--- title: 2. Create a Basic Resource slug: guides/2-create-a-basic-resource docTags: createdAt: 2024-04-12T19:39:41.270Z --- :::hint{type="info"} 🌟 **Key Concept: **A [Resource](docId:3nrQijF-dQK8pQ_bJkqH2) is a piece of digital content that's accessible over the web. Resources can vary in complexity from a simple email address to more complex content such as web pages and healthcare data. ::: **This example setup demonstrates how to create a basic Resource using the IDENTOS Authorization Server.** `TODO: Add overview diagram with step emphasized.` This setup will use a fake Resource that... *TODO: Introduce example.* *Introspection?* ## Prerequisites - You've created the example Resource Server outlined in [1. Create a Basic Resource Server](docId:43VMG-opG9QS9umQ0_J8t). ## Step-by-Step Setup **To create a Resource in the Authorization Server, we need to:** 1. **Define basic scopes** (permissions such as `read`, `write`, etc.) in the Authorization Server (if not already defined). 2. **Create a Resource Definition** in the Authorization Server and specify what scope(s) can be used to access it. 3. **Create a Resource** in the Authorization Server that corresponds to an actual Resource in the Resource Server. For our example, we'll assume that our Resource Server is already populated with Resources (patient records containing blood glucose levels). For the Authorization Server to `read` the blood glucose levels, we'll need to define the `read` scope **(1)**, create the `blood-glucose-level` Resource Definition **(2)**, and create a Resource representing an actual blood glucose level stored in the Resource Server **(3)**. :::hint{type="info"} For a full explanation of each operation and its parameters, see [Create a Resource](docId\:soqSECQwnOeZFVZFzddhy). ::: ::::WorkflowBlock :::WorkflowBlockItem ### Define Scopes Run the Admin API call below to add the `read` scope and `write` scopes to the Authorization Server's `scope` database. Since these are the first scopes in our Authorization Server, the `read` scope will be `id = 1` in the `scope` database, and the `write` scope will be `id = 2`. ```curl curl --location -g --request PATCH '{{AS_ADMIN_URI}}' \ --header 'Content-Type: application/vnd.api+json; ext=jsonpatch' \ --header 'Authorization: {{AS_ADMIN_STATIC_TOKEN}}' \ --header 'ApiVersion: v1.0' \ --header 'Accept-Language: en' \ --data-raw '[ { "op": "add", "path": "/scope", "value": { "type": "scope", "id": 1, "attributes": { "description": "Read value", "name": "read", "iconUri": null, "dType": "Scope" } } }, { "op": "add", "path": "/scope", "value": { "type": "scope", "id": 2, "attributes": { "description": "Write value", "name": "write", "iconUri": null, "dType": "Scope" } } }, ]' ``` ::: :::WorkflowBlockItem ### Create a Resource Definition Run the Admin API call below to add the `blood-glucose-level` Resource Definition to the Authorization Server's `resource-definition` database, and allow Resources of this type to be accessed with both the `read` scope (`id = 1`) and `write` scope (`id = 2`). Since `blood-glucose-level` is the first Resource Definition in the Authorization Server, it will be `id = 1` in the `resource-definition` database. ```curl curl --location -g --request PATCH '{{AS_ADMIN_URI}}' \ --header 'Content-Type: application/vnd.api+json; ext=jsonpatch' \ --header 'Authorization: {{AS_ADMIN_STATIC_TOKEN}}' \ --header 'ApiVersion: v1.0' \ --header 'Accept-Language: en' \ --data-raw '[ { "op": "add", "path": "/resource-definition", "value": { "type": "resource-definition", "id": 1, "attributes": { "maxPermissionDuration": 3000000000, "name": "Blood glucose level", "resourceId": "blood-glucose-level", "type": "https://www.identos.com/resource-definitions/blood-glucose-level", "description": "The blood glucose level (mmol/L) of a patient." }, "relationships": { "scopes": { "data": [ { "id": 1, "type": "scope" }, { "id": 2, "type": "scope" } ] } } } }, ]' ``` ::: :::WorkflowBlockItem ### Create a Resource Run the Admin API call below to add the `bg1_patient-rs` Resource located at `https://patient-rs.fakehospital.com/resource/patient-record` to the Authorization Server's `resource` database, and make it so that this particular Resource can **only** be accessed with the `read` scope (`id = 1`). We'll also need to associate it with the `blood-glucose-level` Resource Definition (`id = 1`) and the `Patient Resource Server` Resource Server (`id = 1`). ```curl curl --location -g --request PATCH '{{AS_ADMIN_URI}}' \ --header 'Content-Type: application/vnd.api+json; ext=jsonpatch' \ --header 'Authorization: {{AS_ADMIN_STATIC_TOKEN}}' \ --header 'ApiVersion: v1.0' \ --header 'Accept-Language: en' \ --data-raw '[ { "op": "add", "path": "/resource", "value": { "type": "resource", "id": 1, "attributes": { "maxPermissionDuration": 3000000000, "resourceId": "bg1_patient-rs", "resourceLocation": "https://patient-rs.fakehospital.com/resource/patient-record" }, "relationships": { "allowedScopes": { "data": [ { "id": 1, "type": "scope" }, ] }, "resourceDefinition": { "data": { "id": 1, "type": "resource-definition" } }, "resourceServer": { "data": { "id": 1, "type": "resource-server" } } } } } ]' ``` ::: :::WorkflowBlockItem ### View the Resource (Optional) Now run the API call below to view the Resource in the Authorization Server. ```curl curl --location -g --request GET '{{AS_ADMIN_URI}}/resource/1' \ --header 'Content-Type: application/vnd.api+json' \ --header 'ApiVersion: v1.0' \ --header 'Authorization: {{AS_ADMIN_STATIC_TOKEN}}' \ --header 'Accept-Language: en' ``` ::: :::: :::hint{type="success"} ## Next Steps **✅ You just created a basic Resource in the Authorization Server! ** - **Next step: **Proceed to [3. Create a Basic Client](docId\:pMynCndy11XUp3aFhp7-8) to learn how to define a Client with permissions for accessing the basic Resource you created. - **Learn more: **Read the [Create a Resource](docId\:soqSECQwnOeZFVZFzddhy) guide to learn more about creating, updating, and deleting resources in the Authorization Server :::