FHIR API Engineering Guide
Build, validate, and secure healthcare APIs that follow FHIR R4 conventions.
The material addresses SMART on FHIR, OAuth scopes, OperationOutcome, and ETags, and includes a scope-checking example. However, it does not explain patient-health-data flows, least privilege, user confirmation, secure key storage, auditing, rollback, or production isolation. The scaffold writes multiple files into a chosen directory without overwrite warnings or confirmation, so points are deducted.
The documentation is organized and includes resource examples, error responses, and a basic test script, but static material does not establish that the key paths run. The scaffold implements only Patient CRUD, not the advertised Observation, Bundle, pagination, or SMART authorization paths. Dependencies are unpinned, and abnormal-input, concurrency, persistence, and failure-diagnostic coverage are thin, so the static ceiling requires a conservative score.
The intended audience and scenarios are reasonably clear: FHIR R4 endpoint development, validation, authorization, Bundles, and pagination, with Python/FastAPI and TypeScript/Express snippets. Boundaries, exclusions, compatibility limits, deployment prerequisites, and negative trigger conditions are not clearly specified, and there is no Chinese-language or mainland-China environment evidence, so points are deducted.
The skill provides a quick reference, topic-specific reference files, examples, a checklist, and a scaffold, giving it usable information architecture. It lacks clear skill-level installation guidance, dependency-version policy, changelog, maintenance owner, update path, and complete limitation disclosure. License metadata is unknown; the repository README's terms do not fully substitute for skill-level governance, so points are deducted.
For designing basic FHIR R4 endpoints, resource validation, and error formats, the material offers directly reusable code and JSON. However, the scaffold generates only a limited Patient API, many claimed capabilities remain to be implemented, and no representative outputs are verified or comparative benefit over mature FHIR libraries and servers is shown. The static ceiling therefore supports only a moderate score.
The supplied source includes code, basic tests, and explicit JSON/HTTP structures, providing some auditability. Coverage is limited: tests address only basic Patient operations, there is no CI evidence, third-party standards corroboration, complete key-path coverage, or independent reproduction, and some normative claims cannot be cross-checked from the supplied files alone. Points are therefore deducted.
- Do not use this skill or its generated scaffold directly for a production healthcare-data system; add formal FHIR conformance review, comprehensive tests, least-privilege controls, key management, auditing, concurrency control, persistence, and recovery.
- The scaffold uses write_text in the target directory and may overwrite files with the same names; confirm the directory is empty or backed up first.
- Dependency versions are not pinned, and the SMART examples involve private keys and tokens without secure-storage or rotation guidance.
- The implemented scaffold is substantially narrower than the skill description; pagination, Bundles, SMART authorization, and most resource support still require implementation and verification.
What it does & when to use it
This skill is for software engineers building healthcare endpoints with FHIR R4. It covers resource structures, required fields, value sets, coding systems, REST behavior, and OperationOutcome errors for common resources including Patient, Observation, Encounter, Condition, MedicationRequest, Medication, and Bundle. It also addresses SMART on FHIR authorization, OAuth scopes, transactions, batch operations, search pagination, and conditional requests. It is a useful implementation reference for FastAPI or TypeScript/Express teams, although the source provides no test results or complete runtime specification.
It explains how to create FHIR REST endpoints, validate required fields and enum values, apply common coding-system URLs, and return OperationOutcome responses. It documents HTTP status codes, Content-Type, Location, ETag, If-Match, If-None-Exist, Bundle transactions, batch processing, and search pagination. Examples are provided for Python/FastAPI, Pydantic v2, and TypeScript/Express, along with the scaffold command python scripts/setup_fhir_project.py my_fhir_api.
- A healthcare software engineer implementing Patient, Observation, or Encounter CRUD endpoints needs field and response guidance.
- A FHIR service team handling missing fields, invalid status values, or business-rule violations needs consistent 422 and OperationOutcome behavior.
- A team adding SMART on FHIR support needs a reference for OAuth scopes and authorization patterns.
- A developer implementing hospital FHIR R4 search needs guidance on Bundles, pagination, transactions, or batch operations.
- A FastAPI or TypeScript/Express developer building a prototype needs resource-model and error-handling examples.
Pros & cons
- Covers common FHIR R4 resources, value sets, coding systems, and REST operations.
- Clearly distinguishes 400, 401, 403, 404, 412, and 422 response cases.
- Includes examples for FastAPI, Pydantic v2, and TypeScript/Express.
- Addresses practical topics including SMART on FHIR, Bundles, pagination, and conditional operations.
- The source provides no test suite, compatibility matrix, or evidence of validation against a live server.
- Detailed resource JSON, SMART authorization, pagination, and Bundle guidance depends on referenced files not included here.
- It is an implementation guide and scaffolding reference, not a complete FHIR server.
- The README states that the collection is provided under Anthropic's terms of service but gives no separate license for this skill.
How to install
The skill is included in the anthropics/healthcare collection. The README provides these commands: /plugin marketplace add anthropics/healthcare, followed by /plugin install healthcare@healthcare. The source does not document a standalone installation method for fhir-developer.
How to use
After installing the healthcare collection, give the environment a concrete FHIR development request, such as: “Create a FHIR R4 POST endpoint for Observation, validate status, return OperationOutcome errors with 422, and set application/fhir+json.” The source does not define a separate invocation command or parameter format.