Authorization

In order to be authorized to use the service the client must first be authenticated using HelseID or Helsenorge.

HelseID

A HelseID access token is required for authorization of organization and health care personell.

Claims

The client must do a token refresh/exchange with HelseID to set correct audience and scope for this service.

Claims documentation for HelseID can be found here.

Documentation to set single audience can be found here

Headers

hit-user-role

Information about the role of the logged in user. Must be a valid JSON data structure. We require that the content of the header is always URL encoded to make sure all types of characters are transmitted correctly to the server.

Example:

{
    "system": "urn:oid:2.16.578.1.12.4.1.1.9060",
    "code": "LE"
}

The content of the "system" field is the coding system (kodeverk) for the type of role the user got.

The content of the "code" field is the role of the user. For HPR all roles must be according to Volven kodeverk 9060. Example HPR roles:

hit-access-basis

Which basis for access (grunnlag/tjenstlig behov) the user has to get access to data. "Forhøyet" must be used if requesting access to data which the patient has restricted access (sperring).

Note:
If the patient has not set restriction and the "Forhøyet"-values are used in this header, then you will recive an error. Overrule of restriction must only be done when the patient have actually set restriction. See status-endpoint.

hit-source-system

The name and version of the EPJ system, 3-512 characters. If the name contains Norwegian characters then the header content should be URL encoded to make sure all types of characters are transmitted correctly to the server.

Machine to machine

The token must contain the following claims when HelseID machine to machine authorization:

Note that a machine token must not contain the claim "helseid://claims/identity/pid". If so you will get an error.

The headers "hit-patient-pid", "hit-source-system" and "content-type" must also be set (see above).

Machine to machine authorization is used in the /status endpoint.

Helsenorge

For an inhabitant an Helsenorge access token is required.

Read about inhabitant authentication - Helsenorge as OpenID Connect provider here.

Claims

Overview claims for Helsenorge is found here.

Headers

Error codes authorization

Error codes has prefix "AUTH".

In order to support Kjernejournal backwards compatibility we've kept some of the old error codes (prefix KJF). We're also sending all error codes in the response header X-KJ-Feilkode to keep backwards compatibility. Other Kjernejournal error codes which are not listed below are no longer in use. Note that both the old Kjernejournal error codes and response header will be phased out in the future.

Kjernejournal legacy authorization

In order to support backwards compatibility for EPJs using Kjernejournal legacy authorization we allow the old Kjernejournal headers and access token to be used.

PS: This is not the preferred way of doing authorization and will be phased out in the future. The preferred way is seen in the chapters above.

Ticket and HelseID token

EPJs can use Ticket from Kjernejournal's Health Indicator service together with an HelseID access token for authorization.

Header values can be found here.

Scope for the HelseID access token must be "nhn:kjernejournal/api" and audience must be "nhn:kjernejournal".

Helsenorge token

For an inhabitant an Helsenorge access token can be used.

Header values are the following.