Manifest request (POST)

When a decoded SMART Health Link payload does not contain the U flag, the receiving system retrieves a SMART Health Link manifest instead of a direct encrypted file. The receiving application performs an HTTP POST request to the SHLink url with a JSON request body containing a required recipient field and, when applicable, a passcode. This follows the SMART Health Links specification.

Endpoint

POST {SHLink URL}

The SHLink URL is obtained from the url field inside the decoded SMART Health Link payload.

Request headers

string

required

Set to application/json to indicate the request body is a JSON object.

Request body

string

required

A string describing the recipient, such as the name of an organization or person, suitable for display to the receiving user.

string

User-supplied passcode when the decoded SHLink payload includes the P flag.

integer

Upper bound on the length of embedded payloads returned in files.embedded.

Example request body

{
  "recipient": "Verona Health System",
  "passcode": "1234",
  "embeddedLengthMax": 200000
}

cURL example

curl \
  --request POST \
  --url "https://haau3.com/api/shl/manifests/abc123/manifest.json" \
  --header "Content-Type: application/json" \
  --data '{
    "recipient": "Verona Health System",
    "passcode": "1234",
    "embeddedLengthMax": 200000
  }'

Manifest response structure

If the request is valid, the resource server returns a SMART Health Link manifest with Content-Type: application/json.

object

required

SMART Health Link manifest object.

string

Indicates whether files may change in the future.

FHIR List

List resource with metadata related to the contained files.

array

One or more file descriptors.

string

required

Nature of the file content.

url

URL to externally retrievable content.

JWE string

Embedded encrypted file contents.

timestamp

Last time the content was modified.

Example manifest response

{
  "manifest": {
    "status": "complete"
  },
  "files": [
    {
      "contentType": "application/fhir+json",
      "embedded": "<encrypted JWE compact serialization>",
      "lastUpdated": "2026-03-10T12:00:00Z"
    }
  ]
}

Responses

HTTP/1.1 200 OK
Content-Type: application/json

{
  "manifest": { "status": "complete" },
  "files": [
    {
      "contentType": "application/fhir+json",
      "embedded": "<encrypted JWE compact serialization>",
      "lastUpdated": "2026-03-10T12:00:00Z"
    }
  ]
}

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{ "remainingAttempts": 2 }

HTTP/1.1 404 Not Found

Each encrypted file (files[].embedded, or fetched from files[].location) is a JWE. Decrypt it with the key from the SHLink payload to obtain the FHIR bundle. See Bundle & artifact reference.

Get started

Kill the Clipboard

Provider & EHR integration

Conversational AI (Cora)

Manifest request (POST)

Endpoint

Request headers

Request body

Example request body

cURL example

Manifest response structure

Example manifest response

Responses

​Endpoint

​Request headers

​Request body

​Example request body

​cURL example

​Manifest response structure

​Example manifest response

​Responses

Endpoint

Request headers

Request body

Example request body

cURL example

Manifest response structure

Example manifest response

Responses