# A008 in INT environment returns 403

**URL:** <https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088>\
**Category:** e-Referral Service FHIR API\
**Created:** [6 November 2024 13:41 UTC](https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088 "2024-11-06T13:41:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ry8msk.dev02](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@ry8msk.dev02](https://developer.community.nhs.uk/u/ry8msk.dev02)\
**Post date:** [6 November 2024 13:41 UTC](https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088/1 "2024-11-06T13:41:35Z")

</div>

Hi everyone,

I am trying to call A008 in INT environment.  
The access mode is User-Restricted Access. I managed to reach all the steps regarding the authorization journey, called A030 to get the ODS code for the smartcard (it was issued for INT by ITOC), but when I call A008 I get **“diagnostics”: “ODS code not provided or has not been configured.”**

Did I perhaps miss some configuration steps?

Thank you!

---

<div class="post-metadata">

**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\
**Post date:** [6 November 2024 13:56 UTC](https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088/2 "2024-11-06T13:56:56Z")

</div>

Hi @ry8msk.dev02,

Can you confirm you are providing the selected ODS code in the Request header `NHSD-End-User-Organisation-ODS` (and Business Function in the `NHSD-eRS-Business-Function` header)?

For user-restricted access the ODS Code / Business function must be provided on every request (except for A030 as that lets you discover what is allowed).

If you can provide your Application-ID and X-Correlation-ID/X-Request-ID I can look into it further.

Thanks,

Adam.

---

<div class="post-metadata">

**Author:** ![ry8msk.dev02](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@ry8msk.dev02](https://developer.community.nhs.uk/u/ry8msk.dev02)\
**Post date:** [8 November 2024 08:12 UTC](https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088/3 "2024-11-08T08:12:06Z")

</div>

Hi @adam.oldfield and sorry for the late response.

Your response helped me a bit and found out I had a typo in my headers that I fixed.

Now I get that I need to provide on behalf of user ID. Where can I get that param?

Thank you!

---

<div class="post-metadata">

**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\
**Post date:** [8 November 2024 09:23 UTC](https://developer.community.nhs.uk/t/a008-in-int-environment-returns-403/3088/4 "2024-11-08T09:23:33Z")

</div>

Hi @ry8msk.dev02,

Good to hear that helped.

If you are using the `SERVICE_PROVIDER_CLINICIAN_ADMIN` Business Function then the Service Provider Clinician you are working on behalf of needs to be provided in the `NHSD-eRS-On-Behalf-Of-User-ID` header.

You can determine what users a `SERVICE_PROVIDER_CLINICIAN_ADMIN` can work on behalf of using: [Retrieve “on-behalf-of” practitioner user information (A040, FHIR R4)](https://digital.nhs.uk/developer/api-catalogue/e-referral-service-fhir#get-/R4/Practitioner)

Regards,

Adam.