- What is virusphp/bridging-bpjs used for?
- It is a Laravel integration package for BPJS Kesehatan bridging APIs. It wraps VClaim V2 for membership eligibility, SEP issuance, referrals, reference data and monitoring, plus Antrol V2 for outpatient queue and booking. Its main value is hiding the V2 encrypted, LZ-String-compressed payload format behind Laravel configuration and service-provider wiring.
- How do I install virusphp/bridging-bpjs in Laravel?
- Install it with Composer using composer require virusphp/bridging-bpjs. Then publish the package config and set the VClaim consumerID, secretKey and userKey, plus separate Antrol credentials. The package should register through Laravel auto-discovery, but verify the published config keys before making your first sandbox request.
- Which BPJS Kesehatan APIs does this package cover?
- The package is positioned to cover VClaim V2 membership, SEP, referral, reference-data and monitoring groups, along with Antrol V2 outpatient queue and booking operations. The public description does not enumerate every endpoint, so confirm the exact endpoint groups and Antrol operations in the source or with the maintainer. Treat endpoint coverage as something to validate in a sandbox rather than assume from the package name.
- How does the VClaim V2 encryption and LZ-String compression work?
- VClaim V2 payloads are encrypted, compressed with an LZ-String implementation, then transported to BPJS. The package hides this handshake, including per-request key derivation from a timestamp and secret key, behind its client. LZ-String originated in JavaScript, so validate the PHP port's output on Unicode and emoji-bearing payloads against BPJS's reference implementation. Clock skew can also break derived keys, so keep servers synchronized with NTP.
- Does it support Laravel 9, 10 and 11 with PHP 8.1+?
- The package is assessed as a natural fit for Laravel 10 or 11 and PHP 8.1+ with ext-openssl and ext-json, which also works in standard queue workers and scheduled commands. The provided context does not publish a clear Laravel version support window, so check composer.json constraints before upgrading. Test on your exact Laravel and PHP versions, especially if you rely on HTTP client fakes in your test suite.
- How do I configure VClaim and Antrol credentials?
- Publish the config file and set the VClaim consumerID, secretKey and userKey, plus separate Antrol credentials. Credentials are described as config-driven, and there is no confirmed path to a secrets manager in the provided material. Avoid committing real BPJS credentials to source control and inject them through environment variables or your platform's secret store. Budget calendar time for BPJS kantor cabang credential provisioning, often with a staging environment first.
- Can I use this package outside Laravel?
- It is a Laravel-style package, so non-Laravel or service-oriented PHP stacks are a poorer fit. You can potentially lift the crypto, compression and HTTP client layers out, but expect to discard the service provider and config glue. For those stacks, an in-house client validated against BPJS's reference implementation may be cleaner.
- How should I handle SEP creation and Antrol booking retries?
- SEP creation and Antrol booking are the operations where a retry can create a duplicate. The provided material does not document idempotency guidance, so add your own safeguards at the application layer. Use idempotency keys or a local request ledger, and make queue jobs explicitly retry-safe. Confirm BPJS response codes and duplicate handling in a sandbox before production.
- Does the package log PHI or national ID numbers?
- The provided material does not confirm whether the package logs request and response bodies, which could persist national ID numbers and diagnoses. Under Indonesia's UU PDP, that would be a reportable-incident risk rather than a code-style nit. Disable or redact body logging, review Laravel HTTP client middleware, and test what actually reaches your log files. Treat PHI handling as an explicit configuration and code-review item.
- Is virusphp/bridging-bpjs maintained, and what are the alternatives?
- The package has a single apparent maintainer, a small community and no published SLA, so BPJS contract changes may outpace updates. Wrap calls behind your own interface so swapping to an in-house client during a breaking change is not a controller refactor under incident pressure. Pin versions, monitor the repository and keep contract tests against a BPJS sandbox. Alternatives are sparse; an in-house client or another maintained BPJS bridge are the realistic fallbacks.