webhooks

The patient's decision, sent to the record holder

The same decision sent to the system that holds the records, with all care context references.

POST/api/v3/consent/request/hip/notify

status only ever carries GRANTED, REVOKED or EXPIRED on this callback.

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Body

statusstringRequired

The values actually sent to a HIP on this callback.

One of GRANTEDREVOKEDEXPIRED

consentIdstringRequired

consentDetailobjectRequired

consentDetail.schemaVersionstringRequired

consentDetail.consentIdstringRequired

consentDetail.createdAtstringRequired

consentDetail.patientobjectRequired

consentDetail.patient.idstringRequired

consentDetail.careContextsobject[]Required

consentDetail.careContexts.patientReferencestringRequired

consentDetail.careContexts.careContextReferencestringRequired

consentDetail.purposeobjectRequired

consentDetail.purpose.textstringRequired

consentDetail.purpose.codestringRequired

consentDetail.purpose.refUristringRequired

consentDetail.hipobjectRequired

consentDetail.hip.idstringRequired

consentDetail.hip.namestringRequired

consentDetail.hip.typestring

consentDetail.hiuobjectRequired

consentDetail.hiu.idstringRequired

consentDetail.hiu.namestringRequired

consentDetail.hiu.typestring

consentDetail.consentManagerobjectRequired

consentDetail.consentManager.idstringRequired

consentDetail.requesterobjectRequired

consentDetail.requester.namestringRequired

consentDetail.requester.identifierobjectRequired

consentDetail.requester.identifier.valuestringRequired

consentDetail.requester.identifier.typestringRequired

consentDetail.requester.identifier.systemstringRequired

consentDetail.hiTypesobject[]Required

consentDetail.permissionobjectRequired

consentDetail.permission.accessModestringRequired

One of VIEWSTOREQUERYSTREAM

consentDetail.permission.dateRangeobjectRequired

consentDetail.permission.dateRange.fromstring

Start of the data access window

consentDetail.permission.dateRange.tostring

End of the data access window

consentDetail.permission.dataEraseAtstringRequired

Consent expiry, after this the HIU must delete the data

consentDetail.permission.frequencyobjectRequired

consentDetail.permission.frequency.unitstring

One of HOURDAYWEEKMONTHYEAR

consentDetail.permission.frequency.valueinteger

Frequency value

consentDetail.permission.frequency.repeatsinteger

Number of repeats (0 = unlimited during consent period)

signaturestringRequired

Base64-encoded digital signature of the consent artefact.

grantAcknowledgementbooleanRequired

Required; no further semantics are documented for this field beyond the boolean value.

Responses

200

Your bridge acknowledged the callback with 200 OK. The gateway validates the body you send back, so a 200 carrying the wrong body is still a failure.

The patient's decision, sent to the record holder

curl --request POST \
  --url https://dev.abdm.gov.in/api/api/v3/consent/request/hip/notify \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'Content-Type: application/json' \
  --data '{
  "status": "GRANTED",
  "consentId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "consentDetail": {
    "schemaVersion": "v3",
    "consentId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "createdAt": "2024-05-01T05:10:20.123Z",
    "patient": {
      "id": "abdulkalam@abdm"
    },
    "careContexts": [
      {
        "patientReference": "batman@tmh",
        "careContextReference": "Episode1"
      }
    ],
    "purpose": {
      "text": "Care Management",
      "code": "CAREMGT",
      "refUri": "www.abc.com"
    },
    "hip": {
      "id": "cowin_hip_01",
      "name": "Cowin",
      "type": "HIP"
    },
    "hiu": {
      "id": "cowin_hiu_01",
      "name": "Cowin",
      "type": "HIU"
    },
    "consentManager": {
      "id": "abdm"
    },
    "requester": {
      "name": "abdulkalam@abdm",
      "identifier": {
        "value": "REG1",
        "type": "MH1001",
        "system": "https://www.sample.com"
      }
    },
    "hiTypes": [
      "Prescription"
    ],
    "permission": {
      "accessMode": "VIEW",
      "dateRange": {
        "from": "2021-09-28T12:30:08.573Z",
        "to": "2021-09-28T12:30:08.573Z"
      },
      "dataEraseAt": "2021-09-28T12:30:08.573Z",
      "frequency": {
        "unit": "HOUR",
        "value": 1,
        "repeats": 0
      }
    }
  },
  "signature": "scrubbed-base64-signature",
  "grantAcknowledgement": false
}'

Your bridge acknowledged the callback with 200 OK. The gateway validates the body you send back, so a 200 carrying the wrong body is still a failure.

Where this fits

hiecm-m3.yaml declares this callback at module level and names no call against it. Which call produces it is not documented, so this page does not say.

The patient's decision, sent to the record holder

Authorizations

Body

Responses

Where this fits​

Where this fits