aehrc/fhir-api
.claude/skills/fhir-api/SKILL.md
Expert guidance for implementing FHIR RESTful API servers and clients following the HL7 FHIR specification. Use this skill when implementing a FHIR server with REST endpoints, building a FHIR client, designing FHIR API routes and handlers, implementing FHIR operations (read, create, update, delete, search, history), working with FHIR bundles, batch requests, or transactions, handling FHIR content negotiation, headers, and versioning, or implementing conditional operations. Trigger keywords include "FHIR REST", "FHIR API", "FHIR server", "FHIR client", "FHIR endpoint", "FHIR operations", "RESTful FHIR", "implement FHIR".
$ install --global
skillsauthnpx skillsauth add aehrc/pathling fhir-apiInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 28, 2026, 10:14 AM35.8s4 files scanned
SKILL.md
- name:
- fhir-api
- description:
- Expert guidance for implementing FHIR RESTful API servers and clients following the HL7 FHIR specification. Use this skill when implementing a FHIR server with REST endpoints, building a FHIR client, designing FHIR API routes and handlers, implementing FHIR operations (read, create, update, delete, search, history), working with FHIR bundles, batch requests, or transactions, handling FHIR content negotiation, headers, and versioning, or implementing conditional operations. Trigger keywords include "FHIR REST", "FHIR API", "FHIR server", "FHIR client", "FHIR endpoint", "FHIR operations", "RESTful FHIR", "implement FHIR".
FHIR REST API implementation
This skill provides guidance for implementing FHIR RESTful APIs according to the HL7 FHIR specification (R4/R5).
URL structure
All FHIR REST URLs follow the pattern:
[base]/[type]/[id]
[base]: Service base URL (e.g.,https://fhir.example.org/r4)[type]: Resource type (e.g.,Patient,Observation)[id]: Logical resource ID
URLs are case-sensitive and use UTF-8 encoding.
Core operations
| Operation | HTTP | URL Pattern | Success |
| ----------------- | -------- | ----------------------------------- | ------- |
| Read | GET | [base]/[type]/[id] | 200 |
| VRead | GET | [base]/[type]/[id]/_history/[vid] | 200 |
| Create | POST | [base]/[type] | 201 |
| Update | PUT | [base]/[type]/[id] | 200/201 |
| Patch | PATCH | [base]/[type]/[id] | 200 |
| Delete | DELETE | [base]/[type]/[id] | 200/204 |
| Search | GET/POST | [base]/[type]?params | 200 |
| History | GET | [base]/[type]/[id]/_history | 200 |
| Capabilities | GET | [base]/metadata | 200 |
| Batch/Transaction | POST | [base] | 200 |
For detailed specifications of each operation, see references/operations.md.
Content negotiation
MIME types
| Format | MIME Type |
| ------ | ------------------------- |
| JSON | application/fhir+json |
| XML | application/fhir+xml |
| RDF | application/fhir+turtle |
Use the Accept header for response format and Content-Type for request body format.
The _format query parameter overrides Accept when clients cannot set headers.
FHIR version
Specify version via MIME type parameter:
Accept: application/fhir+json; fhirVersion=4.0
Version mappings: 1.0 (R2), 3.0 (R3), 4.0 (R4), 4.3 (R4B), 5.0 (R5).
Required headers
Request headers
| Header | Purpose | Example |
| ------------- | ------------------- | ----------------------- |
| Accept | Response format | application/fhir+json |
| Content-Type | Request body format | application/fhir+json |
| If-Match | Optimistic locking | W/"123" |
| If-None-Exist | Conditional create | identifier=123 |
| Prefer | Return preference | return=representation |
Response headers
| Header | Purpose | Example |
| ------------- | ------------------ | ------------------------------- |
| ETag | Version identifier | W/"123" |
| Location | New resource URL | [base]/Patient/123/_history/1 |
| Last-Modified | Modification time | RFC 7231 date |
Versioning and optimistic locking
FHIR uses weak ETags for version tracking:
- Server returns
ETag: W/"[versionId]"with responses - Client sends
If-Match: W/"[versionId]"with updates - Server returns
412 Precondition Failedif version mismatch
Implement version-aware updates when CapabilityStatement.rest.resource.versioning is versioned-update.
Error handling
Return OperationOutcome resources for all errors:
{
"resourceType": "OperationOutcome",
"issue": [
{
"severity": "error",
"code": "invalid",
"diagnostics": "Patient.birthDate: Invalid date format"
}
]
}
Status codes
| Code | Meaning | | ---- | -------------------------------------- | | 400 | Invalid syntax or validation failure | | 404 | Resource not found | | 409 | Version conflict | | 410 | Resource deleted | | 412 | Precondition failed (version mismatch) | | 422 | Business rule violation |
Prefer header
Control response content with Prefer:
| Value | Response body |
| ------------------------- | -------------------- |
| return=minimal | Empty (headers only) |
| return=representation | Full resource |
| return=OperationOutcome | Validation outcome |
For async operations, use Prefer: respond-async to get 202 Accepted with status polling URL.
Implementation checklist
Server implementations should:
- Implement CapabilityStatement at
/metadata - Support content negotiation (JSON at minimum)
- Return proper ETags for versioned resources
- Include
Locationheader on create/update - Return
OperationOutcomefor all errors - Support
_formatparameter fallback - Honour
Preferheader for response content
References
- operations.md: Detailed operation specifications
- search.md: Search parameter and result handling
- batch-transaction.md: Batch and transaction processing
Related Skills
aehrc/wiremock
tools
VerifiedTrustedCommunity
Expert guidance for using WireMock in Java applications for HTTP API mocking and testing. Use this skill when the user asks to mock HTTP APIs, create API stubs, test REST clients, simulate network faults, verify HTTP requests, or integrate WireMock with Spring Boot. Trigger keywords include "wiremock", "mock http", "stub api", "http mock", "api testing", "rest mock", "simulate fault", "verify request", "spring boot wiremock".
125SKILL.mdUpdated Mar 27, 2026
aehrc/sql-on-fhir
documentation
VerifiedTrustedCommunity
Expert guidance for implementing SQL on FHIR v2 ViewDefinitions and operations to create portable, tabular projections of FHIR data. Use this skill when the user asks to create ViewDefinitions, flatten FHIR resources into tables, write FHIRPath expressions for data extraction, implement forEach/forEachOrNull/repeat patterns for unnesting, create where clauses for filtering, use constants in view definitions, combine data with unionAll, execute ViewDefinitions with $run or $export operations, or implement SQL on FHIR server capabilities. Trigger keywords include "ViewDefinition", "SQL on FHIR", "flatten FHIR", "tabular FHIR", "FHIR to SQL", "FHIR analytics", "FHIRPath columns", "unnest FHIR", "$viewdefinition-run", "$export", "view runner", "repeat", "recursive", "QuestionnaireResponse".
125SKILL.mdUpdated Mar 27, 2026
aehrc/Apache Spark Catalyst API
development
VerifiedTrustedCommunity
Expert guidance for working with the Apache Spark Catalyst query optimisation framework. Use this skill when working with Spark SQL internals, creating custom expressions, implementing query optimisations, working with logical/physical plans, or extending Catalyst. Trigger keywords include "catalyst", "spark sql", "expression", "logical plan", "physical plan", "tree node", "query optimisation", "rule executor", "analyzer", "optimizer", "code generation".
125SKILL.mdUpdated Mar 27, 2026
aehrc/sonarcloud-api
development
VerifiedTrustedCommunity
Expert guidance for using the SonarCloud API to interact with code quality analysis, projects, issues, quality gates, and metrics. Use this skill when making API calls to SonarCloud, automating code quality workflows, retrieving analysis results, managing projects programmatically, or integrating SonarCloud with CI/CD pipelines. Trigger keywords include "SonarCloud", "SonarCloud API", "code quality API", "SonarQube Cloud", "quality gate", "code analysis API", "SonarCloud measures", "SonarCloud issues".
125SKILL.mdUpdated Mar 27, 2026