openapi: 3.0.0 info: description: "\n
\n
\n
\n
\n \n \"\"\n \n
\n
\n
\n
\n

This API forms part of the  Booking and Referral Standard (BaRS).
This API specification should be used in conjunction with the BaRS implementation guide for your use case.

\n
\n
\n
\n
\n\n## Overview\n\n![BaRS FHIR API end-to-end process](https://raw.githubusercontent.com/NHSDigital/booking-and-referral-fhir-api/master/specification/images/BaRS-FHIR-API.svg)\n\nUse this API to send booking and referral information between NHS service providers.\n\nYou can:\n * get a specific booking\n * get bookings for a patient\n * process a message, either a booking or a referral\n * get message definition\n * get capability statement\n * get a specific referral\n * get referrals for a patient\n * get slots\n\nThe following describes the end-to-end process:\n1. Send a request from your sender application to this API, along with a service identifier header.\n2. This API redirects the request to the service associated with the service identifier header.\n3. The target backend handles the request and sends a response back to this API.\n4. This API returns the response to your sender application.\n5. In some [Applications](https://simplifier.net/guide/nhsbookingandreferralstandard/home/design/bars-applications) the target may send a follow up request to indicate the outcome of a request.\n\n
\n
\n
\n
\n \n \"\"\n \n
\n
\n
\n
\n

For a non-technical overview of how to build software that deals with referrals and bookings, see Building healthcare software - referrals and bookings.

\n
\n
\n
\n
\n\n## Who can use this API\nThis API can only be used for the Booking and Referral Standard where there is a legal basis to do so. Make sure you have a valid use case before you go too far with your development. We'll ask you to demonstrate this as part of the digital onboarding process before your software goes live.\n\n## Related APIs\nThe following APIs are related to this API:\n * This API replaces the [NHS Booking - FHIR API](https://digital.nhs.uk/developer/api-catalogue/nhs-booking-fhir)\n\n## API status and roadmap\nThis version of the API is in [Production](https://digital.nhs.uk/developer/guides-and-documentation/reference-guide#statuses), meaning:\n * it is available for testing in the integration environment\n * it has availability in production \n * it is NOT subject to breaking changes\n\nTo see our roadmap, or to suggest, comment or vote on features for this API, see our [interactive product backlog](https://nhs-digital-api-management.featureupvote.com/?order=popular&filter=allexceptdone&tag=booking-and-referral&deleted=0#controls).\nIf you have any other queries, please [contact us](https://digital.nhs.uk/developer/help-and-support).\n\n## Service level\nThis API is a platinum service, meaning it is operational and supported 24 x 7 x 365.\n\nFor more details, see [service levels](https://digital.nhs.uk/developer/guides-and-documentation/reference-guide#service-levels).\n\n## Technology\nThis API is [RESTful](https://digital.nhs.uk/developer/guides-and-documentation/our-api-technologies#basic-rest) and uses HTTP POST to submit data.\n\nIt conforms to the [FHIR](https://digital.nhs.uk/developer/guides-and-documentation/our-api-technologies#fhir) global standard for health care data exchange, specifically to [FHIR R4 (v4.0.1)](https://hl7.org/fhir/r4/).\n\nIt includes:\n * country-specific FHIR extensions, which are built against [FHIR UK Core](https://digital.nhs.uk/services/fhir-uk-core), specifically [fhir.r4.ukcore.stu1 0.5.1](https://simplifier.net/packages/fhir.r4.ukcore.stu1/0.5.1)\n * BaRS-specific FHIR extensions and ammendments, documented in the [BaRS FHIR project](https://simplifier.net/NHSBookingandReferrals)\n\n## Network access\nThis API is available on the internet and also indirectly via HSCN.\n\nFor more details, see [Network access for APIs](https://digital.nhs.uk/developer/guides-and-documentation/network-access-for-apis).\n\n## Security and authorisation\n\nThis API is [application-restricted](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation#application-restricted-apis),\nmeaning we authenticate the calling application but not the end user.\n\nTo use this access mode, use the following security pattern:\n* [application-restricted RESTful API - signed JWT authentication](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/application-restricted-restful-apis-signed-jwt-authentication)\n\nFor more details, see [BaRS Core - Security and authorisation](https://simplifier.net/guide/nhsbookingandreferralstandard/home/design/bars-core#Security-and-authorisation).\n\n## Errors\nWe use standard HTTP status codes to show whether an API request succeeded or not. They are usually in the range:\n\n* 200 to 299 if it succeeded, including code 202 if it was accepted by an API that needs to wait for further action\n* 400 to 499 if it failed because of a client error by your application\n* 500 to 599 if it failed because of an error on our server\n\nExample errors specific to each API are shown in the endpoints section, under Response. See the BaRS Core [Error Handling section](https://simplifier.net/guide/nhsbookingandreferralstandard/home/design/bars-core#core-ErrorHandling) for further information on error handling within the BaRS Standard.\n\n\n## Environments and testing\n| Environment | Base URL |\n| ----------------- | ---------------------------------------------------------------------- |\n| Sandbox | `https://sandbox.api.service.nhs.uk/booking-and-referral/FHIR/R4` | \n| Integration test | `https://int.api.service.nhs.uk/booking-and-referral/FHIR/R4` |\n| Production | `https://api.service.nhs.uk/booking-and-referral/FHIR/R4` |\n\nOur [sandbox environment](https://digital.nhs.uk/developer/guides-and-documentation/testing#sandbox-testing) is for early developer testing and covers a limited number of scenarios with predefined responses. Please not this environment is stateless.\n\nOur [integration test environment](https://digital.nhs.uk/developer/guides-and-documentation/testing#integration-testing) is for formal integration testing.\n\nFor more details see [integration testing with our RESTful APIs](https://digital.nhs.uk/developer/guides-and-documentation/testing#integration-testing-with-our-restful-apis).\n\n## Onboarding\nYou need to get your software approved by us before it can go live with this API. We call this onboarding. The onboarding process can sometimes be quite long, so it`s worth planning well ahead.\n\nAs part of this process, you need to demonstrate that you can manage risks and that your software conforms technically with the requirements for this API.\n\nInformation on this page might impact the design of your software. For details, see [Onboarding support information](https://digital.nhs.uk/developer/api-catalogue/booking-and-referral-fhir/onboarding-support-information).\n\nTo understand how our online digital onboarding process works, see [digital onboarding](https://digital.nhs.uk/developer/guides-and-documentation/digital-onboarding).\n\n
\n
\n
\n
\n \n \"\"\n \n
\n
\n
\n

To get started, sign in or create a developer account, then select 'product onboarding'.

\n
\n
\n
\n" version: 1.0.0 title: and Referral Booking Metadata API termsOfService: https://developer.nhs.uk/apis/uec-appointments contact: email: uec.appointmentbooking@nhs.net url: https://developer.nhs.uk/apis/uec-appointments name: NHS Digital license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://sandbox.api.service.nhs.uk/booking-and-referral/FHIR/R4 description: Sandbox Server - url: https://int.api.service.nhs.uk/booking-and-referral/FHIR/R4 description: Production - url: https://api.service.nhs.uk/booking-and-referral/FHIR/R4 description: Integration Server security: - OAuth_Token: [] tags: - name: Metadata paths: /metadata: parameters: - $ref: '#/components/parameters/RequestId_HParam' - $ref: '#/components/parameters/CorrelationId_HParam' - $ref: '#/components/parameters/TargetIdentifierMeta_HParam' - $ref: '#/components/parameters/RequestingOrganisation_HParam' - $ref: '#/components/parameters/RequestingPractitioner_HParam' - $ref: '#/components/parameters/RequestingDevice_HParam' - $ref: '#/components/parameters/Accept_HParam' get: tags: - Metadata summary: Get capability statement description: "\n### Returns the target endpoints CapabilityStatement \n\nThe sender must initially request the receiver's [CapabilityStatement](https://www.hl7.org/fhir/capabilitystatement.html) (GET /metadata) to establish how to interact with the receivers API (its capabilities). If the receiver does not support BaRS functionality the BaRS API will provide an error response to indicate this and the sender will pursue an alternative workflow. \n\nA receiver may only implement a subset of the functionality within the standard and the CapabilityStatement will make this clear to a sender. \n\nWhat is returned is a server level response to indicate what functionality the target API supports and how to interact with it. This includes its Version, Security, Endpoints and their associated parameters as well as which MessageDefinitions are supported.\n\nAny given endpoint will describe its full capabilities as a client and as a server in response. As the Sender and Receiver roles are interchangeable in certain Application Workflows, all capabilities should be described. \n\nThe BaRS proxy will also respond with its own CapabilityStatement, which can be used as an example, by calling this endpoint and omitting the NHSD-Target-Identifier header.\n" operationId: getMeta responses: '200': description: Success content: application/fhir+json: schema: $ref: '#/components/schemas/Capability' example: $ref: examples/metadata/BaRS_API_Capability_Statement.json application/fhir+xml: schema: $ref: '#/components/schemas/Capability' headers: X-Correlation-Id: description: The X-Correlation-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: 9562466f-c982-4bd5-bb0e-255e9f5e6689 X-Request-Id: description: The X-Request-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91 4XX: $ref: '#/components/responses/4XX-BARS' 5XX: $ref: '#/components/responses/5XX-BARS' /MessageDefinition: parameters: - $ref: '#/components/parameters/RequestId_HParam' - $ref: '#/components/parameters/CorrelationId_HParam' - $ref: '#/components/parameters/RequestingOrganisation_HParam' - $ref: '#/components/parameters/RequestingPractitioner_HParam' - $ref: '#/components/parameters/RequestingDevice_HParam' - $ref: '#/components/parameters/TargetIdentifier_HParam' - $ref: '#/components/parameters/Accept_HParam' get: tags: - Metadata summary: Get Message Definition description: "\n### Returns MessageDefinitions supported by the target endpoint\n\nThe Message Definition retrieval is required to inform a Sender on building the payload. A request is made using the Service Identifier and workflow type values, linking to the useContext and event elements, respectively, in the Message Definition resource, returning a list of FHIR resources. \n\nThe order of workflow beyond this point is relatively flexible, the only stipulation being responses occurring after requests.\n\n### Sender\n\nThe request for Message Definition is the next step for a Sender following the metadata acquisition. \nThe sender must request the Message Definition for the Service Identifier obtained previously, along with the type of workflow type e.g. booking-request, servicerequest-request. The Message Definition will contain a list of FHIR resources which the sender must include when making a booking or referral. \n\n### Receiver\n\nA receiver dictates what they need from a sender making a request and the MessageDefinition is the mechanism to support this. The Message Definition details what FHIR resources need to be included in the body (payload).\nThe receiver may support multiple services e.g. Out-of-Hours, Clinical Assessment Service under one organisation (on the same system) and consideration should be given to maintaining service identifiers and workflow type against Message Definitions. It's advisable to make this a configurable option which providers can maintain themselves as new services come onboard.\n" operationId: getMessageDefinition parameters: - $ref: '#/components/parameters/context_QParam' responses: '200': description: Success content: application/fhir+json: schema: $ref: '#/components/schemas/MessageDefinition' example: $ref: examples/message_definition/MessageDefinition_ServiceRequest-request_CaseTransfer.json application/fhir+xml: schema: $ref: '#/components/schemas/MessageDefinition' headers: X-Correlation-Id: description: The X-Correlation-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: 9562466f-c982-4bd5-bb0e-255e9f5e6689 X-Request-Id: description: The X-Request-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91 4XX: $ref: '#/components/responses/4XX-BARS' 5XX: $ref: '#/components/responses/5XX-BARS' components: schemas: RequestingOrganisationToken: $ref: schemas/RequestingOrganisation.yaml TargetIdentifier: $ref: schemas/TargetIdentifier.yaml Capability: $ref: schemas/Capability.yaml MessageDefinition: $ref: schemas/MessageDefinition.yaml RequestingPractitionerToken: $ref: schemas/RequestingPractitioner.yaml RequestingSoftwareToken: $ref: schemas/RequestingSoftware.yaml OperationalOutcome: $ref: schemas/OperationalOutcome.yaml responses: 5XX-BARS: description: "Below are examples of potential HTTP status codes and their associated error codes, which could be returned in the event of a fault. \nGuidance on error handling within BaRS can be found [here](https://simplifier.net/guide/nhsbookingandreferralstandard/Home/Design/Design--Core#Error-handling).\n\n| HTTP status | Error code | Description |\n| ----------- | -------------------------- | --------------------------------------------- |\n| 500 | REC_SERVER_ERROR | The receiver server has encountered an Error processing the request. |\n| 500 | PROXY_SERVER_ERROR | Proxy Error. |\n| 501 | SEND_NOT_IMPLEMENTED | The Request was not recognized. |\n| 501 | REC_NOT_IMPLEMENTED | The Receiver did not recognize the request. |\n| 501 | PROXY_NOT_IMPLEMENTED | The Proxy did not recognize the request. |\n| 503 | REC_UNAVAILABLE | The Receiver was unavailable to service the request.|\n| 503 | PROXY_UNAVAILABLE | The Proxy was unavailable to service the request. |\n" content: application/fhir+json: schema: $ref: '#/components/schemas/OperationalOutcome' example: $ref: examples/500-REC.json headers: X-Correlation-Id: description: The X-Correlation-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: 9562466f-c982-4bd5-bb0e-255e9f5e6689 X-Request-Id: description: The X-Request-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91 4XX-BARS: description: "Below are examples of potential HTTP status codes and their associated error codes, which could be returned in the event of a fault. \nGuidance on error handling within BaRS can be found [here](https://simplifier.net/guide/nhsbookingandreferralstandard/Home/Design/Design--Core#Error-handling).\n\n| HTTP status | Error code | Description |\n| ----------- | -------------------------- | --------------------------------------------- |\n| 400 | SEND_BAD_REQUEST | The API was unable to process the request. |\n| 400 | REC_BAD_REQUEST | The Receiver has responded stating the message was malformed. |\n| 401 | SEND_UNAUTHORIZED | The API deemed you unauthorized to make this request. |\n| 401 | REC_UNAUTHORIZED | The receiver deemed you unauthorized to make request. |\n| 403 | SEND_FORBIDDEN | Missing or Expired Token. |\n| 404 | PROXY_NOT_FOUND | No related people exist for given NHS number. |\n| 404 | REC_NOT_FOUND | Patient record for given NHS number has been invalidated and not superseded by another NHS number. |\n| 405 | SEND_METHOD_NOT_ALLOWED | HTTP Verb is not correct for this scenario.|\n| 405 | REC_METHOD_NOT_ALLOWED | Receiver does not allow this.|\n| 405 | PROXY_METHOD_NOT_ALLOWED | Proxy does not allow this.|\n| 406 | SEND_NOT_ACCEPTABLE | Senders message had an incorrect content type defined for a response.|\n| 408 | REC_TIMEOUT | The downstream domain processing has not completed within the configured timeout period. |\n| 409 | SEND_CONFLICT | |\n| 409 | REC_CONFLICT | |\n| 409 | PROXY_CONFLICT | |\n| 422 | SEND_UNPROCESSABLE_ENTITY | Message was not malformed but deemed unprocessable. |\n| 422 | REC_UNPROCESSABLE_ENTITY | Message was not malformed but deemed unprocessable. | \n| 422 | PROXY_UNPROCESSABLE_ENTITY | Message was not malformed but deemed unprocessable. | \n| 429 | SEND_TOO_MANY_REQUESTS | The user has sent too many requests in a given amount of time|\n| 429 | REC_TOO_MANY_REQUESTS | The user has sent too many requests in a given amount of time|\n" content: application/fhir+json: schema: $ref: '#/components/schemas/OperationalOutcome' example: $ref: examples/400-SEND.json headers: X-Correlation-Id: description: The X-Correlation-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: 9562466f-c982-4bd5-bb0e-255e9f5e6689 X-Request-Id: description: The X-Request-Id from the request header, if supplied, mirrored back. schema: type: string format: uuid example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91 parameters: TargetIdentifierMeta_HParam: name: NHSD-Target-Identifier description: The identifier of the Target system. A Base64 encoded object containing value and system properties. required: false in: header schema: $ref: '#/components/schemas/TargetIdentifier' context_QParam: name: context description: 'The target service identifier. Allowing the ability to filter returned message definitions by the specified service id. In this example a DoS id. The preferred format is system|value however a value should be accepted and honoured as per [FHIR guidance](https://www.hl7.org/fhir/search.html#token). ' required: true in: query schema: type: string example: https%3A%2F%2Ffhir.nhs.uk%2FId%2Fdos-service-id%7C2000099999 CorrelationId_HParam: name: X-Correlation-Id description: The X-Correlation-Id for the request header, when supplied, mirrored back by the receiver. required: true in: header schema: type: string format: uuid example: 9562466f-c982-4bd5-bb0e-255e9f5e6689 RequestingPractitioner_HParam: name: NHSD-Requesting-Practitioner description: 'Requesting Practitioner described in an object based on a FHIR ''PractitionerRole'' resource (Standard Base64 encoded JSON). This item is not mandatory, however if the information is available it must be included in the request. Only in the event that it is not available, should it be omitted. The example given shows a General Practitioner and their SDS Role profile Id. ' required: false in: header schema: $ref: '#/components/schemas/RequestingPractitionerToken' RequestingOrganisation_HParam: name: NHSD-End-User-Organisation description: "Requesting Organization described in an object based on a FHIR 'Organization' resource (Standard Base64 encoded JSON).\nDifferent BaRS Applications may have different standards and requirements for the Access Control which these headers are used for. \nIn the example given an ODS code and the Organisation name is provided. Other identifiers are permitted if required. \n" required: true in: header schema: $ref: '#/components/schemas/RequestingOrganisationToken' RequestingDevice_HParam: name: NHSD-Requesting-Software description: "Requesting Software described in an object based on a FHIR 'Device' resource (Standard Base64 encoded JSON).\nDifferent BaRS Applications may have different standards and requirements for the Access Control which these headers are used for. \n\nThe identifier used, though arbitrary, should be consistent across instances of a product, the name and version of the product should also be accurate and consistent.\n" required: true in: header schema: $ref: '#/components/schemas/RequestingSoftwareToken' Accept_HParam: name: Accept description: The Accept Header must also contain the version of the API required. in: header required: true schema: type: string example: "'application/fhir+json; version=1.0.0' \n" RequestId_HParam: name: X-Request-Id description: The X-Request-Id for the request header, when supplied, mirrored back by the receiver. required: true in: header schema: type: string format: uuid example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91 TargetIdentifier_HParam: name: NHSD-Target-Identifier description: The identifier of the Target system. A Base64 encoded object containing value and system properties. required: true in: header schema: $ref: '#/components/schemas/TargetIdentifier' securitySchemes: OAuth_Token: type: http scheme: bearer