NHS Website Content API sandbox returning 503 since 20 August

API Platform
1

Hi — the sandbox for the NHS Website Content API appears to have been down for several days. Every endpoint I try returns 503 Service Temporarily Unavailable:

  • https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/ → 503
  • https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/acne/ → 503
  • https://sandbox.api.service.nhs.uk/nhs-website-content/manifest/pages → 503

First seen on the evening of 20 August; still the case on 25 August. The API gateway itself looks healthy — for comparison, https://sandbox.api.service.nhs.uk/hello-world/hello/world returns 200 — so it seems specific to the nhs-website-content sandbox backend.

We have also registered an Integration-test application with the NHS Website Content API product attached (the key is accepted — an unattached key correctly returns no_products), but every int request is then refused by the backend with an Akamai “Access Denied” page for www.nhswebsite-staging.nhs.uk/content-api/... (e.g. reference #18.740e6168). Is integration-test access to this API subject to an approval step or allowlist beyond attaching the product in the onboarding portal?

So, two questions: is the sandbox outage known and when will it be restored — and what are the correct steps to reach the integration-test environment? We are evaluating the API (sandbox application medrics-patient-information; integration-test application “Patient info”) and both routes are currently blocked.

Thanks!

2

Hi @Greta_Gapsyte

Thank you for your query.

A 503 Service Temporarily Unavailable response would not normally indicate an authentication or API key issue. It means the request reached the platform, but the backend service was unavailable or unable to process the request at that time.

I’ve reviewed your applications and can confirm that Patient info is correctly subscribed to the NHS Website Content API (Integration Testing Environment) API and its status is Approved.

The NHS Website Content API is an open-access API, so it does not require OAuth authentication. Access is controlled using the API key issued to your application.

According to the integration testing guidance NHS Website Content API v2 - NHS England Digital, please ensure that:

  • You do not request an OAuth access token for this API.
  • Where the specification asks for an API key, you send it in the apikey request header.

There is no separate approval step for the integration-test environment beyond having an approved application subscribed to the API product.

For medrics-patient-information application, please subscribe the application to the sandbox version of the API if you wish to test against the sandbox environment, and retry.

If the issue is still occurring, please raise it through the NHS England ServiceNow support route, selecting the NHS Website Content API.

It could be a service-side availability issue than a client configuration issue.

To help the relevant team investigate this further, please provide:

  • the full request URL, with credentials removed
  • the HTTP method
  • the complete response headers and body
  • any request or correlation identifier returned in the response
  • confirmation of whether the failure is continuous or intermittent

Thanks,

NHS England API Platform team

Please note: The API Platform team can only address queries relevant to the NHS England API Platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out to the relevant API / Service teams.

3

Hello, thanks for responding

Issue 1 — Integration test: 401 Access Denied from the staging origin

Continuous from first test (24 August ~21:00 BST) through 26 August
20:25 GMT. Same result on every request.

  • Full request URL: https://int.api.service.nhs.uk/nhs-website-content/conditions/acne/
    (also /manifest/pages — identical result)
  • HTTP method: GET
  • Request headers: apikey: <redacted — key of the approved "Patient info" application>, accept: application/json
  • Complete response (captured 26 Aug 2026 20:25 GMT):
HTTP/1.1 401
Date: Wed, 26 Aug 2026 20:25:09 GMT
Content-Type: text/html
Content-Length: 433
Connection: close
Expires: Wed, 26 Aug 2026 20:25:09 GMT
Mime-Version: 1.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
WWW-Authenticate: Basic realm="secure"

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access
"http://www.nhswebsite-staging.nhs.uk/content-api/conditions/acne/"
on this server.<P>
Reference #18.8398645f.1787775909.194a627
<P>https://errors.edgesuite.net/18.8398645f.1787775909.194a627</P>
</BODY>
</HTML>
  • Correlation/reference identifiers: Akamai reference
    #18.8398645f.1787775909.194a627 (26 Aug 20:25 GMT); earlier examples
    #18.21c61002.1787775890.347fda48 (26 Aug 20:24) and
    #18.740e6168 (24 Aug).
  • Observation: the response carries WWW-Authenticate: Basic realm="secure" — the staging origin www.nhswebsite-staging.nhs.uk
    appears to be demanding HTTP Basic authentication at its edge, which an
    API consumer cannot supply. This suggests the gateway-to-origin access
    for the integration environment is misconfigured, rather than a client
    issue. Our apikey is accepted by the gateway itself: before the API
    product was attached, the same requests correctly returned the JSON
    error {"error": "no_products"}, so key transmission in the apikey
    header is working. We do not request an OAuth token.

Issue 2 — Sandbox: 503 Service Temporarily Unavailable

Continuous since the evening of 20 August; still the case 26 August
20:24 GMT.

  • Full request URL: https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/acne/
    (also /conditions/ and /manifest/pages — identical result)
  • HTTP method: GET; request headers: accept: application/json (no
    apikey — sandbox is documented open-access)
  • Complete response (captured 26 Aug 2026 20:24 GMT):
HTTP/1.1 503
Date: Wed, 26 Aug 2026 20:24:50 GMT
Content-Type: text/html
Connection: close
Server: <as returned>
Strict-Transport-Security: max-age=31536000; includeSubDomains

<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body>
<center><h1>503 Service Temporarily Unavailable</h1></center>
</body>
</html>
  • No correlation identifier is present in the sandbox response.
  • The gateway itself is healthy: https://sandbox.api.service.nhs.uk/hello-world/hello/world
    returns 200 throughout the same period.
  • Per the API Platform team’s forum advice (26 Aug), we subscribed the
    sandbox application medrics-patient-information to the sandbox version
    of the API and retried: the 503 is unchanged (identical with and without
    an apikey header, retested 26 Aug immediately after subscribing).

Ask

Please can the relevant team (1) restore the sandbox backend, and
(2) correct integration-test access to the staging origin (or advise if
int consumers require something additional to pass its Basic-auth edge
protection — nothing in the API documentation mentions one).

4

I can confirm I’m seeing the same behaviour on 4 September 2026.

Integration Test:
https://int.api.service.nhs.uk/nhs-website-content/conditions/
returns 401 Unauthorized with WWW-Authenticate: Basic realm="secure" and an Access Denied response from the staging NHS website origin.

Sandbox:
https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/glaucoma
returns 503 Service Temporarily Unavailable.

My Integration Test application has the NHS Website Content API enabled and I am sending the active API key in the documented apikey header.

This appears to match the staging-origin / sandbox outage described above.

5

Following recent information we’ve received from the team responsible for this area, we’ve been advised that this is a known issue affecting the NHS Website Content integration and sandbox APIs and is already being tracked by the relevant teams.

Unfortunately, we do not currently have a confirmed timescale for a resolution.

If you would like your specific case to be logged, please feel free to raise a ServiceNow support ticket, selecting the NHS Website Content API.

Thanks,

NHS England API Platform team

Please note: The API Platform team can only address queries relevant to the NHS England API Platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out to the relevant API / Service teams.