# Machine2Machine record retrieval via Clinical Data Gateway FHIR API

**URL:** <https://developer.community.nhs.uk/t/machine2machine-record-retrieval-via-clinical-data-gateway-fhir-api/15722>\
**Category:** API Platform\
**Tags:** fhir, cis2\
**Created:** [12 October 2026 11:30 UTC](https://developer.community.nhs.uk/t/machine2machine-record-retrieval-via-clinical-data-gateway-fhir-api/15722 "2026-10-12T11:30:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yevhenii\_Kurotv](https://avatars.discourse-cdn.com/v4/letter/y/73ab20/32.png) [@Yevhenii\_Kurotv](https://developer.community.nhs.uk/u/Yevhenii_Kurotv)\
**Post date:** [12 October 2026 11:30 UTC](https://developer.community.nhs.uk/t/machine2machine-record-retrieval-via-clinical-data-gateway-fhir-api/15722/1 "2026-10-12T11:30:08Z")

</div>

Hello,

I have a question about the **Clinical Data Gateway FHIR API Get structured record endpoint.**

The documentation [https://digital.nhs.uk/developer/api-catalogue/clinical-data-gateway#post-/FHIR/STU3/patient/$gpc.getstructuredrecord](https://digital.nhs.uk/developer/api-catalogue/clinical-data-gateway#post-/FHIR/STU3/patient/$gpc.getstructuredrecord) says that it needs an nhs-cis2-aal2 token.

Does it mean that the request must initiate a request? That would be a departure from IM1 when a medical record can be fetched on demand.

Intelligent data processing may require minutes to make sense of a patient’s medical record, and a clinician’s time is too precious to wait for that.

Kind regards,  
Yevhenii

---

<div class="post-metadata">

**Author:** ![Valswyn\_Alfonso](https://avatars.discourse-cdn.com/v4/letter/v/43a26b/32.png) [@Valswyn\_Alfonso](https://developer.community.nhs.uk/u/Valswyn_Alfonso)\
**Post date:** [12 October 2026 16:22 UTC](https://developer.community.nhs.uk/t/machine2machine-record-retrieval-via-clinical-data-gateway-fhir-api/15722/2 "2026-10-12T16:22:47Z")

</div>

Yes. Please go through the following [https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation)

---

<div class="post-metadata">

**Author:** ![Yevhenii\_Kurotv](https://avatars.discourse-cdn.com/v4/letter/y/73ab20/32.png) [@Yevhenii\_Kurotv](https://developer.community.nhs.uk/u/Yevhenii_Kurotv)\
**Post date:** [13 October 2026 12:12 UTC](https://developer.community.nhs.uk/t/machine2machine-record-retrieval-via-clinical-data-gateway-fhir-api/15722/3 "2026-10-13T12:12:44Z")

</div>

Sorry, I mistyped my message. I meant to write “Does it mean that a user must initiate a request?” and it seems that your answer is “yes”: this API is not intended for service-to-service integrations.