Digital assurance for APIs and services

To get assurance and integrate with NHS APIs, your organisation must first complete our assurance process and get approval. This ensures your service meets NHS standards for safety, security, and data protection.

If you're not sure whether the Digital Onboarding Service is the right process for the API or service you wish to use, please check our onboarding process guidance.  

Follow these steps to assure use of NHS APIs 

1. Check the API catalogue
   The APIs listed here are all assured using the Digital Onboarding Service. Browse this list to find the right APIs for your service or product.
2. Register your organisation
   Sign up with the NHS to get an Organisation Data Service (ODS) code.
3. Complete the Data Security and Protection Toolkit
   Use the Toolkit to show your organisation meets the National Data Guardian’s 10 data security standards.
4. Create a developer account
   This gives you access to the Digital Onboarding Service assurance process.
5. Register your environment
   Add your API hosting environment details in the Developer account so they’re ready for configuration.
6. Start the assurance process
   Begin your application and choose which APIs to apply for in the Digital Onboarding Service. See below for detailed guidance on using the service.
7. Sign the connection agreement
   Once approved, you’ll receive an agreement to sign before integration can begin.

Organisations can use NHS APIs to link their products and services to NHS data. Before integration, we check that your organisation is suitable and has the correct credentials and permissions. You will need to complete the NHS API assurance process. This includes answering questions about your product and demonstrating that it meets key security and governance requirements.

Each organisation can have one or more products, and each product can have one or more APIs as shown in the diagram below.

This diagram shows the relationship between organisations, products and APIs. It shows an example GP surgery with 4 products: prescription software, a screening device, patient record software and an A&E system.

The diagram highlights that multiple APIs can be needed for a product, and that each product will need separate assurance. 

When you start digital assurance, you will need to set up your organisation and products in the Digital Onboarding Service system.

This enables you and your team to collaborate with the assurance process and respond to the questions and requirements. These questions and requirements change from time to time in line with new rules and legislation.

There are two account user types:the first registered user will become the ‘Account Manager’, subsequent users will become ‘Developers’. The table below shows the tasks available to each account type.

For help with this process please refer to our digital assurance user guides.

NHS API assurance has moved to a single streamlined process called the Single Assessment flow. This means all new API applications submitted through the Digital Onboarding Service will follow this updated process. The aim is to make assurance more consistent and user-friendly, while speeding up internal reviews and improving quality.

As a result of this new process, the legacy assessment flow is no longer accepting new applications. If you need to add an API to an existing product or update an approved API from the old process, you’ll need to create a new product instead. For now, you can still complete any legacy assessments you’ve already started but we will share timelines for phasing these out soon.

For further support:

• start a conversation on our Developer community
• take a look at our documentation, guides and tutorials
• read our digital assurance user guides