medplum #support

Join Discord

Channels

faq

announcements

Bots on free tier for evaluation? Or rest-hook Subscriptions?

nsykumoh

08/02/2026, 2:21 PM

Hi — I'm a physician (non-developer) building a monitoring platform on Medplum's hosted free tier, using AI-assisted development. I'm in the prototype phase with fictional test data only.

My Phase 0 spike needs a Bot (Subscription-triggered on QuestionnaireResponse, computes a triage tier, writes a Task), but Bots appear to require the Production tier. Two questions:

Is there any way to enable Bot invocations on a free/dev project for evaluation purposes? Happy to describe the project — this is a real product build heading toward a paid Production project once we reach live patients.

If not — do free-tier projects support rest-hook Subscriptions to an external URL, so I can run the same logic in a serverless function during development?

ClientApplication OAuth2 Client Credentials JWT always returns 401 Unauthorized (Medplum 5.1.21)

Xelem

07/28/2026, 6:38 PM

Hi! I'm trying to authenticate a backend using OAuth2 Client Credentials on Medplum 5.1.21 (official Docker Compose setup), but every request authenticated with the ClientApplication token returns 401 Unauthorized.

Steps:

1. Fresh Medplum install. 2. Logged in as super admin. 3. Created a new Project. 4. Created an AccessPolicy in that project. 5. Created a ClientApplication via:

POST /admin/projects/{projectId}/client

6. Requested a token via:

POST /oauth2/token

grant_type=client_credentials

7. Received a valid JWT.

The decoded JWT contains

client_id

profile

login_id

, correct `iss`/`aud`, etc.

However, every request returns 401, including:

GET /auth/me

GET /fhir/R4/Patient

POST /fhir/R4/Organization

The response is always:

Copy code

json
{
  "resourceType": "OperationOutcome",
  "issue": [\
    {\
      "code": "login",\
      "details": {\
        "text": "Unauthorized"\
      }\
    }\
  ]
}

Things I've verified:

\* Official Docker Compose deployment (

medplum/medplum-server:5.1.21

) \* Authorization header is

Bearer <token>

\* Token is issued successfully by the same server (

http://localhost:8103

) \* Same behavior whether using the bootstrap project or a newly created project \* Super admin JWT works for FHIR requests

Is a

ClientApplication

obtained via the client_credentials flow supposed to authenticate directly against the FHIR API? Is there an additional bootstrap/configuration step I'm missing, or could this be a known issue in 5.1.21? Any guidance would be appreciated.

Performance implications of relying on Access Policy instead of search parameters

rabbit_rabbit

07/20/2026, 5:13 PM

Our application is patient/family focused: a single user may have access to 1-10 patients each of which may have 1-3 care plans.

I'm wondering if there are potential performance implications to relying on access policies to search for all resources that patient has access to instead of narrowing the search via parameters.

As an example, I could do this in two passes, searching for a patient's care teams like so

Copy code

const records = new Map<string, PatientRecord>();
  const patients = await client.searchResources('Patient', '_count=1000');
  await Promise.all(
    patients.map(async (patient) => {
      const pid = patient.id;
      const careTeams = await client.searchResources(
        'CareTeam',
        `subject=Patient/${pid}`,
      );
      records.set(pid, { patient, careTeam: careTeams[0] });
    }),
  );
  return { records };

or I could do this as 2 parallel requests

Copy code

const records = new Map<string, PatientRecord>();
  const [patients, careTeams] = await Promise.all([\
    client.searchResources('Patient', '_count=1000'),\
    client.searchResources('CareTeam', '_count=1000'),\
  ])

patients.map((patient) => {
    const pid = patient.id
    const careTeam = careTeams.find(careTeam =>
      careTeams.reference === `Patient/${patient.id}`
    )
    records.set(pid, { patient, careTeam });
  });

return { records };

I'm wondering though is on the backend access policies are applied after resources are found. That is, whether all matching records are found and then the filter is applied in such a way that we end up essentially scanning all records and having bad performance.

I imagine this isn't the case, but wanting to check before banking on this. Thank you!

Proposed improvements for AWS self-hosting

Vishal

07/19/2026, 2:39 PM

1. External DNS support is unclear

The CDK supports

skipDns

, but

medplum aws init

still says Route 53 is required. The documentation also implies that using another DNS provider means managing SSL certificates manually.

AWS ACM can still provision and renew certificates when DNS is hosted elsewhere. Users only need to add ACM’s validation CNAME records to their DNS provider.

Suggested improvements:

- Ask whether Route 53 manages the domain. - Automatically set

skipDns

when it does not. - Output the API load balancer and CloudFront target hostnames. - Document ACM validation with external DNS providers such as Cloudflare.

2. Failed deployments can leave CloudFormation stuck

Our deployment initially failed because

@medplum/cdk

used the unsupported

cache.t2.medium

Redis type. This specific problem has been fixed in [PR #9810]( https://github.com/medplum/medplum/pull/9810).

However, rollback also failed because retained RDS/Redis resources remained connected to the VPC, preventing CloudFormation from deleting it.

Consider using CDK’s

RETAIN_ON_UPDATE_OR_DELETE

policy. It maps to

RetainExceptOnCreate

, which cleans up resources after a failed initial deployment while retaining production data during later stack deletion.

3. Fargate deployment circuit breaker

The generated Fargate services do not enable a deployment circuit breaker. CDK warns that a failed service deployment may take several hours to fail.

Consider enabling:

Copy code

ts
circuitBreaker: {
  rollback: true,
}

Care Management Workflows

Paul Simpson

07/17/2026, 4:37 PM

Hello! I was hoping to connect with a Medplum FDE who has experience with building care management workflows. I'm getting close to finalizing a contract for Medplum hosted and I would like to better understand our options for building out care management capabilities using the Provider app as a starting point. Thank you.

Adding project setting checkReferencesOnWrite

rabbit_rabbit

07/17/2026, 10:41 AM

When using hosted medplum I can edit my project settings and manually add a

checkReferencesOnWrite

setting (although it calls this a "secret") in the interface.

When running locally I have a super admin view where I can see the project in a submenu in the bottom left. From there, there's a dedicated checkbox for this setting inspiring more confidence that this actually took effect.

My question is two-fold: - Is there some way of getting a "super admin" type experience for my project? I wasn't the one who initially set it up and the employee who did is no longer with the company, so perhaps that's a permission that wasn't initially created for me? Alternatively is super admin not available for hosted medplum? - If super admin permissions are not possible, is what I'm seeing here proof enough that the setting is applied?

Thanks in advance! https://cdn.discordapp.com/attachments/1527686702334742608/1527686702682996766/image.png?ex=6a5b909c&is=6a5a3f1c&hm=15294af77877d9c47413d1f3c3b95e516bf833243592dd68e2fd529475723f34& https://cdn.discordapp.com/attachments/1527686702334742608/1527686703203225701/image.png?ex=6a5b909d&is=6a5a3f1d&hm=113a993ca4eff854178547dc47e5523b80ab489aeb3bb7a61aa0cca61fa17835&

Are there various methods that I can handle patient-generated medical record corrections/disputes?

snar

07/13/2026, 2:19 AM

How should patient-generated corrections, annotations, disputes, and clarifications be represented in FHIR? thanks

Where do Medplum developers store ingestion pipeline metadata?

snar

07/13/2026, 1:32 AM

Where do Medplum developers store ingestion pipeline metadata?

For example:

processing status OCR version extraction version ingestion logs

Is there already a FHIR-native pattern (using Task, Provenance, DocumentReference extensions, or custom extensions)

Thanks

Query reg. pricing

Loga

07/10/2026, 10:34 AM

It's been stated that for self hosted enterprise, pricing is involved. Can I get some details on the pricing info? Also, is the pricing one time or differs based on specifics like, no. of hospitals, users, etc.

Persistent vs transient PlanDefinition $apply

VAyala

06/30/2026, 12:33 AM

There seems to be some abmiguity in R4 about whether PlanDefinition $apply should be a transient or persistent operation, which is later disambiguated in R5 and in the Clinical Practice Guidelines.

In the latter 2 (and other related documentation), the spec is explicit that the $apply operation is transient - "Note that result of this operation is transient (i.e. none of the resources created by the operation are persisted in the server, they are all returned as entries in the result Bundle(s)). The result effectively represents a proposed set of activities, and it is up to the caller to determine whether and how those activities are actually carried out and/or persisted."

Having the operation return the response, instead of persisting it, makes it possible for the caller to control idempotency/transaction-bundles/if-match optimistic locking, etc and inject user requested overrides where appropriate before persisting.

Are there any plans to consider moving towards the transient implementation of $apply? And implementing $apply more fully in general?

Schedule refers to non-existent Timing

rabbit_rabbit

06/12/2026, 8:51 AM

The [Usage for the Schedule resource]( [https://www.medplum.com/docs/api/fhir/resources/schedule?section=usage](/content/docs/api/fhir/resources/schedule?section=usage ""/index.html)) refers to Timing, but [this page]( https://www.hl7.org/fhir//api/fhir/datatypes/timing) 404s and I don't see it in the FHIR Resources. What is the best practice for storing the delivery of a medication?

Thanks!

"PostDeployMigrationQueue worker: error" during Medplum server reindex v8

Adriano Freitas

06/10/2026, 7:19 AM

Hi everyone, how are you?

I'd like to ask for help (more of a cry for help, really) with this error that's occurring during reindexing when we updated the Medplum server to v8. It's only emitting this log and not progressing with the reindexing. Is there anything I can do? It's a database with millions of records, and the reindexing process has already been running for over 800 hours. Below is the log that appears:

{"level":"INFO","timestamp":"2026-06-10T11:04:29.100Z","msg":"PostDeployMigrationQueue worker: error","error":"could not renew lock for job 1","stack":"Error: could not renew lock for job 1\n at /usr/src/medplum/node_modules/bullmq/dist/cjs/classes/worker.js:792:40\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n at async Worker.extendLocks (/usr/src/medplum/node_modules/bullmq/dist/cjs/classes/worker.js:782:9)\n at async Timeout._onTimeout (/usr/src/medplum/node_modules/bullmq/dist/cjs/classes/worker.js:732:29)"}

I would appreciate any help you can provide.

Sincerely,

Adriano Freitas

Adding another developer to medplum project

rabbit_rabbit

06/09/2026, 1:47 PM

Hello! My colleague created a project in medplum, then added me as a User to that project. We're both developers on a new project.

That user's email already has an existing project, so when I log in it takes me to that existing project, not to the project I was invited to.

However, if he adds a user with an otherwise unused email, I get that no account is found.

Any advice on how to proceed is appreciated! https://cdn.discordapp.com/attachments/1513962773439320087/1514285421461245992/image.png?ex=6a2acfb2&is=6a297e32&hm=4ce902ad8b31cea16fd8d1c254ca7d693b87b0406c9fbd496d5fa7ca1dfa8848&

ElastiCache Serverless support?

amandamcgivern

06/03/2026, 3:07 PM

Hi Medplum team! Checking if there's been any movement on supporting [ElastiCache Serverless]( https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/WhatIs.html#WhatIs.Overview). I saw the [2024 thread]( https://discord.com/channels/905144809105260605/1295366782089166939) where it wasn't on the roadmap and wanted to check in since it's been a couple years and things may have changed.

For context, we're in the process of moving over to Serverless and would like to migrate Medplum as well to get auto-scaling and better multi-availability-zone support.

From reading the source, the only real blocker seems to be the [BullMQ queue names]( https://docs.bullmq.io/bull/patterns/redis-cluster). Serverless is internally cluster-mode, so all of a queue's internal keys need to land on the same shard, which requires wrapping the queue name in {}. Without that, the queue breaks because it touches keys spread across shards. Everything else looks compatible.

Is this something you'd consider supporting?

Changing value of mfaRequired after user is already invited.

Yong Lee

06/03/2026, 8:01 AM

Helle Medplum team. I noticed that even though mfaRequired can be set as

true

in the initial invite but there is no documentation on setting mfaRequired as

false

. I understand that even project admin may be not possible on server-scoped users but does same logic apply on project-scoped users as well?

- Yong Lee

GDPR - account deletion request

thomabig

05/28/2026, 7:35 AM

Hello everyone,

I have a question about GDPR and possibility to request the account's deletion. Do you have any internal way of "anonymizing" all information of a User at once ?

My understanding is that if I decide to anonymize at a certain point in time, all the history records will still contain name, email, phone about the patient.

Is that correct ? Do you have a procedure to allow such process ?

Thanks

GraphQL doesn't support "pr" filter

bnz

05/27/2026, 11:45 AM

Hello, trying to filter PatientList by active patients, but we want to include patients that do not have

active

(active undefined) in the active category as opposed to inactive. We can do this via REST with

active pr false

, but this seems to is not be included on the graphql side and gets ignored in the query. Is there an option to get around this or is REST the best option? Thanks for your help!

Enroll via Native App

mdaymard

05/19/2026, 7:39 PM

Hi!

We are building a health app using Medplum and would be initially self-hosting. I have a question about best practices when authenticating via native mobile apps.

Our healthcare app doesn't allow self-registration. Flow: clinic admin creates Patient → assigns activation code → patient enters code in iOS app → verifies identity (DOB + phone last 4) → creates password → gets tokens.

Current approach: - iOS app uses client_credentials grant (ClientApplication) to get bearer token - App calls bots for: code validation, identity verification, password setup, login - Passwords stored as PBKDF2 hash in Patient extensions (no Medplum User accounts)

Concern: client_secret is embedded in iOS binary. Anyone extracting it can call bots directly - brute-force activation codes or probe for patient emails.

Question: Better pattern for mobile apps calling bots before user identity exists? PKCE needs a user first, and our "user" doesn't exist until after activation completes.

Alternatives considered: proxy API in front of Medplum, anonymous tokens for activation only.

Thanks in advance! Mike

Updating resources with attachments hard-codes link

Doug DeBold

05/19/2026, 11:43 AM

Hi there, we have once again encountered this issue and while I understand how to fix this case, I would like to talk about how to prevent this in the future.

The issue we are having is that when we attach a file to a resource, for example an image being attached to a

Communication

, if we update that resource again, it is VERY easy to replace the link to the Binary with a hard-coded signed URL pointing. This then quickly expires and makes the image unavailable for viewing. As far as I can tell, this applies to every single resource that may have a binary attached to it.

How to replicate: 1. Create a resource with an attached Binary 2. Do an full update of the resource, e.g.

medplum.updateResource(...communication, sent: new Date())

3. Notice that

payload.contentAttachement

will have changed even through it wasn't updated

This foot-gun has bit us at least 3 times now. Maybe we are doing something wrong, but aside from banning the use of

updateResource

I really don't see how to prevent this. Any ideas?

UserSecurityRequest auth/setpassword expiration behavior

Guoyi Z (Empallo)

05/12/2026, 10:12 AM

Hi! We are using the hosted Medplum backend and recently reviewed the behavior of

UserSecurityRequest

for invite and password reset flows.

It looks like a

UserSecurityRequest

becomes invalid after it is successfully used, but we did not observe time-based expiration for the

auth/setpassword

endpoint. And when multiple password reset requests are generated for the same user, older reset links may still remain valid until they are used. I wanted to confirm whether this is the expected behavior.

Some thoughts: - A reset link expires after a short period of time, such as 15mins or 1 hour, (the invite type may need to grant longer expiration time) - When a new password reset request is generated, previous unused reset requests for the same user are invalidated.

Are there any planned Medplum features to support expiration for

UserSecurityRequest

, or to make newer password reset requests supersede older unused ones? If this behavior is not currently supported, do you have a recommended approach for hosted Medplum users who want to enforce stricter password reset security while still using

auth/setpassword

? Thanks!

Advanced filters and requests

thomabig

05/08/2026, 5:48 PM

Hello everyone,

I'm wondering what would be the strategy you'd recommend if you would like to implement advanced filters in Medplum.

Let me explain : We have grids with all our patients. In this grid we have columns in which we display values coming from the extensions or status of a resource linked to the patient but not stored directly in the patient.

With the Medplum API, we did not find any ways to have an easy way of adding filtering on these kind of values.

What we thought at the moment is to have a database on which we would copy all data we want to query on, do our SQL queries directly on this independant database and then do a Medplum call on all the IDs that have been extracted from our query.

What do you think ? Do you already had similar strategies ?

Thank you.

$set-accounts in a batch?

argmonster

05/08/2026, 1:30 PM

Hello all!

I was looking at putting a bundle of $set-accounts calls together but ran into the bundle returning 404 errors.

I see that the bundle is routing through a different router than the direct requests and doesn’t support the $set-accounts end point explaining the 404.

I’m guessing this is an intentional design decision? And the best practice to call $set-accounts a large set of resources is to issue individual requests?

409 Serialization failures

Zeeshan

05/06/2026, 1:08 PM

I am new to using medplum. We are self hosting it but while trying to insert a lot of records at once, i am running into too many 409 serialization failures. Did anyone else run into this? Is there a way to soften the postgres transaction_isolation_level as it appears it's been forced through the app in the code.

onsetDateTime shows error `Cannot build numeric range from dateTime`

Guoyi Z (Empallo)

05/05/2026, 3:48 PM

Hi Medplum Team,

I think there is some strange behavior with the

Condition

resource. When I attempt to add an onsetDateTime, I receive an error message stating, “Cannot build numeric range from dateTime.” Looks like it just happened today. Could you please take a look at this issue? Thank you! https://cdn.discordapp.com/attachments/1501309700270985358/1501309700937875456/Screenshot_2026-05-05_at_3.46.27_PM.png?ex=69fb9b1d&is=69fa499d&hm=5f5ca8ba5f975bc71a4915b12f5f452d23b50978e14ed056b438b614941db209&

How to improve AsyncJob time for version updates

Adriano Freitas

04/28/2026, 8:10 AM

We recently started an update to the Medplum environment with the goal of reaching version 5.1.9. We have version 4.1.5 and have built the following runbook:

4.1.5

4.1.18

4.1.18

4.2.6

4.2.6

4.3.15

4.3.15

4.4.3

4.4.3

4.5.2

4.5.2

5.0.15

(enforced compatibility gate) 7.

5.0.15

5.1.9

The problem is that the AsyncJob from version 4.1.5 to 4.1.18 has been running for more than 13 hours. How can we advance to the next versions more quickly? Is there another way to update? https://cdn.discordapp.com/attachments/1498657633115181170/1498657633673150628/Captura_de_tela_2026-04-28_090414.png?ex=69f1f52f&is=69f0a3af&hm=08ede4753863a851d6d62a08af6d7218f73e82f515bb8b52cb1be8b682f19512&

Ingesting 50K x 5MB Observations efficiently

Goswami

04/08/2026, 8:37 AM

Hi,

We need to ingest 50,000 Observations within 3 hours, each ~5MB (250GB total). At that size, batching is nearly useless given the 50MB async bundle cap.

What's the recommended approach? Should we use FHIR Binary + Attachment references to keep Observations lean?

Thanks!

Self-hosted Bot Questions

Doug DeBold

04/06/2026, 10:57 AM

Hi there! I have few questions about self-hosting bots that I have not been able to answer from the code/docs.

1. We have a multi-tenant system with a few standardized bots that every project gets. Currently we are recreating for each project. Can I create the bots in a shared project and then setup the subscriptions in each project? I tried this but wasn't able to get it to work. 2. Does

Bot.system

do anything more than include system secrets for the bot? I have some very sensitive secrets (Stripe keys for example) that I want to move to systemSecrets to reduce visibility. 3. Any other Bot features that would be applicable to self hosting I should be aware of?

Thanks!

Completely remove rate limit for local testing

thomabig

04/04/2026, 3:43 AM

Hello,

We have an API that acts as a intermediate server between the frontend and Medplum.

In this api we've created quite a lot of tests that runs against a Medplum hosted on docker that we launch before running the tests.

When I run the test one by one every test runs correctly, but when running everything at once, I quickly get a rate limit issue.

As this medplum hosted on docker is only used for testing, we would like to remove all the rate limits, but I have not found how to do this.

I'm not completely sure to understand how I'm supposed to do that. I've seen that when lauching a docker image I can add a medplum.config.json

I've tried adding it like that :

{ "defaultRateLimit": "10000000/minute", "defaultAuthRateLimit": "10000000/minute", "defaultFhirQuota": 100000000000 }

But I still get at some point

Expected: "NO_PROJECT_MEMBERSHIP_FOUND" Received: "Too Many Requests ({\"_remainingPoints\":0,\"_msBeforeNext\":21651,\"_consumedPoints\":54472,\"_isFirstInDuration\":false,\"limit\":50000})"

Although when I add this

{ "defaultRateLimit": "1/minute", "defaultAuthRateLimit": "1/minute", "defaultFhirQuota": 1 }

If you have any idea how I can do that that would be great. Thanks https://cdn.discordapp.com/attachments/1489893057443922063/1489893057653641266/image.png?ex=69d21289&is=69d0c109&hm=59b0f3b9a7051454ec3c491e480bc7bdbf797f94ebce05d7ec423ff9d1ae1dad&

saveAuditEvents config

Yong Lee

04/02/2026, 9:20 PM

Hi Medplum team, Is there an equivalent to saveAuditEvents [ [https://www.medplum.com/docs/self-hosting/server-config#saveauditevents](/content/docs/self-hosting/server-config#saveauditevents ""/index.html)] in Medplum Cloud? If there is, is it something that super admin or project admin can control or does it need to be configured by someone from Meplum?

MFA enforcement for invited user

Yong Lee

04/02/2026, 2:57 PM

Hi Medplum team. We are using Medplum Cloud and we are considering to use Medplum native TOTP as the default MFA. We can enforce MFA by requiring MFA in the user invitation. But can the invited user possible self-opt out of MFA once required to use MFA via invitation? Can admin user remove this MFA requirement for the user?

I couldn't find any documentation on this and I did some test and it seems like there is no self-opt out option for MFA required by invite (which is different from self-enrolled MFA)

Please confirm the expected behavior.

Thank you.

Redox -> HL7 Integration Setup Questions

YOH

04/02/2026, 10:32 AM

Hi Medplum team — we're working on setting up a Redox → HL7 integration and trying to understand what needs to be configured on the Medplum side to support it.

We have the following FHIR resource types in place: Patient, ServiceRequest, Encounter, and Practitioner. Our Report writeback via Redox has been validated on Sandbox.

What we're trying to do next is test the HL7 integration through the Redox > HL7 path. A few questions:

1. What does the Medplum-side configuration look like to support a Redox → HL7 integration? 2. Is there a Medplum instance we can point to for testing this flow? 3. Are there any example payloads or test workflows you'd recommend for validating the Redox → HL7 path?

Any guidance appreciated — thanks!

Redox -> HL7 Integration Setup Questions

YOH

04/02/2026, 10:32 AM

Hi Medplum team — we're working on setting up a Redox → HL7 integration and trying to understand what needs to be configured on the Medplum side to support it.

What we're trying to do next is test the HL7 integration through the Redox > HL7 path. A few questions:

Any guidance appreciated — thanks!

Default patient access policy not working.

razan

03/31/2026, 10:54 AM

We run a self hosted version of Medplum, currently on Version 5.1.0. For our usecase we require that Patients can login and send data to the fhir server. Patients are invited by a project admin via the Admin interface. According to documentation it should be possible to set a default access policy for patients in the project. I created an access policy that allows patients to only see resources in their own compartment. When i invite a new Patient this access policy is not applied in the ProjectMembership. When the patient logs in he can see all other patients data which is not ideal. When i manually apply the access policy to the projectmembership of the patient it works as expected.

A possible workaround for us would be to setup a bot that applies access policies to newly created projectmemberships. This is not ideal because it does not restrict access by default. This raises a few questions for me:

Why is the default access policy never applied? Is this a bug?
Why is it possible for a patient with no access policy, to see data of other patients? This seems like a design flaw, a patient should never be able to see other patients data, unless it is specifically granted to them.
Why is it not possible to restrict access to all resources to non admin users by default unless an access policy grants them access. In my eyes this would provide more data security if needed.

Default patient access policy not working.

razan

03/31/2026, 10:54 AM

Issues upgrading 5.0.15 to 5.1.0

Brian Hirst

03/24/2026, 5:02 PM

I am trying to update dfrom the versions indicated and get the following message:

Error: Unable to run this version of Medplum server. Pending post-deploy migration v31 requires server at version 5.0.0 <= version < 5.1.0, but current server version is 5.1.0

Eventually the container dies and attempts to restart. 5.0.15 should be the last version on 5.0. So I am not sure what is going wrong.

Issues upgrading 5.0.15 to 5.1.0

Brian Hirst

03/24/2026, 5:02 PM

I am trying to update dfrom the versions indicated and get the following message:

Eventually the container dies and attempts to restart. 5.0.15 should be the last version on 5.0. So I am not sure what is going wrong.

Changing user email on hosted projects

Tom Wei

03/24/2026, 4:54 PM

My company would like to migrate all existing users to a different email domain. We're using the hosted solution, so there doesn't appear to be a way for me to directly update users. We're using Google oauth, so logins are broken when their primary email address is updated to the new email. Is there any guidance on how we can migrate users to using their new emails for logins?

Changing user email on hosted projects

Tom Wei

03/24/2026, 4:54 PM

“Recaptcha failed” during password reset may indicate SMTP configuration issue

Kai

03/19/2026, 5:38 PM

While troubleshooting a password reset issue in Medplum, the UI consistently returned “Recaptcha failed.” After verifying reCAPTCHA configuration and request flow, the root cause was identified in the backend: an SMTP authentication error (EAUTH: Missing credentials for "PLAIN") during the email send step. This suggests the error message may not always reflect the actual failure point. It may be helpful for the community to consider more specific error handling or logging around email delivery vs. reCAPTCHA verification to avoid misdirecting debugging efforts.

“Recaptcha failed” during password reset may indicate SMTP configuration issue

Kai

03/19/2026, 5:38 PM

Reset Password not sending on app.medplum.com?

Karen Lin

03/19/2026, 1:20 PM

Hi there! Are reset password emails no longer sending? (Haven't been able to find in spam/all mail folders.) Is there no way to reset password and log back in now? Or is this a temporary issue on app.medplum.com?

Reset Password not sending on app.medplum.com?

Karen Lin

03/19/2026, 1:20 PM

ChargeItemDefinition Instance

Borna Doroudi | Empallo

03/18/2026, 2:20 PM

Hi Medplum team,

I have a FHIR related question about the ChargeItemDefinition resource. Is it possible for the instance element to be a reference of HealthCareService? I can see in Medplum documentation the listed options as of now are: Medication, Substance, and Device so I wanteed to see if HealthCareService is also an option here. Thank you!

ChargeItemDefinition Instance

Borna Doroudi | Empallo

03/18/2026, 2:20 PM

Hi Medplum team,

true or false?

Kai

03/18/2026, 11:27 AM

Vite does not preserve dynamic access patterns like const env = import.meta.env (code e.g. // 🔴 CRITICAL: direct import.meta.env usage (no intermediate object) // This ensures Vite statically injects values into the production bundle

export const config: MedplumAppConfig = { baseUrl: import.meta.env.VITE_MEDPLUM_BASE_URL ?? import.meta.env.MEDPLUM_BASE_URL ?? '',)

true or false?

Kai

03/18/2026, 11:27 AM

export const config: MedplumAppConfig = { baseUrl: import.meta.env.VITE_MEDPLUM_BASE_URL ?? import.meta.env.MEDPLUM_BASE_URL ?? '',)

Medplum v5 OTEL

nathan-watkins-unityai

03/16/2026, 3:57 PM

Hi self-hosters, we recently updated our instance to v5.0.15 from 4.x and seemingly lost much of our tracing. We've done some CI modifications in our fork, so I'm hoping if somebody can validate that they're still getting

@opentelemetry/instrumentation-net

@opentelemetry/instrumentation-express

@opentelemetry/instrumentation-ioredis

spans in their traces after the v5 / ESM everywhere upgrade. We only seem to be getting

@opentelemetry/instrumentation-pg

post-upgrade. I'm always surprised otel-js and ESM is still [weird]( https://github.com/open-telemetry/opentelemetry-js/issues/4933) in 2026.

Medplum v5 OTEL

nathan-watkins-unityai

03/16/2026, 3:57 PM

@opentelemetry/instrumentation-net

@opentelemetry/instrumentation-express

@opentelemetry/instrumentation-ioredis

spans in their traces after the v5 / ESM everywhere upgrade. We only seem to be getting

@opentelemetry/instrumentation-pg

public.RiskEvidenceSynthesis+(_History)

Kai

03/13/2026, 9:33 AM

These tables are intriguing, why are they present?

public.RiskEvidenceSynthesis+(_History)

Kai

03/13/2026, 9:33 AM

These tables are intriguing, why are they present?

Patient.active search parameter

Doug DeBold

03/09/2026, 6:44 PM

Hi there. We are seeing some strange behavior with the

Patient.active

search parameter. We are creating patients via the

/admin/projects/:projectId/invite

API. It seems that when we invite patients through this API, even though

Patient.active = undefined

, the search parameter column in the database is being set to

FALSE

. If you then set and unset

active

, the

active

column in the database is properly set to

null

. I have been digging and cannot understand why this is happening.

This is making filtering for for active/inactive users very difficult. Any help/guidance.

Patient.active search parameter

Doug DeBold

03/09/2026, 6:44 PM

Hi there. We are seeing some strange behavior with the

Patient.active

search parameter. We are creating patients via the

/admin/projects/:projectId/invite

API. It seems that when we invite patients through this API, even though

Patient.active = undefined

, the search parameter column in the database is being set to

FALSE

. If you then set and unset

active

, the

active

column in the database is properly set to

null

. I have been digging and cannot understand why this is happening.

This is making filtering for for active/inactive users very difficult. Any help/guidance.

custom search parameter

lazybaer

03/05/2026, 2:46 PM

Hi there! I'm created a

SearchParameter

to allow us to search for practitioner's by their state of licensure. it looks like this

Copy code

{
  "resourceType": "SearchParameter",
  "url": "https://--------.com/fhir/SearchParameter/practitioner-license-state",
  "name": "license-state",
  "status": "active",
  "description": "Search practitioners by state where their license is valid (USPS state codes)",
  "code": "license-state",
  "base": [\
    "Practitioner"\
  ],
  "type": "token",
  "expression": "Practitioner.qualification.extension.where(url='http://hl7.org/fhir/us/davinci-pdex-plan-net/StructureDefinition/practitioner-qualification').extension.where(url='whereValid').value.ofType(CodeableConcept).coding.code",
  "id": "9ec9cef7-5142-486a-aaeb-6934de1a1604",
  "meta": {
    "versionId": "a6d3f326-031e-4136-83b0-94b654201fea",
    "lastUpdated": "2026-03-05T01:39:55.758Z",
    "author": {
      "reference": "ClientApplication/--------------------",
      "display": "----Staging Default Client"
    },
    "project": "--------------------",
    "compartment": [\
      {\
        "reference": "Project/-------------------"\
      }\
    ]
  }
}

(redacted some id's) when trying to seach on that though via: https://api.medplum.com/fhir/R4/Practitioner?license-state=CA&_count=10 I get an error with "Unknown search parameter: license-state" in the response. Any idea what I might be doing wrong? thanks in advance

custom search parameter

lazybaer

03/05/2026, 2:46 PM

Hi there! I'm created a

SearchParameter

to allow us to search for practitioner's by their state of licensure. it looks like this

Copy code

fastupdate for GIN index

Jim Fiorato

03/05/2026, 6:36 AM

We're working on a large backfill of patient/careteam data. We've been following the recommendations in the Migrating to Medplum guide here: [https://www.medplum.com/docs/migration](/content/docs/migration ""/index.html)

We noticed a lot of slowness and inability to parallelize without transaction/serialization conflicts when trying to throttle up the migration of data. We do a lot of fetching/upserting by external identifier. Patient/CareTeam updates were taking 1.5 seconds.

I came across the GIN index page and found that turning off

fastupdate

for the Patient and CareTeam tables really made a big difference in performance, bringing the time down to about 90ms per Patient/Care team.

There isn't much documentation around the GIN index setup here. Is this backfill use case the reason it exists? Do you have any guidance around the use of these settings or tuning of the

gin_pending_list_limit

value for different types of workloads?

fastupdate for GIN index

Jim Fiorato

03/05/2026, 6:36 AM

I came across the GIN index page and found that turning off

fastupdate

for the Patient and CareTeam tables really made a big difference in performance, bringing the time down to about 90ms per Patient/Care team.

gin_pending_list_limit

value for different types of workloads?

Subscriptions Payloads on Updates

lazybaer

03/03/2026, 4:54 PM

hey there! We use webhooks to sync medplum data back into our platform for a number of objects. I actually see a body payload on new records, along with the headers. Something I'm not seeing however is updates from my Subscription to my webhook when a record changes. Specifically, I'm trying to keep my Organization records sync'd to an database via webhook and I'm not seeing evetns after that initaly creationg. Any idea why that might be?

Subscriptions Payloads on Updates

lazybaer

03/03/2026, 4:54 PM

Project-scoped users not able to login

Stephen Henderson

03/02/2026, 10:53 AM

I've added our practitioners to our Medplum-hosted project and given them the appropriate access. They're project-scoped non-admin users, but they cannot access the Medplum project. Seems like they are able to login to Medplum, but they don't see the project in the list of available projects.

Can I get help resolving this? I can share project/user ids.

Project-scoped users not able to login

Stephen Henderson

03/02/2026, 10:53 AM

Can I get help resolving this? I can share project/user ids.

$set-accounts propagation and deprecated strictMode

Jim Fiorato

02/24/2026, 11:24 AM

I'm in the process of setting up a multi-tenant project, and when I use $set-accounts with the propagate flag set to

true

, I get a bunch of validation errors.

Looking through the source code, $set-accounts strictly validates the resources it is propagating the account information to.

I haven't been running the project in

strictMode

, so normal resource CRUD work bypasses validation.

But looking at the strictMode setting on projects I see this message:

Whether this project uses strict FHIR validation. This setting has been deprecated, and can only be set by a super admin.

Why is $set-accounts doing validation on my project that does not have

strictMode

enabled?

strictMode

truly deprecated? If so, is it deprecated in favor of another validation mechanism?

$set-accounts propagation and deprecated strictMode

Jim Fiorato

02/24/2026, 11:24 AM

I'm in the process of setting up a multi-tenant project, and when I use $set-accounts with the propagate flag set to

true

, I get a bunch of validation errors.

Looking through the source code, $set-accounts strictly validates the resources it is propagating the account information to.

I haven't been running the project in

strictMode

, so normal resource CRUD work bypasses validation.

But looking at the strictMode setting on projects I see this message:

Whether this project uses strict FHIR validation. This setting has been deprecated, and can only be set by a super admin.

Why is $set-accounts doing validation on my project that does not have

strictMode

enabled?

strictMode

truly deprecated? If so, is it deprecated in favor of another validation mechanism?

Is there a way to integrate with AMA and pull CPT/ICD codes into the system?

02/20/2026, 5:19 PM

Hey guys, is there any native way in Medplum to pull CPT/ICD codes into Medplum along with their usage guidelines?

Is there a way to integrate with AMA and pull CPT/ICD codes into the system?

02/20/2026, 5:19 PM

Hey guys, is there any native way in Medplum to pull CPT/ICD codes into Medplum along with their usage guidelines?

`StartNewUser` missing meta project

Guoyi Z (Empallo)

02/19/2026, 12:27 PM

Hi, for context, our patient portal allows patients to self-register and we are using the Medplum React

RegisterForm

component, my understanding is under the hood, it calls

startNewUser

to create a new

User

resource first, but it appears the resource is missing the meta.

project

, so as a project admin (we are not self-host), I'm unable to access this User resource. Could you please take a look into this? Thank you!

Here is the

StartNewUser

code for your reference: https://github.com/medplum/medplum/blob/27aeffe3440c15cffc50d42f4c9f50c81cd00508/packages/server/src/auth/newuser.ts#L109

`StartNewUser` missing meta project

Guoyi Z (Empallo)

02/19/2026, 12:27 PM

Hi, for context, our patient portal allows patients to self-register and we are using the Medplum React

RegisterForm

component, my understanding is under the hood, it calls

startNewUser

to create a new

User

resource first, but it appears the resource is missing the meta.

project

, so as a project admin (we are not self-host), I'm unable to access this User resource. Could you please take a look into this? Thank you!

Here is the

StartNewUser

Documentation Rendering is Broken on medplum.com

Jim Fiorato

02/18/2026, 4:51 PM

Looks like the documentation rendering is broken on the site right now. Some kind of HTML escaping issue? https://cdn.discordapp.com/attachments/1473799012699082813/1473799013038948438/Screenshot_2026-02-18_at_3.50.38_PM.png?ex=699785ca&is=6996344a&hm=1bfd318110bcdb8e6e0bded9c4b0ff6ff3ee6f1046f911a49f8e8b768ff54294&

Documentation Rendering is Broken on medplum.com

Jim Fiorato

02/18/2026, 4:51 PM

Clarification on date parameter for Encounter

Koyo

02/18/2026, 12:09 PM

Hi, I was wondering if I could get some clarification on the date parameter for Encounter. Dates are saved as periods. If i were to do date:ge:"1/1/2026 12:00:00AM", does this check with period.start or period.end? Or is it dynamic, where date:ge checks for period.start and date:le checks for period.end.

Thank you!

Clarification on date parameter for Encounter

Koyo

02/18/2026, 12:09 PM

Thank you!

Quest Diagnostics Integration

Borna Doroudi | Empallo

02/17/2026, 11:41 AM

Hi Medplum team,

If possible we'd like to integrate with Quest Diagnostics to enable placing lab order directly within our EHR. To submit a request to their implementations team, they ask for a Medplum contact and phone number. Could you please guide us on the next steps please?

Screenshot attached for reference. Thank you! https://cdn.discordapp.com/attachments/1473358768921247951/1473358769802055791/Screenshot_2026-02-17_at_11.40.58_AM.png?ex=6995ebc8&is=69949a48&hm=12cc8bd2823f4d3f72eb8204cf851569ae9baf996549bde4e09e3dd037b75668&

Quest Diagnostics Integration

Borna Doroudi | Empallo

02/17/2026, 11:41 AM

Hi Medplum team,

Delete Project

blee

02/14/2026, 12:38 PM

Hi, I was using a script to delete resources in my project and i corrupted the project to the point where opening the medplum app website results in an infinite spinner (i think it may be because i deleted the practitioner that was tied to my user?).

i was able to circumvent this by just creating a new project, but id like to delete my old one. what’s the best way to do this?

Delete Project

blee

02/14/2026, 12:38 PM

i was able to circumvent this by just creating a new project, but id like to delete my old one. what’s the best way to do this?

$find operation ignore the planningHorizon end time

Guoyi Z (Empallo)

02/13/2026, 10:47 AM

Hi, when I did some experiments with the new ⁠$find operator, it seems that it ignores the ⁠`planningHorizon` end time from the corresponding

⁠Schedule

resource.

$find operation ignore the planningHorizon end time

Guoyi Z (Empallo)

02/13/2026, 10:47 AM

Hi, when I did some experiments with the new ⁠$find operator, it seems that it ignores the ⁠`planningHorizon` end time from the corresponding

⁠Schedule

resource.

Search parameter "near"

Stiaez

02/11/2026, 7:02 AM

Hi! I'm trying to search ressource Location by near parameter (Location.near)

i tried this

Copy code

{
  LocationList(near: "49.0065943|2.2585148|50|km") {
    id
    name
    position { latitude longitude }
  }
}

but i get this : "Unrecognized search parameter type: special"

Docs list near for Location (type special) — is near actually supported in Medplum (REST/GraphQL)?

thanks

Search parameter "near"

Stiaez

02/11/2026, 7:02 AM

Hi! I'm trying to search ressource Location by near parameter (Location.near)

i tried this

Copy code

{
  LocationList(near: "49.0065943|2.2585148|50|km") {
    id
    name
    position { latitude longitude }
  }
}

but i get this : "Unrecognized search parameter type: special"

Docs list near for Location (type special) — is near actually supported in Medplum (REST/GraphQL)?

thanks

Missing a few records when syncing data with EHR

02/03/2026, 5:45 PM

Hello,

We are experiencing an issue when exporting patient data from Practice Fusion FHIR R4 API. We discovered that clinical data can only be retrieved for patients who have the following identifier in their identifiers array: "urn:oid:2.16.840.1.113883.3.3388.3.3"

Current Behavior:

- Patients WITH urn:oid:2.16.840.1.113883.3.3388.3.3 identifier: Successfully retrieve all clinical data (Observations, Conditions, DiagnosticReports, MedicationRequests, etc.) - Patients WITHOUT this identifier: Only Encounters are returned (~7-15 resources), despite clinical data existing in Practice Fusion

Example Query: GET /fhir/r4/Observation?patient=Patient/{patientId}&_count=100

For patients without the urn:oid:2.16.840.1.113883.3.3388.3.3 identifier, this query returns 0 results, even though observations exist for these patients in your system.

We have attempted alternative search strategies including:

- Using different identifier systems and values - Using patient.identifier=system|value search parameter - Querying with patient ID directly

None of these alternatives successfully retrieve clinical data for patients missing the target URN:OID.

Questions:

- Why do some patients lack the urn:oid:2.16.840.1.113883.3.3388.3.3 identifier? - Is there an alternative method to query clinical resources for patients without this identifier? - What is the recommended way to query and export a single patients' clinical data? And how do we extend it to all patients?

Any guidance would be appreciated. Thank you

Missing a few records when syncing data with EHR

02/03/2026, 5:45 PM

Hello,

Current Behavior:

Example Query: GET /fhir/r4/Observation?patient=Patient/{patientId}&_count=100

We have attempted alternative search strategies including:

- Using different identifier systems and values - Using patient.identifier=system|value search parameter - Querying with patient ID directly

None of these alternatives successfully retrieve clinical data for patients missing the target URN:OID.

Questions:

Any guidance would be appreciated. Thank you

CannotPullContainerError: pull image manifest has been retried 7 time(s): failed to resolve ref dock

ysael

02/03/2026, 11:27 AM

CannotPullContainerError: pull image manifest has been retried 7 time(s): failed to resolve ref docker.io/medplum/medplum-server:5.0.11: docker.io/medplum/medplum-server:5.0.11: not found

seems like there is a potential issue with 5.0.11 image?

CannotPullContainerError: pull image manifest has been retried 7 time(s): failed to resolve ref dock

ysael

02/03/2026, 11:27 AM

seems like there is a potential issue with 5.0.11 image?

Filter task by "Not Before"?

Doug DeBold

01/30/2026, 3:07 PM

Looking at the Task search parameters it looks like there is no way to do API side filtering on

Task.restriction.period.start

just on

end

aka

due-date

. We are scheduling tasks out into the future that should not be performed right now. Would the team be open to adding a new search parameter for "not before" (or something like that) that would allow searching on the restriction start date? I'm happy to do the work!

Filter task by "Not Before"?

Doug DeBold

01/30/2026, 3:07 PM

Looking at the Task search parameters it looks like there is no way to do API side filtering on

Task.restriction.period.start

just on

end

aka

due-date

Is it possible to change the login email?

01/30/2026, 10:05 AM

Hey guys, I am currently logging into superadmin via admin@example.com and I would like to change this email to my custom domain. Any idea on how to do that? I do not want to create a new user. I just want to change the login email to my domain.

I tried changing the email in the user profile but it says user not found when i try to login with the new email

Is it possible to change the login email?

01/30/2026, 10:05 AM

I tried changing the email in the user profile but it says user not found when i try to login with the new email

Some pages on docs not available

Koyo

01/29/2026, 5:35 PM

[https://www.medplum.com/docs/sdk/core.medplumclient.bulkexport](/content/docs/sdk/core.medplumclient.bulkexport ""/index.html)

some pages have recently become unavailable, one of them being core.medplumclient.bulkexport, although it shows up in search.

Is this functionality being removed? Thank you

Some pages on docs not available

Koyo

01/29/2026, 5:35 PM

[https://www.medplum.com/docs/sdk/core.medplumclient.bulkexport](/content/docs/sdk/core.medplumclient.bulkexport ""/index.html)

some pages have recently become unavailable, one of them being core.medplumclient.bulkexport, although it shows up in search.

Is this functionality being removed? Thank you

How do I scale lambdas(bots) for bulk export?

01/29/2026, 9:00 AM

Hey guys, I have a bulk export app which is exporting all patient data from an EHR I have integrated with. I am using bots for it, and I have one bot per resource type. So I have one for Condition, one for Observation and so on. However, the EHR I have connected with has a lot of data, and my lambda times out even though I set the timeout to 15 mins. What's the best way to scale this system?

How do I scale lambdas(bots) for bulk export?

01/29/2026, 9:00 AM