# Server-side logic

**Portal version:** 0.1.0  
**Updated:** 2026-08-28  
**Source menu item:** Server-side logic  
**Availability:** Documented and testable

> The source contract and local workflow exist. Access still depends on the target hospital deployment and its policy gates.

Validate users and purpose on the partner server, call FHIR with server-held credentials, and verify events before side effects.

## What you can use now

- Use bounded request bodies, timeouts, idempotency, structured audit, and visible failure states.
- Return only the minimum data required by the embedded UI.

## Current limits

- The template demo patient endpoint is default-OFF and loopback-development only.

## Next step

Start with the [medOS Developer overview](/developers/platform/overview) and confirm the target hospital’s enabled contracts before production work.

## Canonical references

- [FHIR R4 integration](/integrations/fhir)
- [Public API](/backend/public-api)
- [Security and compliance](/architecture/security-and-compliance)
- [Developer portal status and coverage](/developers/platform/changelog)