# MESH example Python code does not work

**URL:** <https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456>\
**Category:** MESH API\
**Created:** [25 August 2023 09:30 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456 "2023-08-25T09:30:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tc1](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/tc1/32/83_2.png) [@tc1](https://developer.community.nhs.uk/u/tc1)\
**Post date:** [25 August 2023 09:30 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/1 "2023-08-25T09:30:01Z")

</div>

The code @ [Message Exchange for Social Care and Health (MESH) API - NHS Digital](https://digital.nhs.uk/developer/api-catalogue/message-exchange-for-social-care-and-health-api#overview--mesh-authorization-header) isn’t valid python3 (that’s not how you do an import) and contains typos, and no actual output.

Here is a corrected version. Save it to a file and run it.  
Expected output:

> NHSMESH XXX5555:6f732ccc-8c6f-4c9b-a22d-2f42978550ad:0:202308251028:026e8d63f07be7ad3606e4c5262b3c954dfd6b7697cbf2e34ae3646862cd3d0f

```auto
""" Python code to generate a valid authorization header. """
import hmac
import uuid
import datetime
import hashlib

AUTHSCHEMANAME = "NHSMESH " # Note: Space at the end of the schema.
SHARED_KEY = "tbc" # Note: Don't hard code your passwords in a real implementation.

def build_auth_header(mailbox_id: str, password: str = "password", nonce: str = None, nonce_count: int = 0):
  """ Generate MESH Authorization header for mailboxid. """
  #Generate a GUID if required.
  if not nonce:
    nonce = str(uuid.uuid4())
  #Current time formatted as yyyyMMddHHmm
  #for example, 4th May 2020 13:05 would be 202005041305
  timestamp = datetime.datetime.now().strftime("%Y%m%d%H%M")

  #for example, NHSMESH AMP01HC001:bd0e2bd5-218e-41d0-83a9-73fdec414803:0:202005041305
  hmac_msg = mailbox_id + ":" + nonce + ":" + str(nonce_count) + ":" + password + ":" + timestamp

  #HMAC is a standard crypto hash method built in the python standard library.
  hash_code = hmac.HMAC(SHARED_KEY.encode(), hmac_msg.encode(), "sha256").hexdigest()
  return (
    AUTHSCHEMANAME # Note: No colon between 1st and 2nd elements.
    + mailbox_id + ":"
    + nonce + ":"
    + str(nonce_count) + ":"
    + timestamp+ ":"
    + hash_code
  )

print ( build_auth_header( "XXX5555","klshdf09w734","6f732ccc-8c6f-4c9b-a22d-2f42978550ad" ) )

```

---

<div class="post-metadata">

**Author:** ![alan.rawlings2](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@alan.rawlings2](https://developer.community.nhs.uk/u/alan.rawlings2)\
**Post date:** [31 August 2023 10:25 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/2 "2023-08-31T10:25:16Z")

</div>

Hello [tc1](https://developer.community.nhs.uk/u/tc1)  
Great catch. I have passed this information on to [itoc.supportdesk@nhs.net](mailto:itoc.supportdesk@nhs.net) and [ssd.nationalservicedesk@nhs.net](mailto:ssd.nationalservicedesk@nhs.net) for their attention.

---

<div class="post-metadata">

**Author:** ![tc1](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/tc1/32/83_2.png) [@tc1](https://developer.community.nhs.uk/u/tc1)\
**Post date:** [31 August 2023 14:19 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/3 "2023-08-31T14:19:28Z")

</div>

Could you let them know the curl example on [Message Exchange for Social Care and Health (MESH) API - NHS Digital](https://digital.nhs.uk/developer/api-catalogue/message-exchange-for-social-care-and-health-api#post-/messageexchange/-mailbox_id-) is also using GET instead of POST ?

---

<div class="post-metadata">

**Author:** ![alan.rawlings2](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@alan.rawlings2](https://developer.community.nhs.uk/u/alan.rawlings2)\
**Post date:** [31 August 2023 15:01 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/4 "2023-08-31T15:01:29Z")

</div>

Hello [tc1](https://developer.community.nhs.uk/u/tc1), Will do.

---

<div class="post-metadata">

**Author:** ![tc1](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/tc1/32/83_2.png) [@tc1](https://developer.community.nhs.uk/u/tc1)\
**Post date:** [31 August 2023 16:08 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/5 "2023-08-31T16:08:24Z")

</div>

Thanks !

( post must be at least 20 characters )

---

<div class="post-metadata">

**Author:** ![matt.mercer](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@matt.mercer](https://developer.community.nhs.uk/u/matt.mercer)\
**Post date:** [7 September 2023 10:54 UTC](https://developer.community.nhs.uk/t/mesh-example-python-code-does-not-work/456/6 "2023-09-07T10:54:18Z")

</div>

addressed as part of [mesh-1629: fix auth pseudocode and add request body / response schema… by matt-mercer · Pull Request #119 · NHSDigital/mesh-api-specification · GitHub](https://github.com/NHSDigital/mesh-api-specification/pull/119)