Skip to main content

webhooks

The encrypted health data itself, pushed to the URL you supplied

The actual encrypted FHIR bundle. The HIP Data Bridge posts this directly to the dataPushUrl you supplied in the health information request; it is not routed through the Gateway, and this literal path is illustrative rather than fixed, because dataPushUrl is a URL you host and register yourself.

POST/health-information/transfer

Decrypt entries[].content with the ECDH shared secret derived from your private key and keyMaterial. entries[].checksum is the MD5 of the content before encryption, so verify it after decrypting. Large payloads arrive across several calls, paginated by pageNumber and pageCount.

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Body

pageNumberintegerRequired

Current page number, for a multi-page transfer.

pageCountintegerRequired

Total number of pages in this transfer.

transactionIdstringRequired

The transaction id issued when the health information was requested.

entriesobject[]Required
entries.contentstringRequired

Encrypted FHIR bundle content.

entries.mediastringRequired

One of application/fhir+json

entries.checksumstringRequired

MD5 checksum of the content, taken before encryption.

entries.careContextReferencestringRequired

The care context this entry's data belongs to.

keyMaterialobjectRequired

ECDH key material for end-to-end encryption of health data

keyMaterial.cryptoAlgstringRequired

One of ECDH

keyMaterial.curvestringRequired

One of Curve25519

keyMaterial.dhPublicKeyobjectRequired
keyMaterial.dhPublicKey.expirystringRequired

Key expiry time

keyMaterial.dhPublicKey.parametersstringRequired
keyMaterial.dhPublicKey.keyValuestringRequired

Base64-encoded ECDH public key (32 bytes for Curve25519)

keyMaterial.noncestringRequired

Base64-encoded random nonce (32 bytes), unique per request

Responses

202

Accepted. Verify the checksum after decrypting before treating the transfer as complete.

The callback never arrives

Where this fits​

hiecm-m3.yaml declares this callback at module level and names no call against it. Which call produces it is not documented, so this page does not say.