Projects
Medplum Projects are the primary mechanism of access control. Projects are isolated containers of FHIR resources that are administered separately, and which can have different settings.
Medplum Projects enable the following use cases:
-
Development vs. Production: A common requirement for development teams to have a separate
Project, with non-protected data, for testing and debugging, before deploying workflow changes to production. A common Medplum usage pattern is to create a "development", "staging", and "production"Project. -
Multi-tenancy: In B2B2C environments, a service provider may partner with multiple healthcare organizations to deliver care to patients.
Projectscan provide each of these partners their own isolated environments, that have their own patient data, log-in flows, and project administrators. Medplum uses a multi-tenant instance for our hosted offering.
Isolation Model
Medplum Projects create a hard boundary between FHIR resources, and resources within one project cannot reference resources in another.
Additionally, Projects each have their own user administration. A user can be a member of one, or multiple Projects, with different privileges in each. See our User Administration Guide for more information.
Projects can each be configured with own global settings and secrets (see Project Settings below).
For performance and convenience, the Medplum server provides some system level, read-only resources that are shared between projects. Examples include StructureDefinitions and ValueSets.
While they do cross the Project isolation boundary, most application developers will not have to interact these resources.
The SuperAdmin Project
The main exception to this isolation model is the "Super Admin" project. This is a special project that provides a global view over all the resources on the Medplum server. See our SuperAdmin Guide for more information.
The SuperAdmin has the following privileges:
- Access to protected resources.
- Ability to overwrite the
idof a resource, which is normally server generated. - Ability to overwrite fields in the
metaelement of resources such asauthor,lastUpdated, etc.
Logging into the Super Admin project allows for potential dangerous operations and is only intended for server administrators
To switch to the SuperAdmin project or check if you are already in it, you can use the profile selector.
Creating a Project
Medplum App
- Visit the https://app.medplum.com/register or visit https://app.medplum.com/signin and click the "Register" link
- Sign in with an existing user, or enter the details for a new user account
- Enter your project name
Project Settings
You can find the full Project resource schema here
| Setting | Description | Default |
|---|---|---|
superAdmin | Whether this project is the super administrator project (see above). | false |
strictMode | Whether this project uses strict FHIR validation, based on FHIR profiles. Strongly recommend setting this to true. | true |
checkReferencesOnWrite | If true, the the server will reject any create or write operations to a FHIR resource with invalid references. | false |
features | A list of optional features that are enabled for the project. Allowed values are:
| |
defaultPatientAccessPolicy | The default AccessPolicy applied to all Patient Users invited to this Project. This is required to enable open patient registration. |
Project Secrets
Each Project can store a set of key/value pairs to store configuration values, such as API keys, needed by Bots.
See Bot Secrets for more information.
Cloning and Expunging Projects
Self-hosted users have two advanced project administration operations available to them:
$clone- Make a copy of an existingProjectand all its resources.$expunge- Perform a "hard delete" ofProjectand all its resources. This will remove all the related resource rows from the database.
For more information, refer to the Super Admin Project Management guide