# Consent Service: Java API

To use the Consent Service Java API, you must provide an implementation of the [IConsentService](/content/hapi-fhir/apidocs/hapi-fhir-server/ca/uhn/fhir/rest/server/interceptor/consent/IConsentService.html) interface, as described in the HAPI FHIR [ConsentInterceptor](/content/hapi-fhir/docs/security/consent_interceptor.html) documentation.

Consent Service implementation classes may access details about the request context from the [RequestDetails](/content/hapi-fhir/apidocs/hapi-fhir-server/ca/uhn/fhir/rest/api/server/RequestDetails.html) object, using the attributes described in [Security Attributes](/content/docs/java_execution_environment/security_attributes.html).

# Example

The following example shows a Java consent service implementation.

A complete project containing this example is available in the [Interceptor Starter Project](/content/docs/interceptors/starter_project.html).

```java
/*-
 * #%L
 * Smile CDR - CDR
 * %%
 * Copyright (C) 2016 - 2026 Smile CDR, Inc.
 * %%
 * All rights reserved.
 * #L%
 */
package com.smilecdr.demo.consent;

import ca.cdr.api.security.ApprovedScopesUtil;
import ca.uhn.fhir.rest.api.server.RequestDetails;
import ca.uhn.fhir.rest.server.interceptor.consent.ConsentOutcome;
import ca.uhn.fhir.rest.server.interceptor.consent.IConsentContextServices;
import ca.uhn.fhir.rest.server.interceptor.consent.IConsentService;
import org.hl7.fhir.instance.model.api.IBaseResource;
import org.hl7.fhir.r4.model.Observation;

import java.util.Set;

/**
 * This class is an example of a Java Consent Service implementation.
 * <p>
 * This consent service tests whether the client session has the
 * approved scope "observation_view_covid19", and filters Observation
 * resources matching the LOINC code "94767-1" if not.
 */
public class ScopeDrivenConsentService implements IConsentService {

@Override
   public ConsentOutcome canSeeResource(
         RequestDetails theRequestDetails, IBaseResource theResource, IConsentContextServices theContextServices) {

// This example consent service only cares about resources of type
      // Observation, so accept any others automatically. For separation
      // of concerns, you might choose to add additional consent service
      // implementations that handle other resource types, or you could
      // add additional logic here.
      if (!(theResource instanceof Observation)) {
         return ConsentOutcome.PROCEED;
      }

Observation obs = (Observation) theResource;
      String resourceSystem = obs.getCode().getCodingFirstRep().getSystem();
      String resourceCode = obs.getCode().getCodingFirstRep().getCode();

// Any non-LOINC coded Observations will be filtered out
      if (!"http://loinc.org".equals(resourceSystem)) {
         return ConsentOutcome.REJECT;
      }

// The LOINC code 94767-1 corresponds to a SARS-COV-2 Serum/Plasma test. Unless the session
      // has an appropriate scope approved, we'll filter this result.
      if (resourceCode.equals("94767-1")) {
         Set<String> approvedScopes = ApprovedScopesUtil.getApprovedScopes(theRequestDetails);
         if (!approvedScopes.contains("observation_view_covid19")) {
            return ConsentOutcome.REJECT;
         }
      }

// Any other resources are authorized, meaning that the client will get
      // to see the resources, and consentWillSeeResource(...) is not called. This
      // is good for performance but means that no filtering can take place.
      return ConsentOutcome.PROCEED;
   }
}
```

Copy

[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)

Consent Service: Java API

Security

[Authentication Protocols](/content/docs/security/authentication_protocols.html)
[Authorization and Consent](/content/docs/security/authorization_and_consent.html)
[Inbound Security Module](/content/docs/security/inbound_security_module.html)
[Local Inbound Security Module](/content/docs/security/local_inbound_security_module.html)
[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)
[Scripted Inbound Security Module](/content/docs/security/script_inbound_security_module.html)
[SAML Inbound Security Module](/content/docs/security/saml_inbound_security_module.html)
[Trusted Client Mode](/content/docs/security/trusted_client_mode.html)
[Roles and Permissions](/content/docs/security/roles_and_permissions.html)
[Callback Scripts](/content/docs/security/callback_scripts.html)
[Anonymous Access](/content/docs/security/anonymous_access.html)
[Consent Service](/content/docs/security/consent_service.html)
[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)
[Consent Service: Java API](/content/docs/security/consent_service_java.html)
[Security Recipes](/content/docs/security/security_recipes.html)
[Two Factor Authentication](/content/docs/security/two_factor_auth.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)
[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)
[Troubleshooting Security](/content/docs/security/troubleshooting_security.html)

[Security Recipes](/content/docs/security/security_recipes.html)