Claims

This document references the Claims that HelseID will assign in a Token. Several of these Claim types have their origin in specifications, while others are defined according to the needs of the health sector in Norway.

Claims in Tokens

In a response to the Token Endpoint, HelseID issues two types of Token that contains Claims:

• An Access Token
• An ID Token

If the Client uses the client_credentials-flow, HelseID will only issue an Access Token.

If the Client uses the authorization_code-flow for user logon, HelseID will issue both an Access Token and an ID Token.

The ID Token is meant for the Client, the Access Token is meant for the API.

The Claims described below, will in most cases be placed in both types of Tokens.

Claims in the ID Token

Some Claims are always placed in the ID Token, others are only placed by HelseID when the Client sends scopes in the request that permits access to the Claims. These scopes are listed in the document Scopes.

Claims in the Access Token

Some Claims are always placed in the Access Token, others are only placed by HelseID when

1. the Client sends in scopes that gives access to an API, and
2. the API wants to use the claim in the Access Token

This implies that the Client cannot impact which Claims are placed in the Access Token, this is only decided by the Claims the API has chosen.

An example: the API "Siffer-tjeneste" requires the claims helseid://claims/identity/pid, helseid://claims/identity/security_level, helseid://claims/hpr/hpr_number, og helseid://claims/client/claims/orgnr_parent. The API has the audience nhn:siffer-tjeneste, and one scope: nhn:siffer-tjeneste/primtall.

If a Client has access to the API siffer-tjeneste, it can use the scope nhn:siffer-tjeneste/primtall in order to retrieve an Access Token for usage against this API. The API "Siffer-tjeneste" must then inspect the Access Token and use it for authorization purposes.

Claims from HelseID that describes a logged-on user

These Claim types describes the features of a logged-on user.

Claims from HelseID that describes a client

These Claim types describes the features of a client that has been authenticated by HelseID.

Standard claims

A token will also contain a set of standard claims originating from OpenID Connect and the JSON Web Token specification.

Claims from the OpenID Connect specification

These claims are obtained from the OpenID specification. You can find the description here. Some of the claims will only be set in the ID Token from HelseID.

Other claim types

Most of these claims are from the JWT specification. Some of these claims are only set in the Access Token from HelseID.