Getting Started

Passwords must be 12-128 characters. There are no complexity rules (no required uppercase, numbers, or symbols), but common passwords like password123456 are blocked. This follows NIST 800-63B guidelines — length matters more than complexity.

Step 3: Make Authenticated Requests

Use the token from registration or login in the Authorization header:

TOKEN="eyJ..."

# Search patients
curl -H "Authorization: Bearer $TOKEN" \
  http://192.168.1.42:8080/Patient

# Create a resource
curl -X POST http://192.168.1.42:8080/Observation \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/fhir+json" \
  -d '{
    "resourceType": "Observation",
    "status": "final",
    "code": {"text": "Heart rate"},
    "valueQuantity": {"value": 72, "unit": "bpm"}
  }'

Step 4: Register Additional Users

Once the admin account exists, only admins can create new users. Use the admin token and optionally specify a role:

# Create a clinician (default role)
curl -X POST http://192.168.1.42:8080/auth/register \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "drjones", "password": "anothersecurepassword"}'

# Create a read-only user
curl -X POST http://192.168.1.42:8080/auth/register \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "viewer", "password": "viewersecurepassword", "role": "readonly"}'

Available roles and their default SMART scopes:

You can also assign custom SMART scopes per user:

curl -X POST http://192.168.1.42:8080/auth/register \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "labtech",
    "password": "labsecurepassword",
    "role": "clinician",
    "scopes": ["user/Observation.cruds", "user/DiagnosticReport.cruds", "user/Patient.rs"]
  }'

Step 5: Logging In

Other users log in with their credentials:

curl -X POST http://192.168.1.42:8080/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "drjones", "password": "anothersecurepassword"}'

{
  "token": "eyJ...",
  "refresh_token": "eyJ...",
  "token_type": "Bearer",
  "username": "drjones",
  "role": "clinician",
  "scopes": ["user/*.*"]
}

Step 6: Refreshing Tokens

Access tokens expire after 8 hours. Use the refresh token (valid for 7 days) to get a new one:

curl -X POST http://192.168.1.42:8080/auth/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type": "refresh_token", "refresh_token": "eyJ..."}'

Step 7: Logging Out

Revoke your current token:

curl -X POST http://192.168.1.42:8080/auth/logout \
  -H "Authorization: Bearer $TOKEN"

Or revoke a specific token:

curl -X POST http://192.168.1.42:8080/auth/revoke \
  -H "Content-Type: application/json" \
  -d '{"token": "eyJ..."}'

Common Workflows#

Browse Resources in the App

Tap on any resource type in the Resource Counts card to open the resource browser. You can view resources as JSON or YAML, and tap on FHIR references (like Patient/123) to navigate to the referenced resource.

Search with Parameters

FHIR ANT supports the full range of FHIR search parameters:

# Search by name
curl "$BASE/Patient?name=smith"

# Search by date range
curl "$BASE/Observation?date=gt2024-01-01&date=lt2024-12-31"

# Include referenced resources
curl "$BASE/Observation?patient=Patient/123&_include=Observation:patient"

# Chain through references
curl "$BASE/Observation?patient.name=smith"

Backup and Restore

Export all data as a FHIR Bundle:

curl -X POST "$BASE/\$backup" -H "Authorization: Bearer $TOKEN" > backup.json

Restore from a backup:

curl -X POST "$BASE/\$restore" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/fhir+json" \
  -d @backup.json

Connecting from a FHIR Client#

FHIR ANT is a standard FHIR R4 server. Any FHIR client library can connect to it. For example, with the fhir_r4_at_rest Dart package:

final request = FhirSearchRequest(
  base: Uri.parse('http://192.168.1.42:8080'),
  type: R4ResourceType.Patient,
  parameters: FhirSearchParams(params: [
    SearchString(FhirSearchParamDefinition.familyParam, ['Smith']),
  ]),
);
final response = await request.request();

Troubleshooting#

App shows a loading spinner that never finishes Try clearing the app cache in Android Settings > Apps > FHIR ANT > Clear Cache, then relaunch.

Can't connect from another device Make sure both devices are on the same Wi-Fi network. Some networks (especially guest networks) isolate devices from each other.

"Account is locked" error After 5 failed login attempts, the account locks for 15 minutes. Wait for it to expire, or have an admin unlock it:

curl -X POST "$BASE/admin/unlock/2" -H "Authorization: Bearer $ADMIN_TOKEN"

Token expired Access tokens last 8 hours. Use the refresh token endpoint to get a new one (see Step 6 above). Refresh tokens last 7 days.

Next Steps#

• Capabilities — full feature matrix
• API Reference — every endpoint
• Security & Auth — OAuth 2.0, SMART scopes, password policy
• CLI Usage — run the server from the command line