</contact>
<contact>
<name value="HNZ Integration Team"/>
<telecom>
<system value="email"/>
<value value="integration@tewhatuora.govt.nz"/>
<use value="work"/>
</telecom>
</contact>
<description value="Health NZ | Te Whatu Ora Special Authority FHIR API"/>
<jurisdiction>
<coding>
<system value="urn:iso:std:iso:3166"/>
<code value="NZ"/>
<display value="New Zealand"/>
</coding>
</jurisdiction>
<kind value="instance"/>
<implementation>
<description value="Production Special Authority FHIR API"/>
<url value="https://api.sa.digital.health.nz/s2s/fhir/R4"/>
</implementation>
<fhirVersion value="4.0.1"/>
<format value="application/fhir+json"/>
<rest>
<mode value="server"/>
<documentation
value="All token searches on identifiers SHALL be system-qualified (system|value). All requests require a validated access token and a validated signed Request-Context header."/>
<security>
<extension
url="http://fhir-registry.smarthealthit.org/StructureDefinition/oauth-uris">
<extension url="token">
<valueUri
value="https://auth.services.health.nz/realms/hnz-integration/protocol/openid-connect/token"/>
</extension>
<extension url="authorize">
<valueUri
value="https://auth.services.health.nz/realms/hnz-integration/protocol/openid-connect/auth"/>
</extension>
</extension>
<extension
url="http://fhir-registry.smarthealthit.org/StructureDefinition/capabilities">
<valueCode value="client-confidential-symmetric"/>
</extension>
<cors value="false"/>
<service>
<coding>
<system
value="http://terminology.hl7.org/CodeSystem/restful-security-service"/>
<code value="SMART-on-FHIR"/>
</coding>
</service>
<description
value="OAuth 2.0 client credentials flow and signed Request-Context header, per the Health NZ Digital Services Hub onboarding process. The authenticated requester identity is never taken from the FHIR payload."/>
</security>
<resource>
<type value="Claim"/>
<profile
value="https://fhir-ig.digital.health.nz/special-authority/StructureDefinition/sa-claim"/>
<supportedProfile
value="https://fhir-ig.digital.health.nz/special-authority/StructureDefinition/sa-claim"/>
<documentation
value="Special Authority Applications. Submitted with $submit; enquired with search."/>
<interaction>
<code value="search-type"/>
<documentation
value="Search Applications, or retrieve a submitted Application by Application Number with _include. Search results are summary representations: referenced resources are only resolved via _include."/>
</interaction>
<searchInclude value="Claim:patient"/>
<searchInclude value="Claim:requestor"/>
<searchInclude value="Claim:supportinginfo"/>
<searchParam>
<name value="identifier"/>
<definition
value="http://hl7.org/fhir/SearchParameter/Claim-identifier"/>
<type value="token"/>
<documentation
value="Application Number. SHALL be system-qualified."/>
</searchParam>
<searchParam>
<name value="patient"/>
<definition
value="http://hl7.org/fhir/SearchParameter/Claim-patient"/>
<type value="reference"/>
<documentation
value="Supports the chained form patient.identifier=nhi-system|NHI only."/>
</searchParam>
<searchParam>
<name value="requestor"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/claim-requestor"/>
<type value="reference"/>
<documentation
value="Supports requestor:Practitioner.identifier with the HPI CPN system or an NZ registration authority system."/>
</searchParam>
<searchParam>
<name value="application-status"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/application-status"/>
<type value="token"/>
<documentation value="SUBMITTED | PENDING_REVIEW | CANCELLED | DONE"/>
</searchParam>
<searchParam>
<name value="created"/>
<definition
value="http://hl7.org/fhir/SearchParameter/Claim-created"/>
<type value="date"/>
<documentation
value="Submission date range: ge and le map to submittedFrom and submittedTo."/>
</searchParam>
<operation>
<name value="submit"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/OperationDefinition/sa-claim-submit"/>
</operation>
</resource>
<resource>
<type value="ClaimResponse"/>
<supportedProfile
value="https://fhir-ig.digital.health.nz/special-authority/StructureDefinition/sa-application-claimresponse"/>
<supportedProfile
value="https://fhir-ig.digital.health.nz/special-authority/StructureDefinition/sa-approval-claimresponse"/>
<documentation
value="Application outcomes (searched by request.identifier) and Approvals (searched by Approval Number, NHI or practitioner). An Approval search SHALL supply at least one of identifier, patient.identifier or requestor:Practitioner.identifier. approval-valid-on and approval-expiring are mutually exclusive."/>
<interaction>
<code value="search-type"/>
</interaction>
<searchInclude value="ClaimResponse:request"/>
<searchParam>
<name value="identifier"/>
<definition
value="http://hl7.org/fhir/SearchParameter/ClaimResponse-identifier"/>
<type value="token"/>
<documentation value="Approval Number. SHALL be system-qualified."/>
</searchParam>
<searchParam>
<name value="request"/>
<definition
value="http://hl7.org/fhir/SearchParameter/ClaimResponse-request"/>
<type value="reference"/>
<documentation
value="Supports the chained form request.identifier=application-number-system|applicationNumber."/>
</searchParam>
<searchParam>
<name value="patient"/>
<definition
value="http://hl7.org/fhir/SearchParameter/ClaimResponse-patient"/>
<type value="reference"/>
<documentation
value="Supports the chained form patient.identifier=nhi-system|NHI only."/>
</searchParam>
<searchParam>
<name value="requestor"/>
<definition
value="http://hl7.org/fhir/SearchParameter/ClaimResponse-requestor"/>
<type value="reference"/>
<documentation
value="Supports requestor:Practitioner.identifier with the HPI CPN system or an NZ registration authority system."/>
</searchParam>
<searchParam>
<name value="approval-status"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/approval-status"/>
<type value="token"/>
<documentation value="ACTIVE | CANCELLED | REVOKED"/>
</searchParam>
<searchParam>
<name value="approval-valid-on"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/approval-valid-on"/>
<type value="date"/>
<documentation value="Approvals valid on the supplied date."/>
</searchParam>
<searchParam>
<name value="approval-expiring"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/approval-expiring"/>
<type value="date"/>
<documentation value="Approvals expiring within a date range."/>
</searchParam>
<searchParam>
<name value="approval-provider-id"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/approval-provider-id"/>
<type value="token"/>
<documentation
value="Provider - pharmacy - on the Approval. SHALL be system-qualified."/>
</searchParam>
<searchParam>
<name value="approval-version-state"/>
<definition
value="https://fhir-ig.digital.health.nz/special-authority/SearchParameter/approval-version-state"/>
<type value="token"/>
<documentation value="LATEST - default - or PREVIOUS or ALL."/>
</searchParam>
<searchParam>
<name value="_elements"/>
<type value="special"/>
<documentation
value="Supported for Retrieve Application Outcome: _elements=extension,preAuthRef."/>
</searchParam>
</resource>
</rest>
</CapabilityStatement>