Security Quickstart

This page describes a quickstart for users of the CCRI to explore a secure API connection to the CCRI. The security challenges are descried in more detail in the Security section of the this Implementation Guide. The rest of this guide concentrates on how to:

1. Pre-registered OAuth2 Client - Access via Postman
2. Register OAuth2 Client - Access via an OAuth2 negotiated server

To deploy a live instance of a Care Connect API where data is hosted and shared across system and organisational boundaries, please refer to Security for background and understanding of the security considerations when creating your own implementation.

Pre-registered OAuth2 Client

To Authenticate and connect with the CCRI via Postman emulates how a backend server might establish a secure connection. The following screenshots show how to use the Care Connect Reference Implementation via Postman. The 7 steps shown below are:

1. Access Secure Endpoint
2. Select OAuth2
3. Get New Access Token
4. Request Token - please use list of Security Scopes
5. Use Access Token
6. Send Secure Request

Get new access token

Access Secure Endpoint & Select OAuth2

Use Access Token

Please click the Security Scopes for a list of example scopes and access tokens.

Get New Access Token (expiry 90 mins), copy the details below this screenshot.

Create Access Token example for Patient only access, please see Security Scopes for more example scopes:

There are three steps the first time you use the token with the Reference Implementation:

1. Get new access token
2. Ensure you only have one active token (expiry every 90 mins)
3. Use the access token in a Request (The URL is the same as before but with the https:// prefix)

Send Request

Send Secure Request

Register a OAuth2 Client

Access via an OAuth2 client demonstrates how a website / mobile app could interact with an end user. The starting point for this lies in the Capability Statement (example) of a FHIR Server which indicates the location of the Authorisation Server.

The CapabilityStatement indicates secure access can be obtained by registering the client at https://developer.nhs.uk/ccri-auth/register. As a demonstration of how this can be achieved using an Authorisation Server user interface, please follow this link below and log into the OAuth2 server using a Google Id by clicking on Log In (top right hand corner). CareConnect Authorisation Server

Register to the OAuth2 Client

Select ‘Self-service client registration’ from the menu and then select ‘+ New Client’.

Complete your details, for details on Access Scopes please see SMART on FHIR - Scopes and Launch Context.

Take a note of the client_id and client_secret they will be used to establish the secure connection. The diagram below shows a redacted screenshot of an example access token.

Current Version

Check out Versions for more information about the current released version, downloading options, use and future verions.

Contribute

This site is structured around Care Connect stakeholders including API users, developers and architects. Please get involved in the journey.