# NHS Website Content API sandbox returning 503 since 20 August

**URL:** <https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763>\
**Category:** API Platform\
**Tags:** onboarding\
**Created:** [25 August 2026 09:40 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763 "2026-08-25T09:40:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Greta\_Gapsyte](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@Greta\_Gapsyte](https://developer.community.nhs.uk/u/Greta_Gapsyte)\
**Post date:** [25 August 2026 09:40 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763/1 "2026-08-25T09:40:19Z")

</div>

Hi — the sandbox for the NHS Website Content API appears to have been down for several days. Every endpoint I try returns `503 Service Temporarily Unavailable`:

- `https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/` → 503
- `https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/acne/` → 503
- `https://sandbox.api.service.nhs.uk/nhs-website-content/manifest/pages` → 503

First seen on the evening of 20 August; still the case on 25 August. The API gateway itself looks healthy — for comparison, `https://sandbox.api.service.nhs.uk/hello-world/hello/world` returns 200 — so it seems specific to the nhs-website-content sandbox backend.

We have also registered an Integration-test application with the NHS Website Content API product attached (the key is accepted — an unattached key correctly returns `no_products`), but every int request is then refused by the backend with an Akamai “Access Denied” page for `www.nhswebsite-staging.nhs.uk/content-api/...` (e.g. reference #18.740e6168). Is integration-test access to this API subject to an approval step or allowlist beyond attaching the product in the onboarding portal?

So, two questions: is the sandbox outage known and when will it be restored — and what are the correct steps to reach the integration-test environment? We are evaluating the API (sandbox application `medrics-patient-information`; integration-test application “Patient info”) and both routes are currently blocked.

Thanks!

---

<div class="post-metadata">

**Author:** ![Clarissa\_John](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@Clarissa\_John](https://developer.community.nhs.uk/u/Clarissa_John)\
**Post date:** [26 August 2026 11:12 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763/2 "2026-08-26T11:12:31Z")

</div>

Hi @Greta_Gapsyte

Thank you for your query.

A **503 Service Temporarily Unavailable** response would not normally indicate an authentication or API key issue. It means the request reached the platform, but the backend service was unavailable or unable to process the request at that time.

I’ve reviewed your applications and can confirm that **Patient info** is correctly subscribed to the NHS Website Content API (Integration Testing Environment) API and its status is **Approved**.

The NHS Website Content API is an open-access API, so it does not require OAuth authentication. Access is controlled using the API key issued to your application.

According to the integration testing guidance [NHS Website Content API v2 - NHS England Digital](https://digital.nhs.uk/developer/api-catalogue/nhs-website-content/v2), please ensure that:

- You do **not** request an OAuth access token for this API.
- Where the specification asks for an API key, you send it in the **`apikey`** request header.

There is no separate approval step for the integration-test environment beyond having an approved application subscribed to the API product.

For **medrics-patient-information** application, please subscribe the application to the **sandbox** version of the API if you wish to test against the sandbox environment, and retry.

If the issue is still occurring, please raise it through the NHS England ServiceNow support route, selecting the NHS Website Content API.

- **Link** : [Customer Service Portal - Customer Support](https://www.support.digitalservices.nhs.uk/csm)
- Or **Email:** [ssd.nationalservicedesk@nhs.net](mailto:ssd.nationalservicedesk@nhs.net)
- **Telephone:** 0300 303 5035

It could be a service-side availability issue than a client configuration issue.

To help the relevant team investigate this further, please provide:

- the full request URL, with credentials removed
- the HTTP method
- the complete response headers and body
- any request or correlation identifier returned in the response
- confirmation of whether the failure is continuous or intermittent

Thanks,

**NHS England API Platform team**

**Please note: The API Platform team can only address queries relevant to the NHS England API Platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out to the relevant API / Service teams.**

---

<div class="post-metadata">

**Author:** ![Greta\_Gapsyte](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@Greta\_Gapsyte](https://developer.community.nhs.uk/u/Greta_Gapsyte)\
**Post date:** [26 August 2026 20:41 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763/3 "2026-08-26T20:41:29Z")

</div>

Hello, thanks for responding

## Issue 1 — Integration test: 401 Access Denied from the staging origin

Continuous from first test (24 August ~21:00 BST) through 26 August  
20:25 GMT. Same result on every request.

- Full request URL: `https://int.api.service.nhs.uk/nhs-website-content/conditions/acne/`  
(also `/manifest/pages` — identical result)
- HTTP method: GET
- Request headers: `apikey: <redacted — key of the approved "Patient info" application>`, `accept: application/json`
- Complete response (captured 26 Aug 2026 20:25 GMT):

```auto
HTTP/1.1 401
Date: Wed, 26 Aug 2026 20:25:09 GMT
Content-Type: text/html
Content-Length: 433
Connection: close
Expires: Wed, 26 Aug 2026 20:25:09 GMT
Mime-Version: 1.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
WWW-Authenticate: Basic realm="secure"

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access
"http://www.nhswebsite-staging.nhs.uk/content-api/conditions/acne/"
on this server.<P>
Reference #18.8398645f.1787775909.194a627
<P>https://errors.edgesuite.net/18.8398645f.1787775909.194a627</P>
</BODY>
</HTML>

```

- Correlation/reference identifiers: Akamai reference  
`#18.8398645f.1787775909.194a627` (26 Aug 20:25 GMT); earlier examples  
`#18.21c61002.1787775890.347fda48` (26 Aug 20:24) and  
`#18.740e6168` (24 Aug).
- Observation: the response carries `WWW-Authenticate: Basic realm="secure"` — the staging origin `www.nhswebsite-staging.nhs.uk`  
appears to be demanding HTTP Basic authentication at its edge, which an  
API consumer cannot supply. This suggests the gateway-to-origin access  
for the integration environment is misconfigured, rather than a client  
issue. Our `apikey` is accepted by the gateway itself: before the API  
product was attached, the same requests correctly returned the JSON  
error `{"error": "no_products"}`, so key transmission in the `apikey`  
header is working. We do not request an OAuth token.

## Issue 2 — Sandbox: 503 Service Temporarily Unavailable

Continuous since the evening of 20 August; still the case 26 August  
20:24 GMT.

- Full request URL: `https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/acne/`  
(also `/conditions/` and `/manifest/pages` — identical result)
- HTTP method: GET; request headers: `accept: application/json` (no  
apikey — sandbox is documented open-access)
- Complete response (captured 26 Aug 2026 20:24 GMT):

```auto
HTTP/1.1 503
Date: Wed, 26 Aug 2026 20:24:50 GMT
Content-Type: text/html
Connection: close
Server: <as returned>
Strict-Transport-Security: max-age=31536000; includeSubDomains

<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body>
<center><h1>503 Service Temporarily Unavailable</h1></center>
</body>
</html>

```

- No correlation identifier is present in the sandbox response.
- The gateway itself is healthy: `https://sandbox.api.service.nhs.uk/hello-world/hello/world`  
returns 200 throughout the same period.
- Per the API Platform team’s forum advice (26 Aug), we subscribed the  
sandbox application `medrics-patient-information` to the sandbox version  
of the API and retried: the 503 is unchanged (identical with and without  
an `apikey` header, retested 26 Aug immediately after subscribing).

## Ask

Please can the relevant team (1) restore the sandbox backend, and  
(2) correct integration-test access to the staging origin (or advise if  
int consumers require something additional to pass its Basic-auth edge  
protection — nothing in the API documentation mentions one).

---

<div class="post-metadata">

**Author:** ![Abdelrahman\_Abdellat](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@Abdelrahman\_Abdellat](https://developer.community.nhs.uk/u/Abdelrahman_Abdellat)\
**Post date:** [8 September 2026 10:33 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763/4 "2026-09-08T10:33:26Z")

</div>

I can confirm I’m seeing the same behaviour on 4 September 2026.

Integration Test:  
`https://int.api.service.nhs.uk/nhs-website-content/conditions/`  
returns `401 Unauthorized` with `WWW-Authenticate: Basic realm="secure"` and an Access Denied response from the staging NHS website origin.

Sandbox:  
`https://sandbox.api.service.nhs.uk/nhs-website-content/conditions/glaucoma`  
returns `503 Service Temporarily Unavailable`.

My Integration Test application has the NHS Website Content API enabled and I am sending the active API key in the documented `apikey` header.

This appears to match the staging-origin / sandbox outage described above.

---

<div class="post-metadata">

**Author:** ![Clarissa\_John](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@Clarissa\_John](https://developer.community.nhs.uk/u/Clarissa_John)\
**Post date:** [10 September 2026 13:59 UTC](https://developer.community.nhs.uk/t/nhs-website-content-api-sandbox-returning-503-since-20-august/14763/5 "2026-09-10T13:59:29Z")

</div>

Following recent information we’ve received from the team responsible for this area, we’ve been advised that this is a known issue affecting the NHS Website Content integration and sandbox APIs and is already being tracked by the relevant teams.

Unfortunately, we do not currently have a confirmed timescale for a resolution.

If you would like your specific case to be logged, please feel free to raise a ServiceNow support ticket, selecting the NHS Website Content API.

- **Link** : [Customer Service Portal - Customer Support](https://www.support.digitalservices.nhs.uk/csm)
- Or **Email:** [ssd.nationalservicedesk@nhs.net](mailto:ssd.nationalservicedesk@nhs.net)
- **Telephone:** 0300 303 5035

Thanks,

**NHS England API Platform team**

**Please note: The API Platform team can only address queries relevant to the NHS England API Platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out to the relevant API / Service teams.**