{
  "resourceType": "Bundle",
  "type": "transaction",
  "entry": [
    {
      "resource": {
        "resourceType": "StructureDefinition",
        "id": "client-created-by",
        "url": "http://aidbox.app/StructureDefinition/Client/created-by",
        "name": "client-created-by",
        "status": "active",
        "kind": "complex-type",
        "abstract": false,
        "type": "Extension",
        "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension",
        "derivation": "constraint",
        "context": [
          {
            "type": "element",
            "expression": "Client"
          }
        ],
        "differential": {
          "element": [
            {
              "id": "Extension",
              "path": "Extension",
              "min": 0,
              "max": "1"
            },
            {
              "id": "Extension.extension",
              "path": "Extension.extension",
              "max": "0"
            },
            {
              "id": "Extension.url",
              "path": "Extension.url",
              "fixedUri": "http://aidbox.app/StructureDefinition/Client/created-by"
            },
            {
              "id": "Extension.value[x]",
              "path": "Extension.value[x]",
              "min": 1,
              "max": "1",
              "type": [
                {
                  "code": "Reference",
                  "targetProfile": [
                    "http://health-samurai.io/fhir/core/StructureDefinition/User"
                  ]
                }
              ]
            }
          ]
        }
      },
      "request": {
        "method": "PUT",
        "url": "StructureDefinition/client-created-by"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Client.created-by",
        "url": "http://aidbox.app/StructureDefinition/Client/created-by",
        "name": "created-by",
        "status": "active",
        "code": "created-by",
        "base": [
          "Client"
        ],
        "type": "token",
        "description": "Client created-by User",
        "expression": "Client.meta.extension.where(url='http://aidbox.app/StructureDefinition/Client/created-by').value.Reference.id"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Client.created-by"
      }
    },
    {
      "resource": {
        "resourceType": "StructureDefinition",
        "id": "client-status",
        "url": "http://aidbox.app/StructureDefinition/Client/status",
        "name": "client-status",
        "status": "active",
        "kind": "complex-type",
        "abstract": false,
        "type": "Extension",
        "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension",
        "derivation": "constraint",
        "context": [
          {
            "type": "element",
            "expression": "Client"
          }
        ],
        "differential": {
          "element": [
            {
              "id": "Extension",
              "path": "Extension",
              "min": 0,
              "max": "1"
            },
            {
              "id": "Extension.extension",
              "path": "Extension.extension",
              "max": "0"
            },
            {
              "id": "Extension.url",
              "path": "Extension.url",
              "fixedUri": "http://aidbox.app/StructureDefinition/Client/status"
            },
            {
              "id": "Extension.value[x]",
              "path": "Extension.value[x]",
              "min": 1,
              "max": "1",
              "type": [
                {
                  "code": "code"
                }
              ],
              "constraint": [
                {
                  "key": "enum-client-status",
                  "severity": "error",
                  "human": "status must be one of draft | review | active | rejected",
                  "expression": "$this.subsetOf('draft' | 'review' | 'active' | 'rejected')"
                }
              ]
            }
          ]
        }
      },
      "request": {
        "method": "PUT",
        "url": "StructureDefinition/client-status"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Client.status",
        "url": "http://aidbox.app/StructureDefinition/Client/status",
        "name": "status",
        "status": "active",
        "code": "status",
        "base": [
          "Client"
        ],
        "type": "token",
        "description": "Client status (draft, review, active, rejected)",
        "expression": "Client.meta.extension.where(url='http://aidbox.app/StructureDefinition/Client/status').value.code"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Client.status"
      }
    },
    {
      "resource": {
        "resourceType": "Client",
        "id": "smartbox-admin-portal",
        "first_party": true,
        "grant_types": [
          "code",
          "password"
        ],
        "scope": [
          "openid",
          "profile",
          "email"
        ],
        "auth": {
          "authorization_code": {
            "redirect_uri": "http://localhost:8095/api/admin/auth/callback",
            "access_token_expiration": 3600,
            "token_format": "jwt",
            "pkce": true,
            "refresh_token": true,
            "refresh_token_expiration": 86400
          },
          "password": {
            "access_token_expiration": 300
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "Client/smartbox-admin-portal"
      }
    },
    {
      "resource": {
        "resourceType": "Client",
        "id": "admin-api",
        "secret": "admin-api-secret-change-in-production",
        "grant_types": [
          "client_credentials"
        ]
      },
      "request": {
        "method": "PUT",
        "url": "Client/admin-api"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-session"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-session",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": {
            "$one-of": [
              "get",
              "post",
              "put",
              "patch",
              "delete"
            ]
          },
          "uri": {
            "$one-of": [
              "#^/fhir/Session.*",
              "#^/Session.*"
            ]
          }
        },
        "description": "Full CRUD access to Session for admin API client"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-identity-provider"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-identity-provider",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": "get",
          "uri": "#^/IdentityProvider.*"
        },
        "description": "Read-only IdentityProvider access for admin API client (backend maps OIDC third-party initiated login iss to an IdP id)"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "allow-license-activation",
        "engine": "matcho",
        "description": "Allow unauthenticated access to license activation endpoints",
        "matcho": {
          "uri": {
            "$one-of": [
              "/api/v1/license/activate",
              "/api/v1/license/status",
              "/"
            ]
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/allow-license-activation"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-grant"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-grant",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": {
            "$one-of": [
              "get",
              "post",
              "put",
              "patch",
              "delete"
            ]
          },
          "uri": {
            "$one-of": [
              "#^/fhir/Grant.*",
              "#^/Grant.*"
            ]
          }
        },
        "description": "Full CRUD access to Grant for admin API client"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-batch"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-batch",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": "post",
          "uri": "#^/fhir$"
        },
        "description": "Allow batch/transaction operations for admin API client"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-organization"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-organization",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/type": "Organization"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead"
              ]
            }
          }
        },
        "description": "Scoped access for admin API client (organizations)"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-client"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-client",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/type": "Client"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "FhirDelete"
              ]
            }
          }
        },
        "description": "Scoped access for admin API client (clients, incl. E2E teardown)"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-user"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-user",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/type": "User"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "FhirCreate",
                "FhirUpdate",
                "FhirPatch",
                "FhirDelete",
                "Search",
                "Read",
                "Create",
                "Update",
                "Patch",
                "Delete"
              ]
            }
          }
        },
        "description": "Full CRUD access to User for admin API client (FHIR and native Aidbox API)"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-document-reference"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-document-reference",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/id": {
              "$one-of": [
                "smartbox-tos",
                "smartbox-privacy",
                "smartbox-theme",
                "smartbox-enrollment-message",
                "smartbox-app-name",
                "smartbox-app-logo",
                "mpf-export-scope"
              ]
            },
            "resource/type": "DocumentReference"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirRead",
                "FhirUpdate",
                "FhirCreate"
              ]
            }
          }
        },
        "description": "Scoped access for admin-api client to DocumentReference resources (tos, privacy, theme, enrollment message)"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-footer-config"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-footer-config",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/id": "#^footer-config-.*",
            "resource/type": "DocumentReference"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirRead",
                "FhirUpdate",
                "FhirCreate"
              ]
            }
          }
        },
        "description": "Allow admin-api client to read/write footer config DocumentReference (id prefix footer-config-*)"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "allow-read-settings",
        "engine": "matcho",
        "description": "Allow admin-api client to read Aidbox settings",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "uri": {
            "$one-of": [
              "/api/v1/settings/introspect",
              "^/api/v1/settings/.*"
            ]
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/allow-read-settings"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-sql",
        "engine": "matcho",
        "description": "Allow admin-api client to execute SQL queries for patient enrollment lookup",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "uri": "/$sql",
          "request-method": "post"
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-sql"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-audit-event",
        "engine": "matcho",
        "description": "Allow admin-api client to create and read AuditEvent resources for enrollment audit logging",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/type": "AuditEvent"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirCreate",
                "FhirSearch",
                "FhirRead"
              ]
            }
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-audit-event"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-notification",
        "engine": "matcho",
        "description": "Allow admin-api client to create, send, and delete Notification resources for email notifications",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": {
            "$one-of": [
              "put",
              "post",
              "delete"
            ]
          },
          "uri": {
            "$one-of": [
              "#^/Notification.*"
            ]
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-notification"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Communication.about",
        "url": "http://smartbox.hs/sp/Communication-about",
        "name": "communication-about",
        "status": "active",
        "code": "about",
        "base": [
          "Communication"
        ],
        "type": "reference",
        "description": "Search Communication by Communication.about (any reference, incl. Aidbox system resources)",
        "expression": "Communication.about"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Communication.about"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Communication.identifier",
        "url": "http://smartbox.hs/sp/Communication-identifier",
        "name": "communication-identifier",
        "status": "active",
        "code": "identifier",
        "base": [
          "Communication"
        ],
        "type": "token",
        "description": "Search Communication by identifier (system|value)",
        "expression": "Communication.identifier"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Communication.identifier"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Session.client",
        "url": "http://smartbox.hs/sp/Session-client",
        "name": "session-client",
        "status": "active",
        "code": "client",
        "base": [
          "Session"
        ],
        "type": "reference",
        "description": "Search Session by client reference",
        "expression": "Session.client",
        "target": [
          "Client"
        ]
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Session.client"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Session.refresh-token-exp",
        "url": "http://smartbox.hs/sp/Session-refresh-token-exp",
        "name": "session-refresh-token-exp",
        "status": "active",
        "code": "refresh_token_exp",
        "base": [
          "Session"
        ],
        "type": "number",
        "description": "Search Session by refresh token expiration time (unix epoch seconds)",
        "expression": "Session.refresh_token_exp"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/Session.refresh-token-exp"
      }
    },
    {
      "resource": {
        "roles": [
          {
            "type": "admin"
          }
        ]
      },
      "request": {
        "method": "PATCH",
        "url": "User/admin"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/patient-can-get-launch-uri"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "patient-can-get-launch-uri",
        "type": "rpc",
        "engine": "matcho-rpc",
        "rpc": {
          "aidbox.smart/get-launch-uri": {
            "user": {
              "fhirUser": {
                "resourceType": "Patient"
              }
            }
          }
        }
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/patient-can-get-smart-apps"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "patient-can-get-smart-apps",
        "engine": "matcho",
        "matcho": {
          "user": {
            "fhirUser": {
              "resourceType": "Patient"
            }
          },
          "params": {
            "status": "active",
            ".type": "smart-app",
            "resource/type": "Client"
          },
          "operation": {
            "id": "FhirSearch"
          }
        }
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/patient-can-create-communication"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "patient-can-create-communication",
        "engine": "matcho",
        "matcho": {
          "user": {
            "fhirUser": {
              "resourceType": "Patient"
            }
          },
          "params": {
            "resource/type": "Communication"
          },
          "operation": {
            "id": "FhirCreate"
          }
        }
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/smart-app-can-read-patient-api"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "smart-app-can-read-patient-api",
        "engine": "matcho",
        "matcho": {
          "jwt": {
            "atv": 2,
            "scope": "present?",
            "context": {
              "patient": "present?"
            }
          },
          "client": {
            "type": "smart-app",
            "active": true
          }
        }
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "DocumentReference/smartbox-tos"
      },
      "resource": {
        "resourceType": "DocumentReference",
        "id": "smartbox-tos",
        "status": "current",
        "type": {
          "text": "Terms of Service"
        },
        "category": [
          {
            "text": "legal"
          }
        ],
        "content": [
          {
            "attachment": {
              "url": "http://localhost:8095/change-me-smartbox-tos.pdf",
              "contentType": "application/pdf"
            }
          }
        ]
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "DocumentReference/smartbox-privacy"
      },
      "resource": {
        "resourceType": "DocumentReference",
        "id": "smartbox-privacy",
        "status": "current",
        "type": {
          "text": "Privacy Policy"
        },
        "category": [
          {
            "text": "legal"
          }
        ],
        "content": [
          {
            "attachment": {
              "contentType": "text/html"
            }
          }
        ]
      }
    },
    {
      "resource": {
        "resourceType": "AuthConfig",
        "id": "smartbox",
        "theme": {
          "styleUrl": "http://localhost:8095/auth.css"
        }
      },
      "request": {
        "method": "PUT",
        "url": "AuthConfig/smartbox"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin access to Client resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Client"
          }
        },
        "id": "admin-role-client",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-client"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin search and read Session resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Session"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead"
              ]
            }
          }
        },
        "id": "admin-role-session",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-session"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin access to Organization resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Organization"
          }
        },
        "id": "admin-role-organization",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-organization"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin read Patient with ORGBAC",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Patient"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "orgbac-fhir-search",
                "orgbac-fhir-read"
              ]
            }
          }
        },
        "id": "admin-role-patient",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-patient"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin read User with ORGBAC",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "User"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "orgbac-fhir-search",
                "orgbac-fhir-read"
              ]
            }
          }
        },
        "id": "admin-role-user",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-user"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin read Group with ORGBAC",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Group"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "orgbac-fhir-search",
                "orgbac-fhir-read"
              ]
            }
          }
        },
        "id": "admin-role-group",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-group"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin manage DocumentReference",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "DocumentReference"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "FhirUpdate"
              ]
            }
          }
        },
        "id": "admin-role-document-reference",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-document-reference"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin access to settings endpoints",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "request": {
            "uri": {
              "$one-of": [
                "/api/v1/settings/introspect",
                "^/api/v1/settings/.*"
              ]
            }
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead",
                "FhirUpdate"
              ]
            }
          }
        },
        "id": "admin-role-settings-introspect",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-settings-introspect"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin access to AwsAccount resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "AwsAccount"
          }
        },
        "id": "admin-role-aws-account",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-aws-account"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin access to GcpServiceAccount resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "GcpServiceAccount"
          }
        },
        "id": "admin-role-gcp-service-account",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-gcp-service-account"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin search and read AuditEvent resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "AuditEvent"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead"
              ]
            }
          }
        },
        "id": "admin-role-audit-event",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-audit-event"
      }
    },
    {
      "resource": {
        "engine": "matcho",
        "description": "Admin search and read Communication resources",
        "matcho": {
          "user": {
            "roles": [
              {
                "type": "admin"
              }
            ]
          },
          "params": {
            "resource/type": "Communication"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirSearch",
                "FhirRead"
              ]
            }
          }
        },
        "id": "admin-role-communication",
        "resourceType": "AccessPolicy"
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-role-communication"
      }
    },
    {
      "resource": {
        "url": "http://aidbox.app/StructureDefinition/AuditEvent/client",
        "id": "AuditEvent.client",
        "base": [
          "AuditEvent"
        ],
        "expression": "AuditEvent.agent.who.identifier.value",
        "name": "client",
        "status": "active",
        "type": "token",
        "resourceType": "SearchParameter",
        "code": "client",
        "description": "Filter AuditEvent by client identifier (agent.who.identifier.value)"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/AuditEvent.client"
      }
    },
    {
      "resource": {
        "resourceType": "StructureDefinition",
        "id": "FaqPage",
        "url": "http://aidbox.app/StructureDefinition/FaqPage",
        "name": "FaqPage",
        "status": "active",
        "kind": "resource",
        "abstract": false,
        "type": "FaqPage",
        "baseDefinition": "http://hl7.org/fhir/StructureDefinition/DomainResource",
        "derivation": "specialization",
        "differential": {
          "element": [
            {
              "id": "FaqPage",
              "path": "FaqPage",
              "min": 0,
              "max": "*"
            },
            {
              "id": "FaqPage.items",
              "path": "FaqPage.items",
              "min": 0,
              "max": "*",
              "type": [
                {
                  "code": "BackboneElement"
                }
              ]
            },
            {
              "id": "FaqPage.items.id",
              "path": "FaqPage.items.id",
              "min": 0,
              "max": "1",
              "type": [
                {
                  "code": "string"
                }
              ]
            },
            {
              "id": "FaqPage.items.question",
              "path": "FaqPage.items.question",
              "min": 0,
              "max": "1",
              "type": [
                {
                  "code": "string"
                }
              ]
            },
            {
              "id": "FaqPage.items.answer",
              "path": "FaqPage.items.answer",
              "min": 0,
              "max": "1",
              "type": [
                {
                  "code": "markdown"
                }
              ]
            }
          ]
        }
      },
      "request": {
        "method": "PUT",
        "url": "StructureDefinition/FaqPage"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-faqpage"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-faqpage",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "params": {
            "resource/type": "FaqPage"
          },
          "operation": {
            "id": "Read"
          }
        },
        "description": "Scoped access for admin API client (FAQ pages - read only)"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "NotificationTemplate/auth-signup-email"
      },
      "resource": {
        "resourceType": "NotificationTemplate",
        "subject": "Confirm your Member Account",
        "template": "\n<h3>Confirm your email address </h3>\n<p>Hello {{params.data.name}}{{params.email}}{{params.username}}!</p>\n<p>We just need to verify that {{params.email}} {{params.username}} is your email address.</p>\n<p><a target=\"_blank\" href=\"{{params.base-url}}/auth/signup/confirm/{{id}}?redirect_to=aHR0cDovL2xvY2FsaG9zdDo4MDk1L2FkbWluL2F1dGgvc2lnbnVwP2NvbmZpcm1QYXNzd29yZD10cnVl\">Confirm Email Address</a></p> \n<b>Didn't request this email?</b>\n<p>No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.</p>\n<p>If you're having problems, please feel free to write to us at FHIRsupport@villagecare.org. We'll be glad to help.</p> "
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/box-ui-faqpage"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "box-ui-faqpage",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "box-ui"
          },
          "params": {
            "resource/type": "FaqPage"
          },
          "operation": {
            "id": {
              "$one-of": [
                "FhirRead",
                "FhirSearch"
              ]
            }
          }
        },
        "description": "Allow Aidbox UI to read FAQ pages"
      }
    },
    {
      "resource": {
        "resourceType": "Patient",
        "id": "test-e2e-patient",
        "name": [
          {
            "given": [
              "E2E"
            ],
            "family": "TestPatient"
          }
        ],
        "birthDate": "1990-01-01",
        "gender": "unknown"
      },
      "request": {
        "method": "PUT",
        "url": "Patient/test-e2e-patient"
      }
    },
    {
      "resource": {
        "resourceType": "User",
        "id": "test-e2e-smartbox-patient",
        "email": "test-e2e-patient@smartbox.dev",
        "password": "Test123!@#",
        "fhirUser": {
          "id": "test-e2e-patient",
          "resourceType": "Patient"
        },
        "data": {
          "firstName": "E2E",
          "lastName": "TestPatient"
        },
        "roles": [
          {
            "type": "patient"
          }
        ]
      },
      "request": {
        "method": "PUT",
        "url": "User/test-e2e-smartbox-patient"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "provider-directory-public-read",
        "engine": "matcho",
        "description": "Allow admin-api client to read provider directory resources",
        "matcho": {
          "uri": {
            "$one-of": [
              "#^/fhir/PractitionerRole($|/|\\?)",
              "#^/fhir/Practitioner($|/|\\?)",
              "#^/fhir/Location($|/|\\?)",
              "#^/fhir/Organization($|/|\\?)",
              "#^/fhir/HealthcareService($|/|\\?)"
            ]
          },
          "request-method": "get",
          "client": {
            "id": "admin-api"
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/provider-directory-public-read"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-patient-write",
        "engine": "matcho",
        "description": "Allow admin-api client to write Patient resources for enrollment telecom updates",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": {
            "$one-of": [
              "patch",
              "put"
            ]
          },
          "uri": "#^/fhir/Patient($|/|\\?)"
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-patient-write"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-registration-read",
        "engine": "matcho",
        "description": "Allow admin-api client to read Registration resources for enrollment status lookup",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": "get",
          "uri": "#^/fhir/Registration($|/|\\?)"
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-registration-read"
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-access-policy",
        "engine": "matcho",
        "description": "Allow admin-api client to manage per-backend-service AccessPolicies (bs-policy-*) created/removed on app approval/deactivation (#478) and per-admin AccessPolicies (admin-*) created with each portal admin (#580)",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": {
            "$one-of": [
              "get",
              "put",
              "post",
              "delete"
            ]
          },
          "uri": {
            "$one-of": [
              "#^/AccessPolicy/bs-policy-.*",
              "#^/fhir/AccessPolicy/bs-policy-.*",
              "#^/AccessPolicy/admin-[a-zA-Z0-9._-]+$",
              "#^/fhir/AccessPolicy/admin-[a-zA-Z0-9._-]+$"
            ]
          }
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-access-policy"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-force-reset-password"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-force-reset-password",
        "engine": "matcho",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": "post",
          "uri": "#^/auth/force-reset-password.*"
        },
        "description": "Allow admin API client to issue password reset links via /auth/force-reset-password"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "User.role",
        "url": "http://smartbox.hs/sp/User-role",
        "name": "user-role",
        "status": "active",
        "code": "role",
        "base": [
          "User"
        ],
        "type": "token",
        "description": "Search User by role type (User.roles[].type), e.g. /User?role=admin. FHIRPath traverses the roles array, so a role at any index matches.",
        "expression": "User.roles.type"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/User.role"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "User.patient",
        "url": "http://smartbox.hs/sp/User-patient",
        "name": "user-patient",
        "status": "active",
        "code": "patient",
        "base": [
          "User"
        ],
        "type": "reference",
        "target": [
          "Patient"
        ],
        "description": "Linked Patient for an enrolled member. Covers both link shapes: the enrollment flow writes User.fhirUser ({id,resourceType}) and legacy/imported members link via User.data.patient. Powers the enrolled-members list, which pages enrolled Users with /fhir/User?patient:missing=false (matches both shapes) and then fetches that page's Patients. NOTE: avoid reverse chaining (Patient?_has:User:patient:...) — it is too slow on large datasets; and Aidbox value-matches only Aidbox-format references, so :missing is the reliable modifier here. Index for scale: GIN on the User resource (see aidbox.index/suggest-index).",
        "expression": "User.fhirUser | User.data.patient"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/User.patient"
      }
    },
    {
      "resource": {
        "resourceType": "SearchParameter",
        "id": "plannet-practitionerrole-network",
        "url": "http://hl7.org/fhir/us/davinci-pdex-plan-net/SearchParameter/practitionerrole-network",
        "version": "1.2.0-aidbox-fixed",
        "name": "Plannet_sp_practitionerrole_network",
        "status": "active",
        "description": "Select roles where the practitioner is a member of the specified health insurance provider network. NOTE: the IG 1.2.0 expression is missing the trailing .value (selects the Extension, not the Reference) and Aidbox cannot compile it - fixed here.",
        "code": "network",
        "base": [
          "PractitionerRole"
        ],
        "type": "reference",
        "expression": "PractitionerRole.extension.where(url='http://hl7.org/fhir/us/davinci-pdex-plan-net/StructureDefinition/network-reference').value"
      },
      "request": {
        "method": "PUT",
        "url": "SearchParameter/plannet-practitionerrole-network"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "AidboxConfig/smartbox"
      },
      "resource": {
        "id": "smartbox",
        "resourceType": "AidboxConfig",
        "smartbox": {
          "logoUrl": "https://storage.googleapis.com/payerbox-public/health-system-logo.png"
        }
      }
    },
    {
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "admin-api-client-patch",
        "engine": "matcho",
        "description": "Allow the admin-api client to PATCH a single Client resource by id in the admin (PHI) box. The backend uses this to propagate developer-portal changes to approved clients into the production box. Single-resource PATCH only; collection/conditional PATCH, full-resource replace, and other write methods are denied.",
        "matcho": {
          "client": {
            "id": "admin-api"
          },
          "request-method": "patch",
          "uri": "#^/fhir/Client/[^/?]+$"
        }
      },
      "request": {
        "method": "PUT",
        "url": "AccessPolicy/admin-api-client-patch"
      }
    },
    {
      "resource": {
        "roles": [
          {
            "type": "admin"
          }
        ],
        "password": "$s0$f0801$B3jOpXU2PUyd3iHLOi1qnw==$AJkfwK1Xu+dYkXWS5dRtrJK2CR3ztWos7NuNDIdtVAU=",
        "id": "portal-admin",
        "resourceType": "User"
      },
      "request": {
        "method": "PUT",
        "url": "User/portal-admin"
      }
    },
    {
      "resource": {
        "resourceType": "AwsAccount",
        "id": "minio",
        "region": "us-east-1",
        "access-key-id": "minioadmin",
        "secret-access-key": "minioadmin",
        "host": "minio:9000",
        "path-style": true,
        "use-ssl": false
      },
      "request": {
        "method": "PUT",
        "url": "AwsAccount/minio"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/Client/prior-auth-app"
      },
      "resource": {
        "resourceType": "Client",
        "id": "prior-auth-app",
        "secret": "secret",
        "grant_types": [
          "basic"
        ]
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/AccessPolicy/allow-prior-auth-app"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "allow-prior-auth-app",
        "engine": "allow",
        "link": [
          {
            "reference": "Client/prior-auth-app"
          }
        ]
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/SearchParameter/Group-active"
      },
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Group-active",
        "url": "http://hl7.org/fhir/SearchParameter/Group-active",
        "name": "active",
        "status": "active",
        "description": "Whether the group is active",
        "code": "active",
        "base": [
          "Group"
        ],
        "type": "token",
        "expression": "Group.active"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/SearchParameter/Coverage-subscriber-id"
      },
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Coverage-subscriber-id",
        "url": "http://hl7.org/fhir/SearchParameter/Coverage-subscriber-id",
        "name": "subscriber-id",
        "status": "active",
        "description": "Subscriber ID on the coverage",
        "code": "subscriber-id",
        "base": [
          "Coverage"
        ],
        "type": "token",
        "expression": "Coverage.subscriberId"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/SearchParameter/Consent-provision-type"
      },
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Consent-provision-type",
        "url": "http://hl7.org/fhir/SearchParameter/Consent-provision-type",
        "name": "provision-type",
        "status": "active",
        "description": "Type of consent provision (deny or permit)",
        "code": "provision-type",
        "base": [
          "Consent"
        ],
        "type": "token",
        "expression": "Consent.provision.type"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/SearchParameter/Group-period-end"
      },
      "resource": {
        "resourceType": "SearchParameter",
        "id": "Group-period-end",
        "url": "http://hl7.org/fhir/SearchParameter/Group-period-end",
        "name": "period-end",
        "status": "active",
        "description": "End of a Group characteristic's period; used for expiration-based cleanup",
        "code": "period-end",
        "base": [
          "Group"
        ],
        "type": "date",
        "expression": "Group.characteristic.period.end"
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/Client/interop-app"
      },
      "resource": {
        "resourceType": "Client",
        "id": "interop-app",
        "secret": "secret",
        "grant_types": [
          "basic"
        ]
      }
    },
    {
      "request": {
        "method": "PUT",
        "url": "/AccessPolicy/allow-interop-app"
      },
      "resource": {
        "resourceType": "AccessPolicy",
        "id": "allow-interop-app",
        "engine": "allow",
        "link": [
          {
            "reference": "Client/interop-app"
          }
        ]
      }
    }
  ]
}
