Projects

Medplum Projects are the primary mechanism of access control. Projects are isolated containers of FHIR resources that are administered separately, and which can have different settings.

Medplum Projects enable the following use cases:

• Development vs. Production: A common requirement for development teams to have a separate Project , with non-protected data, for testing and debugging, before deploying workflow changes to production. A common Medplum usage pattern is to create a "development", "staging", and "production" Project.

• Multi-tenancy: In B2B2C environments, a service provider may partner with multiple healthcare organizations to deliver care to patients. Projects can provide each of these partners their own isolated environments, that have their own patient data, log-in flows, and project administrators. Medplum uses a multi-tenant instance for our hosted offering.

Isolation Model

Medplum Projects create a hard boundary between FHIR resources, and resources within one project cannot reference resources in another.

Additionally, Projects each have their own user administration. A user can be a member of one, or multiple Projects, with different privileges in each. See our User Administration Guide for more information.

Projects can each be configured with own global settings and secrets (see Project Settings below).

Project Linking

Certain Medplum features, including first-party integrations, require access to shared sets of resources, such as CodeSystem, ValueSet, and Organization.

Medplum super administrators can link shared projects into a target project, providing users with a read-only view of all resources in the linked projects.

A common use case for project linking is the Medplum terminology service. When enabled, Medplum links the shared UMLS Project, which contains CodeSystem resources for major UMLS code systems:

• ICD-10
• RxNORM
• LOINC

You can see linked Projects in the Medplum App by:

• Navigating to app.medplum.com/Project
• Selecting your Project
• Selecting the "Details" tab

The SuperAdmin Project

The main exception to this isolation model is the "Super Admin" project. This is a special project that provides a global view over all the resources on the Medplum server. See our SuperAdmin Guide for more information.

The SuperAdmin has the following privileges:

• Access to protected resources.
• Ability to overwrite the id of a resource, which is normally server generated.
• Ability to overwrite fields in the meta element of resources such as author, lastUpdated, etc.

warning

Logging into the Super Admin project allows for potential dangerous operations and is only intended for server administrators

Checking If You Are In The SuperAdmin Project

To switch to the SuperAdmin project or check if you are already in it, you can use the profile selector.

Creating a Project

Medplum App

• Visit the https://app.medplum.com/register or visit https://app.medplum.com/signin and click the "Register" link
• Sign in with an existing user, or enter the details for a new user account
• Enter your project name

Project Settings

You can find the full Project resource schema here

Setting	Description	Default
superAdmin	Whether this project is the super administrator project (see above).	false
strictMode	Whether this project uses strict FHIR validation, based on FHIR profiles. Strongly recommend setting this to true.	true
checkReferencesOnWrite	If true, the the server will reject any create or write operations to a FHIR resource with invalid references.	false
features	A list of optional features that are enabled for the project. Allowed values are: bots: This Project is allowed to create and run Bots. email: Bots in this project can send emails. cron: This Project can run Bots on CRON timers google-auth-required: Google authentication is the only method allowed for this Project
defaultPatientAccessPolicy	The default AccessPolicy applied to all Patient Users invited to this Project. This is required to enable open patient registration.

Project Secrets

Each Project can store a set of key/value pairs to store configuration values, such as API keys, needed by Bots.

See Bot Secrets for more information.

Cloning and Expunging Projects

Self-hosted users have two advanced project administration operations available to them:

• $clone - Make a copy of an existing Project and all its resources.
• $expunge - Perform a "hard delete" of Project and all its resources. This will remove all the related resource rows from the database.

For more information, refer to the Super Admin Project Management guide

See Also

• User management guide
• Super Admin Guide
• Super Admin CLI
• Project Resource Schema