Tenants and feature settings | HIS User documentation

A tenant is ICAP's top-level boundary for data ownership, configuration, and authorization. Identities, visits, credentials, access units, PACS records, roles, and custom field definitions belong to exactly one tenant.

View and manage tenant settings

The tenant base path is /icap/v1/tenant/{tenantId}. Feature and statistics paths below are relative to that base.

Operation	Path	Required permission
Read the tenant	`GET /icap/v1/tenant/{tenantId}`	`TenantGet`
Update tenant settings	`PATCH /icap/v1/tenant/{tenantId}`	`TenantUpdate`
Read feature settings	`GET /features`	`TenantFeaturesGet`
Update feature settings	`PATCH /features`	`TenantFeaturesUpdate`
Read usage statistics	`GET /statistics`	`TenantStatisticsGet`

Tenant configuration

The following table covers the tenant configuration exposed by the supplied OpenAPI contract.

Setting	Registration	Later update	Behavior
`name`	Required	Yes	The tenant display name.
`traceLogLevel`	Optional	Yes	Controls the tenant trace-log level. Set it to `null` to use the service default; supported values are `Trace`, `Debug`, `Information`, `Warning`, `Error`, `Critical`, and `None`.
`pacsIntegrationEnabled`	Optional	Yes	Enables or disables PACS integration for the tenant. Enabling verifies that AIS can retrieve the same tenant, so the ICAP and AIS tenants must be connected first; see Connect your ICAP tenant to AIS. Disabling it does not remove existing PACS configuration or perform cleanup. See PACS integration.
`personalSharing.allowedInboundTenants`	Optional	Yes	Allowlist of source tenants from which this tenant may accept internal personal-data shares.
`personalSharing.allowedOutboundTenants`	Optional	Yes	Allowlist of target tenants to which this tenant may initiate identity or visitor shares. See personal data sharing.

Feature configuration

Feature configuration is a separate tenant configuration object: it is not included in the tenant resource and cannot be changed at registration or with the tenant PATCH. Use GET /features to read it and PATCH /features to update it. GET /features requires TenantFeaturesGet permission; PATCH /features requires TenantFeaturesUpdate permission which is available only for TenantRegistrator and SystemAdministrator predefined roles.

As a tenant, you cannot change the /features config. To modify the /features config, contact the HIS administrator.

Setting	Update	Behavior
`remotePhotoEnabled`	Yes	When explicitly `true`, permits new identity and visitor remote-photo requests. It does not prevent reads, deletions, or processing of existing requests.
`remotePhotoCardholderGroup`	Yes	Optional cardholder group passed to the Remote Photo service. When absent, the service default group is used.
`payloadLogEnabled`	Yes	When explicitly `true`, enables tenant payload logging, subject to the service's excluded-path handling.
`payloadLogPlaintext`	Yes	When explicitly `true`, enables plaintext tenant payload logging. The contract does not enforce a dependency on `payloadLogEnabled`.

Feature availability may depend on deployment and entitlement, so applications should read the current configuration rather than hard-code assumptions.

Review feature-setting risk

Treat payload logging as a security and privacy decision. Enabling payloadLogEnabled can increase the amount of request or response data retained in operational logs.
Restrict either setting to a small administrative role and review its value after a troubleshooting window closes.

For remote photos, confirm who is eligible through remotePhotoCardholderGroup, whether the tenant is entitled to use the feature, and what privacy policy governs the returned images before enabling remotePhotoEnabled. The supplied contract names these settings but does not specify their deployment-specific retention, entitlement, or group-resolution behavior; obtain those details from the platform administrator.

Health and statistics

GET /health is a tenant-scoped health check suitable for operational monitoring.
GET /statistics provides tenant statistics and accepts year and month query parameters.

Use these endpoints for operational visibility alongside application-level monitoring of downstream PACS transactions.

Tenant isolation

The tenant ID in the request path is both a data and authorization boundary. Do not use an ID returned from one tenant in a request to another tenant, and do not treat a shared person as cross-tenant ownership. See personal data sharing.

Updates to the tenant and feature settings use optimistic concurrency. For routes and schemas, see Tenant and health and the direct OpenAPI contract.