PIT-API overview

Pasientinformasjonstjenesten (PIT) provides endpoints for submitting and retrieving patient information. Patient resources are represented using the FHIR standard, version R4.

Available environments

Access control

Accessing the PIT API requires clients to be authenticated using HelseID and DPoP (Demonstrating Proof-of-Possession):

1. Scope: Clients must request the appropriate scope (nhn:pit/api.read or nhn:pit/api.write).
2. Claim: Access token must include claim helseid://claims/client/claims/orgnr_parent.
3. DPoP required: Only requests including DPoP tokens are accepted.
4. Authorization header: Access token must be sent using the DPoP prefix (i.e., not Bearer).
5. DPoP-Proof: Requests must include a DPoP header with a signed proof generated by the client.

See HelseID Dokumentasjon - DPoP for implementation details.

Submitting patient resources

Patient resources are submitted by making POST requests to the Patient endpoint.

Endpoint format: POST /v1/Patient

A successful submission returns 202 Accepted. Processing is asynchronous — the resource is queued for internal processing after being accepted.

Retrieving patient resources

Patient resources are retrieved by making GET requests to the Patient endpoint.

Endpoint format: GET /v1/Patient

The response is a FHIR Bundle containing matching Patient resources.

Filtering

• _lastUpdated limits results based on when resources were last updated in PIT. Requires a prefix (gt, ge, lt, le) with at least minute precision. Example: ge2024-01-01T12:00Z.

Pagination

Keyset pagination (also known as seek pagination) limits the number of resources returned per request. An opaque cursor parameter is used to retrieve the next page of results. The response Bundle includes a next link containing the cursor value.

• _count controls the page size (1–50, default 20).
• _sort controls the sort order: _lastUpdated for ascending (default) or -_lastUpdated for descending.

Cursor constraints:

• Treat the cursor value as completely opaque — do not attempt to decode or modify it.
• Combining filter parameters (_lastUpdated) with a cursor is not allowed and will result in a 400 error.
• When a cursor is provided, the _sort parameter is ignored.

Pagination example

GET /v1/Patient?_count=10&_sort=-_lastUpdated

The response Bundle includes self and next link elements:

{
  "resourceType": "Bundle",
  "type": "searchset",
  "link": [
    {
      "relation": "self",
      "url": "https://api.pit.test.nhn.no/v1/Patient?_count=10&_sort=-_lastUpdated"
    },
    {
      "relation": "next",
      "url": "https://api.pit.test.nhn.no/v1/Patient?cursor=ZXlKTVlYTjB..."
    }
  ]
}

To fetch the next page, follow the next link via GET.