We have a managers api (/api/managers/-/staff), which will get a list of staff that the currently logged in manager has been granted access to. It is the Managers service.
We also have a staff api (api/staff/[StaffGUID]/obs/sessions) that will get staff data. You have to be an authenticated manager to make a call to the staff api.
I want to make sure that Manager B could not call the staff api with a StaffGuid that they do not have access to.
My current thinking is that I want to call the Managers api from within the
staff/[StaffGUID]/obs/sessions endpoint to answer the question, "Does the currently authenticated manager have access to this patient?".
GET https://ourapi.com/api/v1/managers/-/staff/StaffGuid and then listen for a
403 or a
204. No content needed just a Status.