Building a FHIR API Gateway: What HAPI Won't Do for You

HAPI stores FHIR resources. It does not authenticate users, enforce access control, or generate correct URLs behind a load balancer. Here's what the gateway layer looks like — with the bugs we hit.