FHIR R4 endpoints (/fhir/r4)

A read-only FHIR R4 view of the same data is served under /fhir/r4, alongside the REST API. The version is part of the path: a future FHIR R6 API will be served under /fhir/r6 next to R4. There is no unversioned /fhir alias; requests to it return 404. This is a minimal first version: it does not claim full compatibility with the NoMA/H-resept FHIR profiles.

MedicinalProductPackaged emits the package identifier, article number (when present), and the actual dose identifiers and LMR numbers of linked active doses. Its packageItem entries contain available package type codings and nested packaging components. Container quantities are emitted only when a container count is available; medicine amounts (for example 30 tablets) are not container counts. Required type/quantity fields that are unavailable carry data-absent-reason: unknown. The API does not invent an outer box or SAFEST identifiers. Resource ids and subject references use the FEST ids, not the unrelated ids assigned by other FHIR servers.

• GET /fhir/r4/{Resource} (search) and GET /fhir/r4/{Resource}/{id} (read). Resource names and the r4 segment are case-sensitive.
• GET /fhir/r4/metadata returns the CapabilityStatement and is anonymous.
• Resource endpoints use the same HelseID DPoP authentication and nhn:legemiddelgrunndata/api scope as the v2 endpoints (see Authentication).
• Responses are application/fhir+json. XML and _format are not supported (_format gives 400; an Accept header that excludes JSON gives 406). An optional fhirVersion parameter on the Accept header (for example application/fhir+json; fhirVersion=4.0) is honored: a version other than R4 (4.0.x) gives 406.
• Errors (400, 401, 403, 404, 405, 406, 429, 500) on /fhir paths are FHIR OperationOutcome resources. Rate limiting is the same as for the other endpoints.

Search

Supported parameters: _id, identifier, _count and _page.

• identifier is an exact match on value or system|value against the identifiers the resource emits. FEST identifier values are uppercase Guids and are matched case-sensitively; _id for FEST resources is case-insensitive.
• _id and identifier combine with AND. Repeated, empty or unsupported parameters give 400. A well-formed search without a match returns an empty searchset.
• _count defaults to 10, maximum 1000. Invalid values give 400. The self and next links include _count only when the request did.
• Paging uses opaque _page cursors. Follow the next link unchanged. Concurrent data publication can change later pages. Bundle.total is not returned.

Example

curl -H "Authorization: DPoP <access-token>" -H "DPoP: <proof-jwt>" \
  "https://api.example.com/fhir/r4/MedicinalProductAuthorization/000879"

{
  "resourceType": "MedicinalProductAuthorization",
  "id": "000879",
  "meta": { "versionId": "1", "lastUpdated": "2026-01-02T03:04:05+00:00" },
  "identifier": [{ "system": "https://pharmasys-api.sykehusinnkjop.no/shiReimbursementId", "value": "000879" }],
  "subject": { "reference": "MedicinalProductPackaged/3f2504e0-4f89-11d3-9a0c-0305e82c3301" },
  "legalBasis": { "coding": [{ "system": "urn:oid:2.16.578.1.12.4.1.1.7427", "code": "950", "display": "H-resept" }] }
}

Limitations

• MedicinalProductAuthorization does not expose the reimbursement diagnoses (R4 has no indication element and the H-resept extension is not yet mapped). subject is set only when the group has exactly one active FEST package, otherwise exactly one active brand; it is omitted when ambiguous or unavailable.
• Unlike the REST endpoints, groups are not filtered on whether their products are in FEST.
• meta.versionId is the group version for treatment and reimbursement based resources. For FEST resources it is a provisional constant "1", and lastUpdated is the time the row was last changed in Legemiddelgrunndata. There are no conditional reads, ETags, _lastUpdated or history.
• Product references are only emitted when the target is an active FEST product. Treatment ids that are URLs do not produce an ActivityDefinition or action reference.
• Many optional elements (for example product type, ingredients, package quantities, marketing and holder information) are omitted; required R4 elements without source data use the data-absent-reason extension with unknown.