# Forbidden Error on Record Triage Outcome (A028) API

**URL:** <https://developer.community.nhs.uk/t/forbidden-error-on-record-triage-outcome-a028-api/8490>\
**Category:** e-Referral Service FHIR API\
**Tags:** fhir\
**Created:** [31 October 2025 13:51 UTC](https://developer.community.nhs.uk/t/forbidden-error-on-record-triage-outcome-a028-api/8490 "2025-10-31T13:51:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![supplier](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@supplier](https://developer.community.nhs.uk/u/supplier)\
**Post date:** [31 October 2025 13:51 UTC](https://developer.community.nhs.uk/t/forbidden-error-on-record-triage-outcome-a028-api/8490/1 "2025-10-31T13:51:16Z")

</div>

I’m trying to call the endpoint `/STU3/ReferralRequest/{ubrn}/$ers.recordReviewOutcome` (Record Triage Outcome - A028, FHIR STU3), but I’m getting the following error from the NHS side:

{

```
"meta": {

    "profile": \[

        "[https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1"](https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1%22 "https://fhir.nhs.uk/stu3/structuredefinition/ers-operationoutcome-1%22")

    \]

},

"resourceType": "OperationOutcome",

"issue": \[

    {

        "severity": "error",

        "code": "forbidden",

        "details": {

            "coding": \[

                {

                    "code": "FORBIDDEN",

                    "system": "[https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1"](https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1%22 "https://fhir.nhs.uk/stu3/codesystem/ers-apierrorcode-1%22"),

                    "display": "Forbidden"

                }

            \]

        },

        "diagnostics": "On Behalf Of User ID (555367989103) is not permitted for Business Function (SERVICE_PROVIDER_CLINICIAN)."

    }

\]

```

}

Our Smartcard (ID: **555367989103** ) already has the **SERVICE\_PROVIDER\_CLINICIAN** role, but the API still returns a _Forbidden_ error.

Could you please check if the correct business function is assigned or advise which user/role should be used for this API call?

---

<div class="post-metadata">

**Author:** ![zubeir.tai](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/zubeir.tai/32/413_2.png) [@zubeir.tai](https://developer.community.nhs.uk/u/zubeir.tai)\
**Post date:** [5 November 2025 09:25 UTC](https://developer.community.nhs.uk/t/forbidden-error-on-record-triage-outcome-a028-api/8490/2 "2025-11-05T09:25:31Z")

</div>

Hi @supplier - It looks like you are attempting to use a Service Provider Clinician ADMIN role, for which there is no assigned Service Provider Clinician role.

As per the spec:

> “On behalf of” is only supported for a Service Provider Clinician Admin (SPCA) acting on behalf of a Service Provider Clinician (SPC).
> 
> Where an OBO User ID is supplied the authenticating user must be an SPCA and the OBO User ID must be that of an appropriate SPC.

Please retry using the SPC role, without supplying the OBO User ID.

Thanks,  
Z.

---

<div class="post-metadata">

**Author:** ![supplier](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@supplier](https://developer.community.nhs.uk/u/supplier)\
**Post date:** [5 November 2025 11:46 UTC](https://developer.community.nhs.uk/t/forbidden-error-on-record-triage-outcome-a028-api/8490/3 "2025-11-05T11:46:13Z")

</div>

Hi @zubeir.tai ,

Thanks for the guidance — the approach you suggested worked.  
We were able to proceed successfully.

Regards,  
A.