# description
This Section describes the expected capabilities of the C4BB Server actor which is responsible for providing responses to the queries submitted by the C4BB Requestors. 

The EOB Resource is the focal Consumer-Directed Payer Data Exchange (CDPDE) Resource. Several Reference Resources are defined directly/indirectly from the EOB: Coverage, Patient, Organization (Payer ID), Practioner, and Organization (Facility).

The Coverage Reference Resource SHALL be returned with data that was effective as of the date of service of the claim; for example, the data will reflect the employer name in effect at that time. However, for other reference resources, payers MAY decide to provide either the data that was in effect as of the date of service or the current data. All reference resources within the EOB will have meta.lastUpdated flagged as must support. Payers SHALL provide the last time the data was updated or the date of creation in the payers system of record, whichever comes last. Apps will use the meta.lastUpdated values to determine if the reference resources are as of the current date or date of service.

# rest[].documentation
The C4BB  Server **SHALL**:

1. Support all profiles defined in this Implementation Guide..
1.  Implement the RESTful behavior according to the FHIR specification.
1. Return the following response classes:
   - (Status 400): invalid parameter
   - (Status 401/4xx): unauthorized request
   - (Status 403): insufficient scope
   - (Status 404): unknown resource
   - (Status 410): deleted resource.
1. Support json source formats for all CARIN-BB interactions.
1. Identify the CARIN-BB  profiles supported as part of the FHIR `meta.profile` attribute for each instance.
1. Support the searchParameters on each profile  individually and in combination.

The C4BB  Server **SHOULD**:

1. Support xml source formats for all C4BB interactions.

# rest[].security.description
1. See the [General Security Considerations](7_Authorization_Authentication_and_Registration.html) section for requirements and recommendations.
1. A server **SHALL** reject any unauthorized requests by returning an `HTTP 401` unauthorized response code.

# rest[].resource[].documentation
When an EOB references another resource (e.g., Patient or Practitioner), the reference may be versioned or versionless. Payers SHALL use versioned references whenever they maintain point-in-time data (data that was effective as of the date of service or date of admission on the claim), but MAY use versionless references when they do not maintain versioned data. Clients MAY request referenced resources as part of an EOB search (by supplying the _include parameter) or directly using read or vread. Payers SHALL support both approaches, and SHALL return the same content for referenced resources in either case. “:iterate" should be used if you request to include Coverage:payor in the EOB response bundle, e.g. GET [base]/ExplanationOfBenefit?[parameter=value]&_include=ExplanationOfBenefit:coverage&_include:iterate=Coverage:payor.

# rest[].resource[].interaction[].documentation
Searches using service-date, _lastUpdated, or type require a patient search argument.

_include:* SHALL be supported.