openapi: 3.2.0 info: version: 1.0.0 title: Immunisation History - FHIR Immunization API license: name: MIT contact: name: NHS Digital API Management url: https://digital.nhs.uk/developer/help-and-support email: api.management@nhs.net description: "## Overview\nUse this API to access a patient's immunisation history.\n\nYou can:\n\n- get a patient's coronavirus (`COVID-19`) immunisation history, based on their NHS number\n- get a patient's influenza (`FLU`) immunisation history, based on their NHS number\n- get a patient's human papillomavirus (`HPV`) immunisation history, based on their NHS number\n\nYou cannot currently use this API to:\n\n- get details of other types of immunisation\n\nYou get the following data:\n\n- immunisation event details\n- patient demographic details, as captured at the point of immunisation\n\nThe patient demographic details might differ from those held in the Personal Demographics Service (PDS). To get demographic details from PDS, use the [Personal Demographics FHIR API](https://digital.nhs.uk/developer/api-catalogue/personal-demographics-service-fhir).\n\n### Data availability, timing and quality\nAll immunisation records are verified to ensure the NHS number is correct before making them available via the API.\n\nIn most cases this is automatic, and the record is available within 48 hours of the immunisation event, sometimes sooner.\n\nWhere automated NHS number verification fails, we verify the NHS number manually, which can take longer.\n\nIn a very small number of cases, we are unable to verify the NHS number, and we do not make the immunisation record available at all.\n\nThe `COVID-19` data store is limited to vaccinations from England, Wales and The Isle of Man for the last 4 years. It has been approved to be used for clinical use cases.\n\nThe `FLU` data store is not yet populated and is planned to contain vaccination events captured through a point of care system in England for the last year. It has been approved to be used for clinical use cases.\n\nThe `HPV` data store is not yet populated and is planned to be limited at first with vaccinations captured by the NHAIS system and in England only. It has been approved for use in clinical use cases.\n\n## Who can use this API\nThis API can only be used where there is a legal basis to do so. Make sure you have a valid use case before you go too far with your development. \n\nYou must demonstrate you have a valid use case as part of digital onboarding.\n\nYou must do this before you can go live (see 'Onboarding' below).\n\n### Who can access immunisation history records\nHealth and care organisations in England and the Isle of Man can access immunisation history records. \n\nLegitimate direct care examples include NHS organisations delivering healthcare, local authorities delivering care, third sector and private sector health and care organisations, and developers delivering systems to health and care organisations.\n\nHealth and care organisations in Scotland, Northern Ireland and the Channel Islands access their own equivalents of this API.\n\nPatients who receive health and social care or make use of NHS services in England, Wales and the Isle of Man. \n\n## API status and roadmap\nThis API is [in production](https://digital.nhs.uk/developer/guides-and-documentation/reference-guide#statuses).\n\nTo see our roadmap, or to suggest, comment or vote on features for this API, see our [interactive product backlog](https://nhs-digital-api-management.featureupvote.com/?tag=immunisation-history-api).\n\nIf you have any other queries, [contact us](https://digital.nhs.uk/developer/help-and-support).\n\n## Service level\n\nThis API is a platinum service, meaning it is operational and supported 24 x 7 x 365.\n\nFor more details, see [service levels](https://digital.nhs.uk/developer/guides-and-documentation/reference-guide#service-levels).\n\n## Technology\nThis API is [RESTful](https://digital.nhs.uk/developer/guides-and-documentation/our-api-technologies#basic-rest).\n\nIt conforms to the [FHIR](https://digital.nhs.uk/developer/guides-and-documentation/our-api-technologies#fhir) global standard for health care data exchange, specifically to [FHIR R4 (v4.0.1)](https://hl7.org/fhir/r4/), except that it does not support the [capabilities](http://hl7.org/fhir/R4/http.html#capabilities) interaction.\n\nIt includes some country-specific FHIR extensions, which conform to [FHIR UK Core](https://digital.nhs.uk/services/fhir-uk-core), specifically [fhir.r4.ukcore.stu1 0.5.1](https://simplifier.net/packages/fhir.r4.ukcore.stu1/0.5.1).\n\nYou do not need to know much about FHIR to use this API - FHIR APIs are just RESTful APIs that follow specific rules.\nIn particular:\n- resource names are capitalised and singular, and use US spellings, for example `/Immunization` not `/immunisations`\n- array names are singular, for example `entry` not `entries` for address lines\n- data items that are country-specific and thus not included in the FHIR global base resources are usually wrapped in an `extension` object\n\nThere are [libraries and SDKs available](https://digital.nhs.uk/developer/guides-and-documentation/api-technologies-at-nhs-digital#fhir-libraries-and-sdks) to help with FHIR API integration.\n\n## Network access\nThis API is available on the internet and, indirectly, on the [Health and Social Care Network (HSCN)](https://digital.nhs.uk/services/health-and-social-care-network).\n\nFor more details see [Network access for APIs](https://digital.nhs.uk/developer/guides-and-documentation/network-access-for-apis).\n\n## Security and authorisation\n\nThis API has two access modes: \n* application-restricted access\n* user-restricted access\n\n### Application-restricted access\n\nThis access mode is [application-restricted](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation#application-restricted-apis), meaning we authenticate the calling application but not the end user.\n\nTo use this access mode, use the following security pattern:\n* [Application-restricted RESTful API - signed JWT authentication](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/application-restricted-restful-apis-signed-jwt-authentication)\n\n### User-restricted access\n\nUse this [user-restricted access mode](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation#user-restricted-apis) if the end user is a patient:\n* the end user must have their identity verified to 'high' (P9) level\n* the NHS number in the request must match the NHS number in the NHS login account\n\nTo use this access mode, use the following security pattern:\n* [User-restricted RESTful APIs - NHS login separate authentication and authorisation](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-nhs-login-separate-authentication-and-authorisation)\n\n## Environments and testing\n| Environment | Base URL |\n| ----------------- | ---------------------------------------------------------------------- |\n| Sandbox | `https://sandbox.api.service.nhs.uk/immunisation-history/FHIR/R4/` |\n| Integration test | `https://int.api.service.nhs.uk/immunisation-history/FHIR/R4/` |\n| Production | `https://api.service.nhs.uk/immunisation-history/FHIR/R4/` |\n\n### Sandbox testing\nOur [sandbox environment](https://digital.nhs.uk/developer/guides-and-documentation/testing#sandbox-testing):\n* is for early developer testing\n* only covers a limited set of scenarios\n* is open access, so does not allow you to test authorisation\n\nFor details of sandbox test scenarios, or to try out the sandbox using our 'Try this API' feature, see the documentation for each endpoint.\n\nAlternatively, you can try out the sandbox using our Postman collection:\n\n[![Run in Postman](https://run.pstmn.io/button.svg)](https://app.getpostman.com/run-collection/b7dfde415e5726658d09)\n\n### Integration testing\nOur [integration test environment](https://digital.nhs.uk/developer/guides-and-documentation/testing#integration-testing):\n* is for formal integration testing\n* includes authorisation\n\nIt also includes ready-to-use [immunisation history test data](https://digital.nhs.uk/developer/api-catalogue/immunisation-history-fhir/immunisation-history-fhir-api-test-data).\n\nFor more details see [integration testing with our RESTful APIs](https://digital.nhs.uk/developer/guides-and-documentation/testing#integration-testing-with-our-restful-apis).\n\n## Onboarding\nYou need to get your software approved by us before it can go live with this API. We call this onboarding. The onboarding process can sometimes be quite long, so it’s worth planning well ahead. \n\nAs part of this process, you need to demonstrate that you can manage risks and that your software conforms technically with the requirements for this API. \n\nInformation on this page might impact the design of your software. For details, see [Onboarding support information](https://digital.nhs.uk/developer/api-catalogue/immunisation-history-fhir/onboarding-support-information). \n\nTo understand how our online digital onboarding process works, see [digital onboarding](https://digital.nhs.uk/developer/guides-and-documentation/digital-onboarding#using-the-digital-onboarding-portal). \n\n
\n
\n
\n
\n \n \"\"\n \n
\n
\n
\n

To get started, sign in or create a developer account, then select 'product onboarding'.

\n
\n
\n
\n\n## Errors\nWe use standard HTTP status codes to show whether an API request succeeded or not. They are usually in the range:\n\n* 200 to 299 if it succeeded, including code 202 if it was accepted by an API that needs to wait for further action\n* 400 to 499 if it failed because of a client error by your application\n* 500 to 599 if it failed because of an error on our server\n\nErrors specific to each API are shown in the Endpoints section, under Response. See our [reference guide](https://digital.nhs.uk/developer/guides-and-documentation/reference-guide#http-status-codes) for more on errors. \n" servers: - url: https://sandbox.api.service.nhs.uk/immunisation-history/FHIR/R4 description: Sandbox environment. - url: https://int.api.service.nhs.uk/immunisation-history/FHIR/R4 description: Integration test environment. - url: https://api.service.nhs.uk/immunisation-history/FHIR/R4 description: Production environment. tags: - name: Immunization paths: /Immunization: get: summary: Get immunisation history operationId: get-immunisation-history description: 'Given an NHS number, get the patient''s immunisation history. Also returns the patient''s demographic details, as captured at the point of immunisation. ## Sandbox testing You can test the following scenarios in our sandbox environment: | Scenario | Request | Response | | ----------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------- | | Immunisation history found | `patient.identifier`=`https://fhir.nhs.uk/Id/nhs-number\|9000000009` | HTTP Status 200 with immunisation data in response body | | No immunisations found | `patient.identifier`=`https://fhir.nhs.uk/Id/nhs-number\|9000000033` | HTTP Status 200 with empty bundle in response body | | Bad Request | `patient.identifier`= anything else | HTTP Status 400 Bad Request | You can try out the sandbox using the ''Try this API'' feature on this page. Alternatively, you can try out the sandbox using our Postman collection: [![Run in Postman](https://run.pstmn.io/button.svg)](https://app.getpostman.com/run-collection/b7dfde415e5726658d09) ' parameters: - name: patient.identifier in: query description: 'The patient''s NHS number. Expressed as `|` where `` must be `https://fhir.nhs.uk/Id/nhs-number` and `` must be a [valid NHS number](https://www.datadictionary.nhs.uk/attributes/nhs_number.html). ' required: true schema: type: string example: https://fhir.nhs.uk/Id/nhs-number|9000000009 - name: procedure-code:below deprecated: true in: query description: 'Parent SNOMED immunisation procedure code. For example, `90640007`, which is the parent code for all COVID-19 vaccinations. This parameter has been deprecated and will be replaced by the `immunization.target` parameter. ' required: false schema: type: string description: Parent SNOMED code for all COVID-19 vaccinations. - name: immunization.target in: query description: 'Immunization History is segmented into multiple Data Stores, which may target specific procedures, disorders, diseases, infections or organisms. ' schema: type: string example: COVID19 enum: - COVID19 - HPV - FLU - name: date.from in: query description: 'The earliest date to be included (e.g. 2020-01-01) ' schema: type: string format: date default: '1900-01-01' - name: date.to in: query description: 'The latest date to be included (e.g. 2020-12-31) ' schema: type: string format: date default: '9999-12-31' - name: _include in: query description: 'Specifies other resources to be included in the response along with the immunisations. Must be `Immunization:patient`, which will include patient demographic details. ' required: true schema: type: string example: Immunization:patient - name: Authorization in: header description: 'An OAuth 2.0 bearer token, obtained using our [NHS login pattern](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-nhs-login-separate-authentication-and-authorisation). ' required: true schema: type: string format: ^Bearer\ [[:ascii:]]+$ example: Bearer g1112R_ccQ1Ebbb4gtHBP1aaaNM - name: X-Correlation-ID in: header required: false description: 'An optional ID which you can use to track transactions across multiple systems. It can take any value, but we recommend avoiding `.` characters. Mirrored back in a response header. ' schema: type: string example: 11C46F5F-CDEF-4865-94B2-0EE0EDCC26DA - name: Accept in: header required: false description: 'Optional header to select the version of the api. Version number will follow semver. ' schema: type: string example: version=1.0, version=2.0 responses: '200': description: 'The request was valid, and the response contains immunisation history and associated patient details. If there are no immunisations for the given NHS number, the response bundle will be empty. ' headers: X-Correlation-Id: $ref: components/schemas/XCorrelationId.yaml content: application/fhir+json: schema: $ref: components/schemas/Bundle.yaml example: $ref: components/examples/Immunization.json 4XX: description: 'An error occurred as follows: | HTTP status | Error code | Description | | ----------- | -------------------------- | ------------------------------------------------------------------- | | 400 | `processing` | Missing or invalid NHS number | | 400 | `processing` | Missing, invalid or conflicting parent SNOMED code / Target | | 401 | `processing` | Missing or invalid ID token | | 401 | `processing` | Missing or invalid OAuth 2.0 bearer token | | 401 | `processing` | NHS number in request doesn''t match NHS number in NHS login account | For details see the `diagnostics` field. ' content: application/fhir+json: schema: $ref: components/schemas/OperationOutcome.yaml example: $ref: components/examples/OperationOutcome.json tags: - Immunization x-nhs-api-spec-guid: 1b22efff-7b41-4fa0-9146-dc87686a7b5c