Claims

This document references the claims that HelseID will assign in a Token. Several of these claim types have their origin in specifications, while others are defined according to the needs of the health sector in Norway.

Claims in Tokens

In a response to the Token endpoint, HelseID issues two types of Token that contains claims:

An Access Token
An ID Token

If the Client uses the client_credentials-flow, HelseID will only issue an Access Token.

If the Client uses the authorization_code-flow for user login, HelseID will issue both an Access Token and an ID Token.

The ID Token is meant for the Client, the Access Token is meant for the API.

The claims described below, will in most cases be placed in both types of Tokens.

Claims in the ID Token

Some claims are always placed in the ID Token, others are only placed by HelseID when the Client sends scopes in the request that permits access to the claims. These scopes are listed in the document Scopes.

Claims in the Access Token

Some claims are always placed in the Access Token, others are only placed by HelseID when

the Client sends in scopes that gives access to an API, and
the API wants to use the claim in the Access Token

This implies that the Client cannot impact which claims are placed in the Access Token. The claims in the Access Token are only decided by what claims the API has chosen.

An example: the API "Siffer-tjeneste" requires the claims helseid://claims/identity/pid, helseid://claims/identity/security_level, helseid://claims/hpr/hpr_number, og helseid://claims/client/claims/orgnr_parent. The API has the audience nhn:siffer-tjeneste, and one scope: nhn:siffer-tjeneste/primtall.

If a Client has access to the API siffer-tjeneste, it can use the scope nhn:siffer-tjeneste/primtall in order to retrieve an Access Token for usage against this API. The API "Siffer-tjeneste" must then inspect the Access Token and use it for authorization purposes.

Claims from HelseID that describes a logged-in user

These claim types describes the features of a logged-in user.

Name	Example value	Description
`helseid://claims/identity/pid`	11737291652	Personal identifier (PID)
`helseid://claims/identity/security_level`	3	The security level for which the user was logged in. Possible values are 2, 3 or 4.
`helseid://claims/hpr/hpr_number`	181000001	The health personnel number according to NHN’s coding standard
`helseid://claims/identity/network`	helsenett	Indicates whether an end user authenticated using a HelseID server on Internet or ’Helsenett’. Note that local infrastructure may route users from Helsenett to HelseID nodes exposed on the Internet. Possible values are ’internett’ and ’helsenett’.

Claims from HelseID that describes a client

These claim types describes the features of a client that has been authenticated by HelseID.

Name	Example value	Description
`helseid://claims/client/client_name`	"Your client name here"	The name of the client configuration as setup in HelseID Selvbetjening. This value can be used for logging purposes in APIs, but should not be used to for access control.
`helseid://claims/client/claims/orgnr_parent`	883974832	The parent organization for an end user or a client.
`helseid://claims/client/claims/orgnr_child`	892262462	The child organization (underenhet/behandlingssted) for an end user or a client.
`helseid://claims/client/claims/orgnr_supplier`	994598759	For a multi-tenant system this is the organization that has received a delegation to access HelseID on behalf of an organization.
`helseid://claims/client/client_tenancy`	multi-tenant	Indicates the type of system that requested the access token. Can have one of the following values: `none`, `single-tenant`, or `multi-tenant`.
`client_amr`	private_key_jwt	The type of secret used for authenticating the client. Possible values are `client_secret` or `private_key_jwt`.
`nhn:tillitsrammeverk:parameters`	A JSON structure	An "attest" from the Client, enriched with extra information from HelseID.
`nhn:sfm:journal-id`	ed30a6a5-4834-40be-a32b-1e4f5217e378	A SFM-id, used by a multi-tenant Client

Standard claims

A token will also contain a set of standard claims originating from OpenID Connect and the JSON Web Token specification.

Claims from the OpenID Connect specification

These claims are obtained from the OpenID specification. You can find the description here. Some of the claims will only be set in the ID Token from HelseID.

Name	Example value	Description	Only in ID Token
`sub`	dXAUXjEAlVsoWcYVaR+fvzuXvnWQ7CYXqvr+DMuJ/0w=	Subject - Identifier for the End-User at the Issuer. The value is a hash of the PID + salt.
`amr`	[ "pwd" ]	Authentication Methods References. A JSON array of strings that are identifiers for the authentication methods used in the authentication.
`auth_time`	1704116220000	The time when the user was authenticated, described as "epoch time".
`client_id`	eeb808a2-6e6f-42ae-849a-505432cf128f	Identifies the Client by a unique number.
`sid`	0970F0ED60C552597BFC254150FA406D	Session ID
`name`	FORSIKTIG IMPULSIV HANDELSMANN	Full name of the logged-in user.
`given_name`	FORSIKTIG	The given name of the logged-in user.
`family_name`	HANDELSMANN	The family name of the logged-in user.
`middle_name`	IMPULSIV	The middle name of the logged-in user.
`nonce`	63849101571...WQ4OTI4MjVkNmU3	The nonce matches the parameter included in the original authorize request to the IDP.	X
`at_hash`	y9WtN9oBLG9q0J6NDbAHZQ	Access Token hash value	X
`s_hash`	5EpOYEdB22sp-7V9zGs4Bw	State hash value	X

Other claim types

Most of these claims are from the JWT specification. Some of these claims are only set in the Access Token from HelseID.

Name	Example value	Description	Only in Access Token
`iss`	`https://helseid-sts.test.nhn.no`	Issuer
`aud`	`nhn:melde`	Audience: The name of the audience for the token. In an Access Token, this will be the name of an API, and in an ID Token, this will be a Client ID.
`exp`	1495545339	Expiration time for the Token, described as "epoch time".
`nbf`	1495545039	Not before, the Token cannot be used before this time, described as "epoch time".
`iat`	1495545039	Issued at time, the Token was issued at this time, described as "epoch time".
`jti`	F4F832F0C68E24F0011F773B71CC6739	JWT ID - unique for each token issued by a specific provider within a given time period.
`idp`	`idporten-oidc`	The identity provider that authenticated the user.
`scope`	[ “openid”, “profile”, “read” ]	Authorization and identity scopes.	X
`cnf`	`{ "jkt": "aoezvIe32RdFpTP4FIxwBYb6VGX0dp3ecvoVjFkdXQk" }`	DPoP confirmation method, as described in the specification	X

Deprecated claims

These claims are still in use, but will be deprecated in the near future. We reccomend that you do not use any of these claims.

Name	Description
`helseid://claims/identity/assurance_level`	The security level for which the user was logged in. This claim is deprecated, you should use the `helseid://claims/identity/security_level` claim (see above) instead, as it contains the same value as this claim.
`helseid://claims/identity/pid_pseudonym`	Personal identifier pseudonymized with HMAC; this claim is deprecated, you should use the `sub` claim (see above) instead.