Tutorials

Many of our APIs give access to sensitive or personal data. Each API is secured using an appropriate security pattern.

The security patterns are in three categories:

• open-access APIs
• application-restricted APIs
• user-restricted APIs​

This page contains tutorials which show you how to connect to our example Hello World API using each security pattern.​

These tutorials show you how to connect to an open-access REST API using:

• Java
• .NET (C#)
• PHP

and also using the "Try this API" feature.​​

You can use the following security patterns to connect to an application-restricted REST API:

• signed JWT authentication

• API key authentication​

Signed JWT authentication tutorials

These tutorials show you how to use the signed JWT authentication pattern using:

• Java

• C#

• PHP​

API key authentication tutorials

These tutorials show you how to use the API key authentication pattern using:​

• Java

• C#

• PHP

These tutorials show you how to connect to an user-restricted REST API.​

Two types of end user can access user-restricted APIs:

• healthcare workers - authenticated using NHS Care Identity Service 2 (NHS CIS2)
• patients - authenticated using NHS login

Users can be authenticated and authorised using:

• separate authentication and authorisation - where these are done separately
• combined authentication and authorisation - where these are done together

These tutorials show you how to use NHS CIS2 - separate authentication and authorisation using:

• Java
• .NET (C#)
• PHP

These tutorials show you how to use NHS CIS2 - combined authentication and authorisation using:

• Java
• .NET (C#)
• PHP

These tutorials show you how to use NHS login - separate authentication and authorisation using:

• Java
• .NET (C#)
• PHP

These tutorials show you how to use NHS login - combined authentication and authorisation using:

• Java
• .NET (C#)
• PHP

and also using the "Try this API" feature.

Some of our APIs have open-access sandboxes you can use for learning, experimentation and early testing.

For more details, see sandbox testing.