Getting NO_RELATIONSHIP error when getting details of referral after submission

e-Referral Service (e-RS) e-Referral Service FHIR API
1

On the integration environment, I have submitted a referral and can see it in the e-RS UI.

The status of the referral is NOT_BOOKED.

I am trying to get the status of this referral via the API, using application-restricted access. Calling https://int.api.service.nhs.uk/referrals/FHIR/STU3/ReferralRequest/:ubrn (A005) I get this response:

{
  "meta": {
    "profile": [
      "https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1"
    ]
  },
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "severity": "error",
      "code": "business-rule",
      "details": {
        "coding": [
          {
            "code": "NO_RELATIONSHIP",
            "system": "https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1",
            "display": "No relationship"
          }
        ]
      },
      "diagnostics": "No legitimate relationship with referral (000049838878)."
    }
  ]
}

The user I used to create the referral is for C82660, and can see that this organisation is the referring organisation in the UI. The application I’m using for application-restricted access (app id 00b67abe-1fb0-4c3d-85e1-4a3d36f04487) has these custom attributes set:

app-restricted-ods-code: C82660

app-restricted-user-id: 555395063103

asid: [same as my user-restricted application]

On my latest request to get the status, my x-correlation-id is 11C46F5F-CDEF-4865-94B2-0EE0EDCC26DA. And the UBRN I’m using is 000049838878.

I was under the impression that since both my user-restricted user and my application-restricted application are both using the same ODS code, then they both should have access to the referral that’s been created.

Is there something I’ve configured incorrectly for this, or am I misunderstanding who can call this endpoint?

2

Hello we will take a look at this for you - it may not be anything you have done wrong - it may be something we have incorrectly setup for you. Bear with us and we will respond to you :slight_smile:

3

@Jamie_Burns So I have an initial thought on where the issue may lie.

C82660 is your referring test practice code - I think from above you have confirmed that also.

Your app-restricted ODS code, linked to your application should then be an NHS Trust provider code so you can systematically retrieve the referral you have just progressed - so this should not be C82660

Looking at your test pack - I believe the actual Trust code different. Which Trust are you referring into (ODS Code) please?

4

Hi Tony,

Originally I had the application-restricted app set to use J4B3R, which is our test Trust and that worked fine when referring into it. However, this solution we’re building is for a referring organisation who will be referring into many different organisations and we were trying to get the updates to the referrals that they have created via the API.

Is it possible for a referring organisation to use application-restricted to get the status of a referral they’ve created, or is this only available to the orgs that have been sent the referral?

5

Ah okay, that makes sense - so is possibly a valid question of legitmate relationship then - I’d need a business analyst to check on the finer details.

Have you had any other issues with app restricted on this app - I have noticed there is a missing attrribute also - if its referrer app restricted we also need to add an extra one. So if it is let me know and I’ll have that added - might resolve issues you have not yet seen.

6

We’ve not noticed anything else, but we’re now only looking to use application-restricted for this one endpoint.

We’ve got another application set up (appId da62210d-b0f6-49e6-a2d4-49b212a4d03d) which is also set for C82660 and has this attribute:

app-restricted-business-function: REFERRER_AUTHORISED_APPLICATION

We get this error for this endpoint: Endpoint not authorised for Business Function (REFERRER_AUTHORISED_APPLICATION).

Which makes sense, if this endpoint is only for service providers receiving referrals.

Is there a different attribute we should be adding for this, which might help?

If not, then I guess the question is whether user-restricted is the only option we’ve got for the referring organisation to get the details of a referral that they’ve created?

7

Thank you for all the context, its the “No legitimate relationship with referral” we will investigate our end first. Feel like something is not quite correct here.

8

Just one more thing :slight_smile:

So the two apps are basically exactly the same, only that one has the attribute of REFERRER_AUTHORISED_APPLICATION, and one does not. Are you able to make a user restricted call for the same referral via A005 successfully - or have you not tried that?

9

Hi Tony - yes, we can call A005 fine with user-restricted, where that role selected is for that same ODS code.

10

Hi Jamie,

Thanks for bearing with us, had a look at this in the logs and code.

We think you’re seeing two separate behaviours from the two apps:

  1. App that sends REFERRER_AUTHORISED_APPLICATION (da62210d-b0f6-49e6-a2d4-49b212a4d03d)

For A005 (GET ReferralRequest/{id}), that business function is not currently permitted on this endpoint, so it fails early with: Endpoint not authorised for Business Function (REFERRER_AUTHORISED_APPLICATION).

  1. App request that returned NO_RELATIONSHIP (00b67abe-1fb0-4c3d-85e1-4a3d36f04487)

For the request (corr id 11C46F5F-CDEF-4865-94B2-0EE0EDCC26DA…, UBRN 000049838878), e-RS received: x-ers-access-mode=application-restricted, x-ers-ods-code=C82660, x-ers-business-function=PROVIDER_AUTHORISED_APPLICATION.

That then goes through provider style legitimate relationship style checks and fails (userServicesCount=0, lrExists=false), which is why you get NO_RELATIONSHIP.

So the situation is these two app-restricted calls are being evaluated under different business-function and authorisation paths.

Could you share the exact business-function value configured for app 00b67abe-1fb0-4c3d-85e1-4a3d36f04487 in APIM, and if possible the raw header value being sent on the request (before it reaches e-RS)? We can see your request is reaching us as x-ers-business-function=PROVIDER_AUTHORISED_APPLICATION, so this would confirm whether it’s coming from your app/ APIM setup or mapped from AUTHORISED_APPLICATION.

11

Hi Thomas,

Thanks for looking into this for us.

I’ve checked our requests for A005 (application-restricted) and the only header we’re setting is Authorization. I think when I’ve tried setting the other headers (e.g., NHSD-eRS-Business-Function) we get an error back, which matches the docs because those headers are not available for application-restricted.

As for the app set up (00b67abe-1fb0-4c3d-85e1-4a3d36f04487), we’ve only got these custom attributes set up (within onboarding.prod.api.platform.nhs.uk):

app-restricted-ods-code

app-restricted-user-id

asid

We’re not explicitly setting the business function anywhere (unless it’s set somewhere that I don’t have access to?).

Is there a different app-restricted-business-function attribute we should be setting for this?

12

Jamie,

Just to confirm are both of these apps intended for referrer app restricted access? :slight_smile:

13

Hi Tony,

The situation I’m in is that the organisation this solution is for is both a referrer and a service provider, and I’m trying to make sure that what I’ve got set up here in the integration environment is what we’ll have in production.

Currently, I’m only looking to use application-restricted access for this one endpoint (A005), so however these apps need to be set up, as long as it’s what I’ll be able to reproduce in production, then these apps can be configured in any way.

14

Hey Jamie - I’ll reach out for a quick call early next week if that’s okay - see if we can get to the bottom of it

15

Hi Tony,

That’s great, thanks - I’m unavailable on Monday but around the rest of the week.

16

Hi Tony, just checking you’re still ok for a quick call about this at some point please?

17

Hi Jamie, would 4pm tomorrow work for you?

18

Hi Tony, that would be perfect, thank you.

19

Could you send me your email in the private chat on here :slight_smile: