POST /cmd/GetAccessToken HTTP/1.1
Host: <FHIR_SERVICE_HOST>
Content-Type: application/json

{
  "header": {
    "version": "v0.1",
    "flag": 0
  },
  "body": {
    "seq": 0,
    "cmd": "",
    "token": "",
    "traceid": "",
    "client": {
      "platform": 0,
      "env": "",
      "isTourist": 0,
      "product": 0
    },
    "payload": {
      "timestamp": 1730000000000,
      "apiKey": "<API_KEY>",
      "signature": "<SIGNATURE>",
      "scopes": [],
      "context": {}
    }
  }
}

GET /INSTANCE_ID/fhir/Patient/199963 HTTP/1.1
Host: HOSTNAME
Authorization: Bearer <AccessToken>
Accept: application/fhir+json

message = apiKey + timestamp

signature = HMAC-SHA256(apiSecret, message)

Authorization: Bearer <AccessToken>

import hashlib
import hmac
import time
from typing import Optional

import requests


def sign(api_key: str, api_secret: str, sign_time: int) -> str:
    """签名

    Args:
        api_key: API密钥
        api_secret: API密钥对应的秘密
        sign_time: 签名时间（毫秒）

    Returns:
        签名字符串（大写十六进制）
    """
    message = f"{api_key}{sign_time}".encode("utf-8")
    h = hmac.new(api_secret.encode("utf-8"), message, hashlib.sha256)
    return h.hexdigest().upper()


# 校验签名逻辑（本地自测用）
def check_signature(api_key: str, api_secret: str, signature: str, sign_time: int, timeout: int) -> Optional[str]:
    """校验签名

    Args:
        api_key: API密钥
        api_secret: API密钥对应的秘密
        signature: 签名字符串
        sign_time: 签名时间（毫秒）
        timeout: 超时时间（毫秒）

    Returns:
        None表示校验通过，否则返回错误信息
    """
    now_time = int(time.time() * 1000)  # 当前时间（毫秒）

    if sign_time > now_time + timeout or sign_time < now_time - timeout:
        return "signTime is timed out"

    calculated_sign = sign(api_key, api_secret, sign_time)
    if signature.upper() != calculated_sign.upper():
        return "signature is invalid"

    return None


def request_auth_server(api_key: str, api_secret: str) -> Optional[str]:
    sign_time = int(time.time() * 1000)
    signature = sign(api_key, api_secret, sign_time)

    rsp = requests.post(
        # 将 <FHIR_SERVICE_HOST> 替换为实际鉴权服务访问域名
        url="https://<FHIR_SERVICE_HOST>/cmd/GetAccessToken",
        json={
            "header": {
                "version": "v0.1",
                "flag": 0,
            },
            "body": {
                "seq": 0,
                "cmd": "",
                "token": "",
                "traceid": "",
                "client": {
                    "platform": 0,
                    "env": "",
                    "isTourist": 0,
                    "product": 0,
                },
                "payload": {
                    "timestamp": sign_time,
                    "apiKey": api_key,
                    "signature": signature,
                    "scopes": [],
                    "context": {},
                },
            },
        },
        timeout=10,
    )

    if rsp.status_code != 200:
        return None

    data = rsp.json()
    if data.get("retcode", 0) != 0:
        return None

    payload = data.get("payload") or {}
    return payload.get("accessToken")


if __name__ == "__main__":
    key = "<KEY>"
    secret = "<SECRET>"
    token = request_auth_server(key, secret)
    print(token)

{
  "payload": {
    "accessToken": "<ACCESS_TOKEN>"
  }
}