Try to set IgnoreFailedAuth to true.

Alternative approach: create a user which has access only to schemas you need.

To check all parts of the request you can use this utility method which outputs all objects as a response. Just add this to any part of your code:

set %response.ContentType = "html"
do ##class(%CSP.Utils).DisplayAllObjects()
return $$$OK

Please contact WRC.

You need your own datatype, which implements method generators for Set, GetStored etc.

After that use your own datatype in your main class. Example.

In your REST Web Application settings, leave only pass (and remove group by id, if any):

After that check that UnknownUser does not have %ALL.

Finally try to access your REST url using Postman (or similar tool) and you should be able to see Login methind being executed.

Leave only password auth for the rest web app?

Are InterSystems Reports available on Ensemble, or only on Iris? (ie could we use InterSystems reports from the start?)

Only on IRIS.

Any other options for HL7 -> PDF generation?

Convert HL7 to FHIR and use The FHIR SQL Builder to make dataset available as a set of SQL Tables. Consume from InterSystems Reports.

You don't need to create a /login route since Login method is being called implicitly if auth is required.
To add logging, it's enough to redefine the Login method in your broker like this (##super docs):

ClassMethod Login(skipheader As %Boolean = 1) As %Status [ ProcedureBlock = 0 ]
{
    // do app-level logging
    quit ##super(skipheader)
}