ATNA Audit Event API

Use the ATNA Audit Record Repository API to submit FHIR AuditEvent resources for your integration.

This page is the practical REST/FHIR submission reference. For the complete ATNA ARR actor, transaction, transport, query, and security requirements, use the published guides:

ATNA implementation summary - implementation overview for the ARR, including ITI-20 transport, ITI-81/ITI-82 query flows, and security requirements.
ARR implementation guide - normative FHIR Implementation Guide and conformance artifacts.
ARR artifacts summary - profiles, capability statements, and other published artifacts.

The ARR supports the ATNA Audit Record Repository role. Integrations may submit audit records using the RESTful FHIR feed documented below; the ATNA implementation summary also describes the classic Syslog transport and the query transactions separately. Mutual TLS and proof of required ATNA logging are part of the integration requirements.

AuditEvent API

This section documents the current AuditEvent submission endpoint exposed by the Audit Record Repository.

Endpoint

Base URL: https://test-hie.health.gov.za/arr/AuditEvent
Method: POST
Content-Type: application/json

This is the RESTful FHIR feed for the ARR submission flow (ITI-20). Use the ATNA transport guidance for the alternative Syslog transport, and the ATNA query guidance for ITI-81 and ITI-82 retrieval patterns.

Required Client Credentials

Client certificate: Client.pem
Client key: Client.key
Issuer CA certificate: issuerCA.pem

Mutual TLS is required. Replace the certificate file paths with the credentials issued for your integration.

The client certificate authenticates the integrating node; it does not replace application-level user authentication. See the ATNA security guidance for the ATNA grouping, TLS, and retention requirements.

cURL
Node.js
Python

curl --request POST \
  --cert Client.pem \
  --key Client.key \
  --cacert issuerCA.pem \
  --url https://test-hie.health.gov.za/arr/AuditEvent \
  --header 'Content-Type: application/json' \
  --data '{
  "resourceType": "AuditEvent",
  "id": "example-login",
  "type": {
    "system": "http://dicom.nema.org/resources/ontology/DCM",
    "code": "110114",
    "display": "User Authentication"
  },
  "subtype": [
    {
      "system": "http://dicom.nema.org/resources/ontology/DCM",
      "code": "110122",
      "display": "Login"
    }
  ],
  "action": "E",
  "recorded": "2013-06-20T23:41:23Z",
  "outcome": "0",
  "agent": [
    {
      "type": {
        "coding": [
          {
            "system": "http://terminology.hl7.org/CodeSystem/extra-security-role-type",
            "code": "humanuser",
            "display": "human user"
          }
        ]
      },
      "who": {
        "identifier": {
          "value": "95"
        }
      },
      "altId": "601847123",
      "name": "Grahame Grieve",
      "requestor": true,
      "network": {
        "address": "127.0.0.1",
        "type": "2"
      }
    },
    {
      "type": {
        "coding": [
          {
            "system": "http://dicom.nema.org/resources/ontology/DCM",
            "code": "110153",
            "display": "Source Role ID"
          }
        ]
      },
      "who": {
        "identifier": {
          "system": "urn:oid:2.16.840.1.113883.4.2",
          "value": "2.16.840.1.113883.4.2"
        }
      },
      "altId": "6580",
      "requestor": false,
      "network": {
        "address": "Workstation1.ehr.familyclinic.com",
        "type": "1"
      }
    }
  ],
  "source": {
    "site": "Cloud",
    "observer": {
      "identifier": {
        "value": "hl7connect.healthintersections.com.au"
      }
    },
    "type": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/security-source-type",
        "code": "3",
        "display": "Web Server"
      }
    ]
  }
}
'

import fs from 'node:fs';
import https from 'node:https';

const auditEvent = {
  resourceType: 'AuditEvent',
  id: 'example-login',
  type: {
    system: 'http://dicom.nema.org/resources/ontology/DCM',
    code: '110114',
    display: 'User Authentication',
  },
  subtype: [
    {
      system: 'http://dicom.nema.org/resources/ontology/DCM',
      code: '110122',
      display: 'Login',
    },
  ],
  action: 'E',
  recorded: '2013-06-20T23:41:23Z',
  outcome: '0',
  agent: [
    {
      type: {
        coding: [
          {
            system: 'http://terminology.hl7.org/CodeSystem/extra-security-role-type',
            code: 'humanuser',
            display: 'human user',
          },
        ],
      },
      who: {identifier: {value: '95'}},
      altId: '601847123',
      name: 'Grahame Grieve',
      requestor: true,
      network: {address: '127.0.0.1', type: '2'},
    },
    {
      type: {
        coding: [
          {
            system: 'http://dicom.nema.org/resources/ontology/DCM',
            code: '110153',
            display: 'Source Role ID',
          },
        ],
      },
      who: {
        identifier: {
          system: 'urn:oid:2.16.840.1.113883.4.2',
          value: '2.16.840.1.113883.4.2',
        },
      },
      altId: '6580',
      requestor: false,
      network: {address: 'Workstation1.ehr.familyclinic.com', type: '1'},
    },
  ],
  source: {
    site: 'Cloud',
    observer: {identifier: {value: 'hl7connect.healthintersections.com.au'}},
    type: [
      {
        system: 'http://terminology.hl7.org/CodeSystem/security-source-type',
        code: '3',
        display: 'Web Server',
      },
    ],
  },
};

const request = https.request(
  'https://test-hie.health.gov.za/arr/AuditEvent',
  {
    method: 'POST',
    cert: fs.readFileSync('Client.pem'),
    key: fs.readFileSync('Client.key'),
    ca: fs.readFileSync('issuerCA.pem'),
    headers: {'Content-Type': 'application/json'},
  },
  (response) => {
    console.log(`Status: ${response.statusCode}`);
    response.pipe(process.stdout);
  },
);

request.on('error', console.error);
request.end(JSON.stringify(auditEvent));

import requests

audit_event = {
    "resourceType": "AuditEvent",
    "id": "example-login",
    "type": {
        "system": "http://dicom.nema.org/resources/ontology/DCM",
        "code": "110114",
        "display": "User Authentication",
    },
    "subtype": [
        {
            "system": "http://dicom.nema.org/resources/ontology/DCM",
            "code": "110122",
            "display": "Login",
        }
    ],
    "action": "E",
    "recorded": "2013-06-20T23:41:23Z",
    "outcome": "0",
    "agent": [
        {
            "type": {
                "coding": [
                    {
                        "system": "http://terminology.hl7.org/CodeSystem/extra-security-role-type",
                        "code": "humanuser",
                        "display": "human user",
                    }
                ]
            },
            "who": {"identifier": {"value": "95"}},
            "altId": "601847123",
            "name": "Grahame Grieve",
            "requestor": True,
            "network": {"address": "127.0.0.1", "type": "2"},
        },
        {
            "type": {
                "coding": [
                    {
                        "system": "http://dicom.nema.org/resources/ontology/DCM",
                        "code": "110153",
                        "display": "Source Role ID",
                    }
                ]
            },
            "who": {
                "identifier": {
                    "system": "urn:oid:2.16.840.1.113883.4.2",
                    "value": "2.16.840.1.113883.4.2",
                }
            },
            "altId": "6580",
            "requestor": False,
            "network": {
                "address": "Workstation1.ehr.familyclinic.com",
                "type": "1",
            },
        },
    ],
    "source": {
        "site": "Cloud",
        "observer": {
            "identifier": {"value": "hl7connect.healthintersections.com.au"}
        },
        "type": [
            {
                "system": "http://terminology.hl7.org/CodeSystem/security-source-type",
                "code": "3",
                "display": "Web Server",
            }
        ],
    },
}

response = requests.post(
    "https://test-hie.health.gov.za/arr/AuditEvent",
    json=audit_event,
    cert=("Client.pem", "Client.key"),
    verify="issuerCA.pem",
    headers={"Content-Type": "application/json"},
    timeout=30,
)
response.raise_for_status()
print(response.status_code, response.text)

Sample Response

A successful submission returns the stored AuditEvent, including its assigned resource ID and server-managed meta fields.

{
  "resourceType": "AuditEvent",
  "id": "1862",
  "meta": {
    "versionId": "1",
    "lastUpdated": "2026-08-24T10:42:52.746+00:00",
    "source": "#TahFVWwYFcDndGL3"
  },
  "type": {
    "system": "http://dicom.nema.org/resources/ontology/DCM",
    "code": "110114",
    "display": "User Authentication"
  },
  "subtype": [
    {
      "system": "http://dicom.nema.org/resources/ontology/DCM",
      "code": "110122",
      "display": "Login"
    }
  ],
  "action": "E",
  "recorded": "2013-06-20T23:41:23Z",
  "outcome": "0",
  "agent": [
    {
      "type": {
        "coding": [
          {
            "system": "http://terminology.hl7.org/CodeSystem/extra-security-role-type",
            "code": "humanuser",
            "display": "human user"
          }
        ]
      },
      "who": {
        "identifier": {
          "value": "95"
        }
      },
      "altId": "601847123",
      "name": "Grahame Grieve",
      "requestor": true,
      "network": {
        "address": "127.0.0.1",
        "type": "2"
      }
    },
    {
      "type": {
        "coding": [
          {
            "system": "http://dicom.nema.org/resources/ontology/DCM",
            "code": "110153",
            "display": "Source Role ID"
          }
        ]
      },
      "who": {
        "identifier": {
          "system": "urn:oid:2.16.840.1.113883.4.2",
          "value": "2.16.840.1.113883.4.2"
        }
      },
      "altId": "6580",
      "requestor": false,
      "network": {
        "address": "Workstation1.ehr.familyclinic.com",
        "type": "1"
      }
    }
  ],
  "source": {
    "site": "Cloud",
    "observer": {
      "identifier": {
        "value": "hl7connect.healthintersections.com.au"
      }
    },
    "type": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/security-source-type",
        "code": "3",
        "display": "Web Server"
      }
    ]
  }
}
Status code 201

AuditEvent API

Endpoint​

Required Client Credentials​

Sample Response

Endpoint

Required Client Credentials