Getting started on FLAGS - Patient Flags Service FHIR API (INT) — calling-system attribute missing (400) after enabling API on app

Patient Flags
1

Hi Flags Team

We are integrating with the Patient Flags Service – FHIR API using application-restricted access (signed JWT) in the INT environment and are blocked by a required application attribute.

Application details

Item Value
Application name FDSFLAGSINT
Application ID b3726b12-ba65-4f5e-b794-2091a0673f81
Environment Integration test (INT)
Organisation / owner FDS CIS2 TEAM / FDS Consultants
Access mode Application-restricted (signed JWT / private key JWT)
API Key (Client ID) GaFOSLfTV47OyTBXLs6kGNquk9TkRtia

Connected APIs (enabled)

  • Patient flags API - FHIR API (Integration) — Enabled

Custom attributes on the Hub app currently show: No custom attributes.

What works

  1. Public key / JWKS registered and validated on the app (kid = opera-ra-1).
  2. OAuth token exchange succeeds against https://int.api.service.nhs.uk/oauth2/token using client credentials + JWT bearer assertion (iss/sub = API Key, aud = token URL, RS512).
  3. After adding Patient flags API - FHIR API (Integration), the request is no longer 401; it now reaches the API and returns 400.

Failing request

GET https://int.api.service.nhs.uk/patient-flags-api/FHIR/R4/PatientFlag?patient=9449306753&code=NRAF

Headers include (among others):

  • Authorization: Bearer <access_token>
  • apikey: <API Key / Client ID>
  • Accept: application/fhir+json
  • X-Request-ID: <uuid>
  • NHSD-End-User-Organisation-ODS: D81045

Error response (HTTP 400)

{

“error”: {

“code”: 400,

“message”: “A required target attribute ‘calling-system’ is missing, please send all required attributes”

}

}

Request

Please add the required calling-system attribute (and any other required INT attributes/permissions) to application FDSFLAGSINT / Application ID b3726b12-ba65-4f5e-b794-2091a0673f81 for the Patient Flags Service – FHIR API in INT.

We understand from this thread that calling-system is an application attribute on the API Platform / DOS record rather than a request header we can supply ourselves.

Happy to provide further correlation IDs or evidence if needed.

Thanks
Iain Pretty
FDS Consultants / OPERA [8J025]

2

Iain, could you email me please and I will send you the information you need - england.patientflagapi@nhs.net