Authorization
In order to be authorized to use the service in production the client must first be authenticated using HelseID
The service in the DEV environment is without authentication. See environments for an overview
There are two authentication channels:
| Channel | Authentication |
|---|---|
/api/personnel/... |
Personal HelseID login (DPoP token with personnel claims) |
/api/machine/... |
Machine HelseID token + identity headers, no personal login |
Both channels expose the same endpoints.
HelseID — personnel channel (/api/personnel/)
A DPoP token from HelseID is required for authorization of organization and health care personell. Bearer tokens will not be allowed.
Note that the EPJ system must provide the org. nr. of the actual work place (point of care) of the health care personell when requesting the access token. This will make sure that the request is connected to the correct organization.
Claims - required in access token to the API
The client must do a token refresh/exchange with HelseID to set correct audience and scope for this service.
| Claim | Description |
|---|---|
| scope | nhn:papla/api & offline_access |
| aud | nhn:papla |
| helseid://claims/client/claims/orgnr_parent | Org. nr. at the top level (legal entity). Required for all. |
| helseid://claims/client/claims/orgnr_child | Org. nr. at the lower level (point of care). For some organizations the same as orgnr_parent. Required for all. |
Claims documentation for HelseID can be found here.
Documentation on how to set organization nrs. as claims for a multi-tenant client can be found here.
Documentation to set single audience can be found here
Headers
| Name | Description | Required |
|---|---|---|
| Authorization: DPoP |
HelseID DPoP access token. | Yes |
| DPoP | DPoP proof. | Yes |
HelseID — machine channel (/api/machine/)
For machine-to-machine integrations that act on behalf of a health care personnel, but where no personal login is performed. A machine HelseID token (no personal login) is used, and the acting personnel is identified via request headers instead of token claims.
Claims - required in access token to the API
Only the organization claims are required — no personnel claims:
| Claim | Description |
|---|---|
| helseid://claims/client/claims/orgnr_parent | Org. nr. at the top level (legal entity). Required for all. |
| helseid://claims/client/claims/orgnr_child | Org. nr. at the lower level (point of care). For some organizations the same as orgnr_parent. Required for all. |
Headers
| Name | Description | Required |
|---|---|---|
| Authorization: DPoP |
Machine HelseID DPoP access token (no personal login). | Yes |
| DPoP | DPoP proof. | Yes |
| nhn-user-nin | NIN of the acting health care personnel. Must be a valid NIN (real or synthetic). | Yes |
| nhn-user-name | Display name of the acting health care personnel. | Yes |
| nhn-user-hpr | HPR number of the acting health care personnel. | No |
Requests missing nhn-user-nin or nhn-user-name are rejected with 401 Unauthorized.