The UserInfo endpoint

The UserInfo endpoint can be used to retrieve claims about a user. See the specification for more details.

The UserInfo endpoint is available at the path connect/userinfo relative to the authority. For instance, the UserInfo endpoint in the test environment will look like this:

https://helseid-sts.test.nhn.no/connect/userinfo

The endpoint can be used both by a Client and by an API.

⚠️  Usage of the UserInfo endpoint

In most circumstances, the usage of this endpoint is not necessary, as the only specific information about the user it can issue, is the details regarding the user's authorization(s) in HPR (Helsepersonellregisteret). If this information is not required for the software, the use of Scopes will be sufficient both for Clients and APIs.

Requests to the UserInfo endpoint

The caller will need to send a valid Access Token in the request:

GET https://helseid-sts.nhn.no/connect/userinfo
Authorization: Bearer <access_token>

If your client uses a DPoP token, you can still use this as a Bearer token against the UserInfo endpoint.

In order to get a response back, the Access Token must contain either the helseid://scopes/hpr/hpr_number-scope or the helseid://claims/hpr/hpr_number-claim.

Response from the UserInfo endpoint

The response is structured as a JSON object. It will contain claims regarding the user. In particular, the helseid://claims/hpr/hpr_details claim will include extra details regarding the user's authorization(s) in HPR (Helsepersonellregisteret) if any such authorization is present.

The approvals list only contains the user's current approvals. Expired and suspended approvals are not included, and the response has no field for status or validity. If the user has no current approvals, the list is empty.

Example of a response:

{
    "helseid://claims/identity/pid": "06828399789",
    "helseid://claims/identity/security_level": "4",
    "helseid://claims/identity/assurance_level": "high",
    "helseid://claims/hpr/hpr_number": "565505933",
    "name": "KVART GREVLING",
    "given_name": "KVART",
    "middle_name": "",
    "family_name": "GREVLING",
    "helseid://claims/identity/network": "internett",
    "userinfo_issued_at": 1714715867,
    "helseid://claims/hpr/hpr_details": {
        "approvals": [
            {
                "profession": "LE",
                "authorization": {
                    "value": "1",
                    "description": "Autorisasjon"
                },
                "requisition_rights": [
                    {
                        "value": "1",
                        "description": "Full rekvisisjonsrett"
                    }
                ],
                "specialities": []
            }
        ],
        "hpr_number": 565505933
    },
    "sub": "PGzVzvP2JvlXV\u002B\u002BOJSJAQG5d99BH8QsikmxpdIAKSZk="
}

 If you are using the Test Token Service

The Test Token Service is only for the test environment, and if you need Access Tokens, the UserInfo endpoint will only respond for Access Tokens that belong to an active HelseID session. Tokens from the Test Token Service have no session and are rejected. An API that calls the UserInfo endpoint cannot therefore be tested with such tokens. A real login is required, for example via TestIDP.