FHIR (fast healthcare interoperability standards)

APIs MUST conform to the FHIR R4 specification when a relevant FHIR profile exists. Where no suitable profile is available, you may need to model custom resources following FHIR principles.

FHIR R4 already addresses many fundamental aspects of RESTful API design. If your API implementation is based on FHIR, you can jump directly to the Security section.