Endpoint — Service technical address

The ID card of a FHIR service: URL, protocol, accepted payloads, environment. The technical directory of interoperable platforms.

Purpose

Endpoint describes a technical address to communicate with: FHIR REST server, HL7 v2 MLLP, Direct Project email, IHE XDS, SMTP, DICOM, WebSocket. An Organization, Location or PractitionerRole can reference one or more Endpoint via endpoint[] — client-side discovery.

Key fields

JSON example

Hospital FHIR R5 production endpoint:

{
  "resourceType": "Endpoint",
  "id": "ep-hospital-1-fhir",
  "status": "active",
  "connectionType": [{
    "system": "http://terminology.hl7.org/CodeSystem/endpoint-connection-type",
    "code": "hl7-fhir-rest"
  }],
  "name": "FHIR R5 — Hospital 1",
  "description": "Hospital 1 main FHIR R5 endpoint, production base",
  "environmentType": [{
    "coding": [{
      "system": "http://terminology.hl7.org/CodeSystem/endpoint-environment",
      "code": "prod",
      "display": "Production"
    }]
  }],
  "managingOrganization": { "reference": "Organization/hospital-1" },
  "contact": [{
    "system": "email",
    "value": "interop@hospital-1.example.org"
  }],
  "period": {
    "start": "2024-01-01"
  },
  "payloadType": [{
    "coding": [{
      "system": "http://terminology.hl7.org/CodeSystem/endpoint-payload-type",
      "code": "any"
    }]
  }],
  "payloadMimeType": ["application/fhir+json", "application/fhir+xml"],
  "address": "https://fhir.hospital-1.example.org/r5"
}

Common pitfalls

• Endpoint without environmentType — confusing prod and test is a classic cause of PHI leaks to insecure environments.
• HTTP not HTTPS — a FHIR Endpoint must always be HTTPS; spec recommends TLS 1.2+.
• No contact — when the endpoint goes down, who do you call? Required.
• payloadMimeType inconsistent with connectionType — an hl7-fhir-rest endpoint announcing plain application/json (instead of application/fhir+json) creates Content-Negotiation bugs.
• Confusing with CapabilityStatement — Endpoint = just the URL and type, CapabilityStatement = what the server can do at that URL.

Related resources

• Organization — references exposed endpoints.
• Location — local endpoint (a department's PACS).
• CapabilityStatement — capabilities at that URL.
• Practitioner / PractitionerRole — personal endpoint.