{
  "info": {
    "_postman_id": "2f5fb064-3929-4da7-a26a-e528e0ea285b",
    "name": "UnifyEMPI — API demo",
    "description": "An importable tour of UnifyEMPI discovery, canonical Patient search, FHIR R4 Patient $match, source-system writes and read-only reviewer operations. Non-mutating requests target the shared demo API by default; writes and operational requests remain local.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "bearer",
    "bearer": [
      {
        "key": "token",
        "value": "{{accessToken}}",
        "type": "string"
      }
    ]
  },
  "item": [
    {
      "name": "1 — Discovery and health",
      "description": "Unauthenticated service discovery and readiness requests. These target the public demo by default.",
      "item": [
        {
          "name": "Readiness",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "text/plain",
                "type": "text"
              }
            ],
            "url": "{{baseUrl}}/health/ready",
            "description": "Checks whether the API and selected registry provider are ready to serve traffic. The response contains no patient information."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "pm.test(\"Reports healthy\", function () {",
                  "    pm.expect(pm.response.text().toLowerCase()).to.include(\"healthy\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "FHIR CapabilityStatement",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "url": "{{baseUrl}}/fhir/R4/metadata",
            "description": "Returns the FHIR R4 capability statement, supported formats, Patient and Person interactions and the Patient $match operation."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const capability = pm.response.json();",
                  "",
                  "pm.test(\"Describes a FHIR R4 server\", function () {",
                  "    pm.expect(capability.resourceType).to.eql(\"CapabilityStatement\");",
                  "    pm.expect(capability.fhirVersion).to.eql(\"4.0.1\");",
                  "    pm.expect(capability.format).to.include(\"application/fhir+json\");",
                  "    pm.expect(capability.format).to.include(\"application/fhir+xml\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "SMART configuration",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json",
                "type": "text"
              }
            ],
            "url": "{{baseUrl}}/.well-known/smart-configuration",
            "description": "Discovers the configured token endpoint, client-credentials support and UnifyEMPI scopes."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const smart = pm.response.json();",
                  "",
                  "pm.test(\"Advertises system and MPI scopes\", function () {",
                  "    pm.expect(smart.token_endpoint).to.be.a(\"string\").and.not.empty;",
                  "    pm.expect(smart.grant_types_supported).to.include(\"client_credentials\");",
                  "    pm.expect(smart.scopes_supported).to.include(\"system/Patient.read\");",
                  "    pm.expect(smart.scopes_supported).to.include(\"mpi.match\");",
                  "});"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "2 — Canonical Patient and matching",
      "description": "Read-only requests against synthetic canonical Patients. Run the search before the read request so the collection can capture canonicalPatientId.",
      "item": [
        {
          "name": "Search canonical Patients",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "url": "{{baseUrl}}/fhir/R4/Patient?family=Khan&birthdate=1991-07-28&_count=10",
            "description": "Searches canonical Patients by family name and birth date. Source Patient snapshots are not returned to a consumer search."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const bundle = pm.response.json();",
                  "const entries = bundle.entry || [];",
                  "",
                  "pm.test(\"Returns a non-empty FHIR searchset\", function () {",
                  "    pm.expect(bundle.resourceType).to.eql(\"Bundle\");",
                  "    pm.expect(bundle.type).to.eql(\"searchset\");",
                  "    pm.expect(entries).to.be.an(\"array\").that.is.not.empty;",
                  "});",
                  "",
                  "if (entries.length > 0) {",
                  "    pm.collectionVariables.set(\"canonicalPatientId\", entries[0].resource.id);",
                  "}"
                ]
              }
            }
          ]
        },
        {
          "name": "Read the selected canonical Patient",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "url": "{{baseUrl}}/fhir/R4/Patient/{{canonicalPatientId}}",
            "description": "Reads the first enterprise identity captured by the preceding search and verifies the canonical resource ID."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const patient = pm.response.json();",
                  "",
                  "pm.test(\"Returns the selected canonical Patient\", function () {",
                  "    pm.expect(patient.resourceType).to.eql(\"Patient\");",
                  "    pm.expect(patient.id).to.eql(pm.collectionVariables.get(\"canonicalPatientId\"));",
                  "    pm.expect(patient.active).to.eql(true);",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Match a synthetic Patient — JSON",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Parameters\",\n  \"parameter\": [\n    {\n      \"name\": \"resource\",\n      \"resource\": {\n        \"resourceType\": \"Patient\",\n        \"name\": [\n          {\n            \"use\": \"official\",\n            \"family\": \"Khan\",\n            \"given\": [\"Sameera\"]\n          }\n        ],\n        \"birthDate\": \"1991-07-28\",\n        \"gender\": \"female\",\n        \"address\": [\n          {\n            \"use\": \"home\",\n            \"line\": [\"22 Orchard Close\"],\n            \"city\": \"Swansea\",\n            \"postalCode\": \"SA1 1AA\"\n          }\n        ],\n        \"telecom\": [\n          {\n            \"system\": \"phone\",\n            \"value\": \"07700 900347\",\n            \"use\": \"mobile\"\n          }\n        ]\n      }\n    },\n    {\n      \"name\": \"onlyCertainMatches\",\n      \"valueBoolean\": false\n    },\n    {\n      \"name\": \"count\",\n      \"valueInteger\": 10\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{baseUrl}}/fhir/R4/Patient/$match",
            "description": "Submits a partial synthetic Patient in the standard FHIR R4 Parameters wrapper. The operation is read-only and returns score plus match-grade on every result."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const bundle = pm.response.json();",
                  "const entries = bundle.entry || [];",
                  "",
                  "pm.test(\"Returns a non-empty FHIR searchset\", function () {",
                  "    pm.expect(bundle.resourceType).to.eql(\"Bundle\");",
                  "    pm.expect(bundle.type).to.eql(\"searchset\");",
                  "    pm.expect(entries).to.be.an(\"array\").that.is.not.empty;",
                  "});",
                  "",
                  "pm.test(\"Every result has a score and match grade\", function () {",
                  "    entries.forEach(function (entry) {",
                  "        pm.expect(entry.search.score).to.be.a(\"number\");",
                  "        const extensions = entry.resource.extension || [];",
                  "        const grade = extensions.find(function (extension) {",
                  "            return extension.url === \"http://hl7.org/fhir/StructureDefinition/match-grade\";",
                  "        });",
                  "        pm.expect(grade, \"match-grade extension\").to.exist;",
                  "        pm.expect(grade.valueCode).to.be.oneOf([\"certain\", \"probable\", \"possible\"]);",
                  "    });",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Match with onlyCertainMatches",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Parameters\",\n  \"parameter\": [\n    {\n      \"name\": \"resource\",\n      \"resource\": {\n        \"resourceType\": \"Patient\",\n        \"name\": [{\n          \"family\": \"Khan\",\n          \"given\": [\"Sameera\"]\n        }],\n        \"birthDate\": \"1991-07-28\",\n        \"gender\": \"female\"\n      }\n    },\n    {\n      \"name\": \"onlyCertainMatches\",\n      \"valueBoolean\": true\n    },\n    {\n      \"name\": \"count\",\n      \"valueInteger\": 10\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{baseUrl}}/fhir/R4/Patient/$match",
            "description": "Demonstrates strict certainty filtering. Demographic similarity alone cannot establish certain, so an empty searchset is a valid result."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const bundle = pm.response.json();",
                  "",
                  "pm.test(\"Returns only certain matches\", function () {",
                  "    pm.expect(bundle.resourceType).to.eql(\"Bundle\");",
                  "    pm.expect(bundle.type).to.eql(\"searchset\");",
                  "    (bundle.entry || []).forEach(function (entry) {",
                  "        const grade = (entry.resource.extension || []).find(function (extension) {",
                  "            return extension.url === \"http://hl7.org/fhir/StructureDefinition/match-grade\";",
                  "        });",
                  "        pm.expect(grade, \"match-grade extension\").to.exist;",
                  "        pm.expect(grade.valueCode).to.eql(\"certain\");",
                  "    });",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "No match returns an empty searchset",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Parameters\",\n  \"parameter\": [\n    {\n      \"name\": \"resource\",\n      \"resource\": {\n        \"resourceType\": \"Patient\",\n        \"name\": [{\n          \"family\": \"NoMatchExample\",\n          \"given\": [\"Synthetic\"]\n        }],\n        \"birthDate\": \"1900-01-01\"\n      }\n    },\n    {\n      \"name\": \"count\",\n      \"valueInteger\": 10\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{baseUrl}}/fhir/R4/Patient/$match",
            "description": "Shows the standards-shaped no-match outcome: HTTP 200 with an empty FHIR searchset Bundle rather than a 404."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const bundle = pm.response.json();",
                  "",
                  "pm.test(\"Returns an empty FHIR searchset\", function () {",
                  "    pm.expect(bundle.resourceType).to.eql(\"Bundle\");",
                  "    pm.expect(bundle.type).to.eql(\"searchset\");",
                  "    pm.expect(bundle.entry || []).to.be.an(\"array\").that.is.empty;",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Match a synthetic Patient — XML",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+xml",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+xml",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "<Parameters xmlns=\"http://hl7.org/fhir\">\n  <parameter>\n    <name value=\"resource\" />\n    <resource>\n      <Patient>\n        <name>\n          <family value=\"Khan\" />\n          <given value=\"Sameera\" />\n        </name>\n        <gender value=\"female\" />\n        <birthDate value=\"1991-07-28\" />\n        <address>\n          <postalCode value=\"BD1 2RD\" />\n        </address>\n      </Patient>\n    </resource>\n  </parameter>\n  <parameter>\n    <name value=\"onlyCertainMatches\" />\n    <valueBoolean value=\"false\" />\n  </parameter>\n  <parameter>\n    <name value=\"count\" />\n    <valueInteger value=\"10\" />\n  </parameter>\n</Parameters>",
              "options": {
                "raw": {
                  "language": "xml"
                }
              }
            },
            "url": "{{baseUrl}}/fhir/R4/Patient/$match",
            "description": "Exercises the same FHIR R4 operation using XML request and response payloads."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "pm.test(\"Returns a FHIR XML Bundle\", function () {",
                  "    pm.expect(pm.response.headers.get(\"Content-Type\")).to.include(\"application/fhir+xml\");",
                  "    pm.expect(pm.response.text()).to.include(\"<Bundle\");",
                  "    pm.expect(pm.response.text()).to.include(\"match-grade\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Malformed match returns OperationOutcome",
          "request": {
            "auth": {
              "type": "noauth"
            },
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Parameters\",\n  \"parameter\": [\n    {\n      \"name\": \"count\",\n      \"valueInteger\": 10\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{baseUrl}}/fhir/R4/Patient/$match",
            "description": "Intentionally omits the resource parameter to demonstrate a standards-shaped client error."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 400\", function () {",
                  "    pm.response.to.have.status(400);",
                  "});",
                  "",
                  "const outcome = pm.response.json();",
                  "",
                  "pm.test(\"Returns a FHIR OperationOutcome\", function () {",
                  "    pm.expect(outcome.resourceType).to.eql(\"OperationOutcome\");",
                  "    pm.expect(outcome.issue).to.be.an(\"array\").that.is.not.empty;",
                  "});"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "3 — Source-system writes",
      "description": "Create, update and read a synthetic source Patient. These requests use sourceBaseUrl, which is localhost by default. In an authenticated deployment, set accessToken to a JWT containing trusted tenant_id, source_system and system/Patient.write claims.",
      "item": [
        {
          "name": "Create a source Patient",
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.collectionVariables.set(\"demoSourceLocalId\", \"postman-\" + pm.variables.replaceIn(\"{{$guid}}\"));",
                  "pm.collectionVariables.set(\"createIdempotencyKey\", \"postman-create-\" + pm.variables.replaceIn(\"{{$guid}}\"));",
                  "pm.collectionVariables.unset(\"sourcePatientResourceId\");",
                  "pm.collectionVariables.unset(\"sourcePatientEtag\");"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 201\", function () {",
                  "    pm.response.to.have.status(201);",
                  "});",
                  "",
                  "if (pm.response.code === 201) {",
                  "    const patient = pm.response.json();",
                  "    pm.collectionVariables.set(\"sourcePatientResourceId\", patient.id);",
                  "    pm.collectionVariables.set(\"sourcePatientEtag\", pm.response.headers.get(\"ETag\"));",
                  "}",
                  "",
                  "pm.test(\"Returns a source Patient ID and ETag\", function () {",
                  "    pm.expect(pm.collectionVariables.get(\"sourcePatientResourceId\")).to.be.a(\"string\").and.not.empty;",
                  "    pm.expect(pm.collectionVariables.get(\"sourcePatientEtag\")).to.match(/^W\\/\\\"[0-9]+\\\"$/);",
                  "});"
                ]
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{createIdempotencyKey}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Patient\",\n  \"id\": \"{{demoSourceLocalId}}\",\n  \"active\": true,\n  \"identifier\": [\n    {\n      \"system\": \"https://fhir.nhs.uk/Id/nhs-number\",\n      \"value\": \"9434765919\"\n    }\n  ],\n  \"name\": [\n    {\n      \"use\": \"official\",\n      \"family\": \"Morgan\",\n      \"given\": [\"Carys\", \"Postman\"]\n    }\n  ],\n  \"gender\": \"female\",\n  \"birthDate\": \"1982-04-17\",\n  \"address\": [\n    {\n      \"use\": \"home\",\n      \"line\": [\"10 Demonstration Road\"],\n      \"city\": \"Cardiff\",\n      \"postalCode\": \"CF10 1AA\"\n    }\n  ],\n  \"telecom\": [\n    {\n      \"system\": \"email\",\n      \"value\": \"carys.morgan@example.invalid\",\n      \"use\": \"home\"\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{sourceBaseUrl}}/fhir/R4/Patient",
            "description": "Creates a synthetic source-system Patient, then captures the server resource ID and weak ETag for the following requests."
          },
          "response": []
        },
        {
          "name": "Update the source Patient with If-Match",
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.collectionVariables.set(\"updateIdempotencyKey\", \"postman-update-\" + pm.variables.replaceIn(\"{{$guid}}\"));"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "if (pm.response.code === 200) {",
                  "    pm.collectionVariables.set(\"sourcePatientEtag\", pm.response.headers.get(\"ETag\"));",
                  "}",
                  "",
                  "pm.test(\"Advances the source Patient ETag\", function () {",
                  "    pm.expect(pm.collectionVariables.get(\"sourcePatientEtag\")).to.match(/^W\\/\\\"[0-9]+\\\"$/);",
                  "});"
                ]
              }
            }
          ],
          "request": {
            "method": "PUT",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              },
              {
                "key": "If-Match",
                "value": "{{sourcePatientEtag}}",
                "type": "text"
              },
              {
                "key": "Idempotency-Key",
                "value": "{{updateIdempotencyKey}}",
                "type": "text"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"resourceType\": \"Patient\",\n  \"id\": \"{{sourcePatientResourceId}}\",\n  \"active\": true,\n  \"identifier\": [\n    {\n      \"system\": \"https://fhir.nhs.uk/Id/nhs-number\",\n      \"value\": \"9434765919\"\n    }\n  ],\n  \"name\": [\n    {\n      \"use\": \"official\",\n      \"family\": \"Morgan\",\n      \"given\": [\"Carys\", \"Postman\"]\n    }\n  ],\n  \"gender\": \"female\",\n  \"birthDate\": \"1982-04-17\",\n  \"address\": [\n    {\n      \"use\": \"home\",\n      \"line\": [\"12 Demonstration Road\"],\n      \"city\": \"Cardiff\",\n      \"postalCode\": \"CF10 1AA\"\n    }\n  ],\n  \"telecom\": [\n    {\n      \"system\": \"email\",\n      \"value\": \"carys.morgan@example.invalid\",\n      \"use\": \"home\"\n    },\n    {\n      \"system\": \"phone\",\n      \"value\": \"07700900123\",\n      \"use\": \"mobile\"\n    }\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "url": "{{sourceBaseUrl}}/fhir/R4/Patient/{{sourcePatientResourceId}}",
            "description": "Updates the created source Patient using the captured ETag. UnifyEMPI rejects missing or stale If-Match values."
          },
          "response": []
        },
        {
          "name": "Read the source Patient",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/fhir+json",
                "type": "text"
              }
            ],
            "url": "{{sourceBaseUrl}}/fhir/R4/Patient/{{sourcePatientResourceId}}",
            "description": "Reads the created source Patient using source-system credentials and verifies the latest ETag."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const patient = pm.response.json();",
                  "",
                  "pm.test(\"Returns the created source Patient\", function () {",
                  "    pm.expect(patient.resourceType).to.eql(\"Patient\");",
                  "    pm.expect(patient.id).to.eql(pm.collectionVariables.get(\"sourcePatientResourceId\"));",
                  "    pm.expect(pm.response.headers.get(\"ETag\")).to.eql(pm.collectionVariables.get(\"sourcePatientEtag\"));",
                  "});"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "4 — Reviewer read-only operations",
      "description": "Safe operational reads for a local or protected deployment. These use operationsBaseUrl, which is localhost by default, and inherit the collection bearer token. Required scopes are documented on each request.",
      "item": [
        {
          "name": "Operational summary",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json",
                "type": "text"
              }
            ],
            "url": "{{operationsBaseUrl}}/api/v1/operations/summary",
            "description": "Returns tenant-bound operational counts. Requires mpi.operations or mpi.admin."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "pm.test(\"Returns JSON\", function () {",
                  "    pm.expect(pm.response.headers.get(\"Content-Type\")).to.include(\"application/json\");",
                  "    pm.expect(pm.response.json()).to.be.an(\"object\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Review queue",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json",
                "type": "text"
              }
            ],
            "url": "{{operationsBaseUrl}}/api/v1/review-cases",
            "description": "Returns the tenant-bound review queue without making a decision. Requires mpi.review or mpi.admin."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "pm.test(\"Returns JSON\", function () {",
                  "    pm.expect(pm.response.headers.get(\"Content-Type\")).to.include(\"application/json\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Audit events",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json",
                "type": "text"
              }
            ],
            "url": "{{operationsBaseUrl}}/api/v1/audit-events",
            "description": "Searches immutable tenant audit evidence. Requires mpi.audit or mpi.admin."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "pm.test(\"Returns JSON\", function () {",
                  "    pm.expect(pm.response.headers.get(\"Content-Type\")).to.include(\"application/json\");",
                  "});"
                ]
              }
            }
          ]
        },
        {
          "name": "Tenant matching settings",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json",
                "type": "text"
              }
            ],
            "url": "{{operationsBaseUrl}}/api/v1/tenant/settings",
            "description": "Reads non-secret source trust, thresholds and approval settings. HMAC material is never returned. Requires mpi.config.read or mpi.admin."
          },
          "response": [],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"Returns HTTP 200\", function () {",
                  "    pm.response.to.have.status(200);",
                  "});",
                  "",
                  "const settings = pm.response.json();",
                  "",
                  "pm.test(\"Does not expose HMAC secrets\", function () {",
                  "    pm.expect(settings).to.be.an(\"object\");",
                  "    pm.expect(JSON.stringify(settings).toLowerCase()).not.to.include(\"secretbase64\");",
                  "});"
                ]
              }
            }
          ]
        }
      ]
    }
  ],
  "variable": [
    {
      "key": "baseUrl",
      "value": "https://unifyempi-demo-api-mjpwolhr6q-nw.a.run.app",
      "type": "string",
      "description": "Shared demo API for non-mutating discovery, search and matching. It may be changed to a local or approved protected UnifyEMPI API."
    },
    {
      "key": "sourceBaseUrl",
      "value": "http://localhost:8080",
      "type": "string",
      "description": "Target for mutating source-system requests. Use only an isolated local or approved protected deployment."
    },
    {
      "key": "operationsBaseUrl",
      "value": "http://localhost:8080",
      "type": "string",
      "description": "Target for reviewer and operational reads."
    },
    {
      "key": "accessToken",
      "value": "",
      "type": "string",
      "description": "Bearer token for protected source-system or reviewer requests. Local development has authentication disabled."
    },
    {
      "key": "canonicalPatientId",
      "value": "",
      "type": "string",
      "description": "Set automatically by the canonical Patient search."
    },
    {
      "key": "demoSourceLocalId",
      "value": "",
      "type": "string",
      "description": "Generated automatically before a source Patient create."
    },
    {
      "key": "sourcePatientResourceId",
      "value": "",
      "type": "string",
      "description": "Captured automatically from a successful source Patient create."
    },
    {
      "key": "sourcePatientEtag",
      "value": "",
      "type": "string",
      "description": "Captured and advanced automatically by source Patient create and update."
    },
    {
      "key": "createIdempotencyKey",
      "value": "",
      "type": "string",
      "description": "Generated automatically for a source Patient create."
    },
    {
      "key": "updateIdempotencyKey",
      "value": "",
      "type": "string",
      "description": "Generated automatically for a source Patient update."
    }
  ]
}
