# description
FHIR R5 capability statement for the PDHC Contract Manager. This server manages healthcare contracts as FHIR R5 Contract resources with JWT-authenticated admin CRUD and rate-limited public read access.

# rest[].documentation
RESTful FHIR R5 server with Contract CRUD support. Read endpoints are public and rate-limited to 100 requests/hour per IP. Write endpoints (create, update, delete) require a JWT Bearer token with admin role. User management is available under /admin/.

# rest[].resource[].documentation
FHIR R5 Contract resources representing healthcare agreements. Public read access with rate limiting. Admin-only create, update, and delete.

# rest[].resource[].interaction[].documentation
GET /fhir/Contract/{guid} — public, rate-limited

# rest[].resource[].interaction[].documentation
GET /fhir/Contract — returns Bundle searchset, public, rate-limited

# rest[].resource[].interaction[].documentation
POST /fhir/Contract — admin JWT required

# rest[].resource[].interaction[].documentation
PUT /fhir/Contract/{guid} — admin JWT required

# rest[].resource[].interaction[].documentation
DELETE /fhir/Contract/{guid} — admin JWT required, returns 204

# rest[].resource[].operation[].documentation
GET /fhir/Contract/{guid}/scope — Returns a lightweight scope + status descriptor for the contract (request_scope, return_scope, scope_defined, status). Public, rate-limited under READ_RATE_LIMIT.

# rest[].security.description
Authentication via POST /auth/login returns a JWT Bearer token (8-hour expiry). Include as Authorization: Bearer <token> on admin endpoints. Read endpoints are public. Roles: admin (full CRUD + user management), reader (read-only).

# title
PDHC Contract Manager — FHIR Capability Statement