diff --git a/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/FHIRToolingClient.java b/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/FHIRToolingClient.java
index 4a9fdd588..558763932 100644
--- a/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/FHIRToolingClient.java
+++ b/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/FHIRToolingClient.java
@@ -362,10 +362,14 @@ public class FHIRToolingClient extends FHIRBaseToolingClient{
   }
 
   /**
-   * Helper method to prevent nesting of previously thrown EFhirClientExceptions
+   * Helper method to prevent nesting of previously thrown EFhirClientExceptions. If the e param is an instance of
+   * EFhirClientException, it will be rethrown. Otherwise, a new EFhirClientException will be thrown with e as the
+   * cause.
    *
-   * @param e
-   * @throws EFhirClientException
+
+   * @param message The EFhirClientException message.
+   * @param e The exception
+   * @throws EFhirClientException EFhirClientException representing the exception.
    */
   protected void handleException(String message, Exception e) throws EFhirClientException {
     if (e instanceof EFhirClientException) {
@@ -379,8 +383,8 @@ public class FHIRToolingClient extends FHIRBaseToolingClient{
    * Helper method to determine whether desired resource representation is Json or
    * XML.
    *
-   * @param format
-   * @return
+   * @param format the format
+   * @return true if the format is JSON, false otherwise
    */
   protected boolean isJson(String format) {
     boolean isJson = false;
diff --git a/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/network/FhirRequestBuilder.java b/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/network/FhirRequestBuilder.java
index b969a15c2..74a4c3354 100644
--- a/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/network/FhirRequestBuilder.java
+++ b/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/client/network/FhirRequestBuilder.java
@@ -51,7 +51,6 @@ public class FhirRequestBuilder {
   private ToolingClientLogger logger = null;
   private String source;
 
-  //TODO this should be the only constructor. There should be no okHttp exposure.
   public FhirRequestBuilder(HTTPRequest httpRequest, String source) {
     this.source = source;
     this.httpRequest = httpRequest;
diff --git a/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedFhirWebAccessor.java b/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedFhirWebAccessor.java
index 0ae20cfff..211c7ac98 100644
--- a/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedFhirWebAccessor.java
+++ b/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedFhirWebAccessor.java
@@ -126,10 +126,9 @@ public class ManagedFhirWebAccessor extends ManagedWebAccessorBase<ManagedFhirWe
         }
         OkHttpClient okHttpClient = getOkHttpClient();
         //TODO check and throw based on httpRequest:
-        // if (!ManagedWebAccess.inAllowedPaths(url)) {
-        //      throw new IOException("The pathname '"+url+"' cannot be accessed by policy");
-        // }
-        //TODO add auth headers to httpRequest
+
+        if (!ManagedWebAccess.inAllowedPaths(httpRequestWithDirectHeaders.getUrl().toString())) {
+              throw new IOException("The pathname '"+httpRequestWithDirectHeaders.getUrl().toString()+"' cannot be accessed by policy");}
         Response response = okHttpClient.newCall(requestBuilder.build()).execute();
         return getHTTPResult(response);
       case MANAGED: