{ "schema": "varexis-index-free-publication-preview/1", "catalogue_version": "pub-8-tranche-58-v1", "route_id": "agentic_reviewed_fhir_audit_query_format_context", "record_id": "VXI-EXT-ADMINISTRATION-FHIR-AUDIT-QUERY-FORMAT-CONTEXT-01-v1", "question": "Can an auditor interpret a FHIR AuditEvent query blob without its originating query format?", "answer": "R5 AuditEvent.entity.query stores query input in a base64 container whose meaning depends on the originating event and query format. An audit consumer must understand that format before interpreting it. The encoding does not make the query self-describing or establish that its contents are safe for unrestricted disclosure.", "records": [ { "record_id": "VXI-EXT-ADMINISTRATION-FHIR-AUDIT-QUERY-FORMAT-CONTEXT-01-v1", "url": "/varexis-index/records/fhir-audit-query-format-context.json", "content_sha256": "cba4c06f33ad9ef67589015be8266345790885b1e406324b55cb733e688c6312", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-25T00:44:04.075Z", "record_id": "VXI-EXT-ADMINISTRATION-FHIR-AUDIT-QUERY-FORMAT-CONTEXT-01-v1", "record_kind": "external_reference", "title": "FHIR R5 query decoding context", "system": "HL7 FHIR R5 5.0.0 — auditevent", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can an auditor interpret a FHIR AuditEvent query blob without its originating query format?", "near_questions": [ "Can an AuditEvent query blob be interpreted without its query language?", "What context is needed to decode FHIR audit queries?", "Does base64 make an audit query safe to publish?", "Why must an auditor retain the originating query format?" ], "supported_claims": [ { "claim": "R5 AuditEvent.entity.query stores query input in a base64 container whose meaning depends on the originating event and query format. An audit consumer must understand that format before interpreting it. The encoding does not make the query self-describing or establish that its contents are safe for unrestricted disclosure.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "No clinical advice, patient-safety validation, legal compliance or confirmation of insurance cover.", "No independent proof of a live access decision, completed workflow, physical action or settled payment.", "The published R5 definition does not establish support or conformance in a buyer implementation.", "Buyer deployment testing, live runtime enforcement, certification or permission to act", "Expanded capabilities or licences for existing INDEX executables" ], "public_summary": "R5 AuditEvent.entity.query stores query input in a base64 container whose meaning depends on the originating event and query format. An audit consumer must understand that format before interpreting it. The encoding does not make the query self-describing or establish that its contents are safe for unrestricted disclosure.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "HL7 FHIR R5 5.0.0 — auditevent definitions", "source_url": "https://hl7.org/fhir/R5/auditevent-definitions.html", "checked_on": "2026-10-25", "candidate_record_id": "VXI-EXT-ADMINISTRATION-FHIR-AUDIT-QUERY-FORMAT-CONTEXT-01-v1", "candidate_record_sha256": "f86f7624c5c131432db5fe4d871e6d7a77e661b080ecfa9bc0eb045635a944bd", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "R5 AuditEvent.entity.query stores query input in a base64 container whose meaning depends on the originating event and query format. An audit consumer must understand that format before interpreting it. The encoding does not make the query self-describing or establish that its contents are safe for unrestricted disclosure.", "required_buyer_context": "Event type and entity role; Originating query format; Approved handling scope for the decoded content. Buyer deployment not inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-25", "claim_to_check": "Can an auditor interpret a FHIR AuditEvent query blob without its originating query format?", "documented_statement": { "status": "documented", "statement": "R5 AuditEvent.entity.query stores query input in a base64 container whose meaning depends on the originating event and query format. An audit consumer must understand that format before interpreting it. The encoding does not make the query self-describing or establish that its contents are safe for unrestricted disclosure.", "source_ids": [ "fhir-auditevent-definitions" ] }, "review_inference": { "status": "review_inference", "statement": "Retain the interpretation context for an encoded audit query. This is a documentation-review judgment, not an observed outcome.", "source_ids": [ "fhir-auditevent-definitions" ] }, "buyer_evidence_required": [ "Event type and entity role", "Originating query format", "Approved handling scope for the decoded content" ], "review_condition": { "status": "varexis_review_policy", "statement": "Refuse semantic interpretation or unrestricted disclosure justified only by base64 encoding." }, "unknowns": "The applicable implementation guide, live system and actual administrative outcome were not inspected.", "unknown_finding": { "status": "unknown", "statement": "The applicable implementation guide, live system and actual administrative outcome were not inspected." }, "evidence_sources": [ { "source_id": "fhir-auditevent-definitions", "url": "https://hl7.org/fhir/R5/auditevent-definitions.html", "final_url": "https://hl7.org/fhir/R5/auditevent-definitions.html", "status": 200, "captured_at_utc": "2026-10-25T00:21:09.777Z", "sha256": "577ea4432c9dbed44f65f64e26a03b8e2b7adb5b22c66934c134cfb7d61e45e0", "bytes": 54989, "title": "HL7 FHIR R5 5.0.0 — auditevent definitions", "hash_basis": "SHA-256 of unmodified HTTP response body bytes", "rights_review": "Original factual paraphrase of the HL7 FHIR core specification under CC0. Third-party terminology and trademarks have separate terms; no document, schema, code or modified standard is redistributed. No endorsement or patient data.", "checked_on": "2026-10-25", "capture_status": 200, "claim_review_completed": true, "reviewed_sections": [ "AuditEvent.outcome", "AuditEvent.agent.requestor", "AuditEvent.occurred[x]; AuditEvent.recorded", "AuditEvent.entity.query" ], "version_context": "Permanent FHIR R5 5.0.0 publication. Resource-specific maturity and normative/Trial Use status apply; no universal normative or implementation-conformance claim." } ], "observed_deployment": false, "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.", "paid_value": { "decision_context": "Retain the interpretation context for an encoded audit query.", "free": "Complete review, sources, practical questions and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Recheck the applicable FHIR version, implementation guide, resource profile and independent administrative outcome before relying on a current workflow." }, "buyer_relevance": "Retain the interpretation context for an encoded audit query.", "refusal_conditions": [ "Refuse semantic interpretation or unrestricted disclosure justified only by base64 encoding." ] }, "niche": { "niche_id": "agent-authority-action-evidence", "label": "Agent Authority & Action Evidence", "classification_id": "audit", "classification_label": "Audit, Provenance & Evidence Accountability", "topic_id": "audit", "buyer_intent": "Retain the interpretation context for an encoded audit query.", "comparison_role": "supplementary_discovery" }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#fhir-audit-query-format-context", "machine_readable_record": "/varexis-index/records/fhir-audit-query-format-context.json" } } ], "access": { "mode": "exact_http_only", "payment_required": false, "purchase_url": null, "mcp_preview_available": false, "paid_saved_retrieval_available": false, "natural_language_search_qualified": false }, "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.", "content_sha256": "b52ef8b56570b362bc359f5ca2aab31da2b262d3b38e88006a1e546de14f5b2f" }