Patient Flags Service - FHIR API - calling-system attribute

API Platform
1

We are invoking the Get patient flags operation on the Patient Flags Service - FHIR API in the INT environment:

https://int.api.service.nhs.uk/patient-flags-api/FHIR/R4/PatientFlag?patient=9449306753

However, the endpoint returns a client error 400 (Bad Request) with body:

{
    "error": {
        "code": 400,
        "message": "A required target attribute 'calling-system' is missing, please send all required attributes"
    }
}

We have confirmed that:

  • request includes all headers as per the documentation and succeeds against Sandbox.
  • request uses Application-restricted access with a valid JWT.
  • API has been added to the application.

As far as we can see the attribute calling-system is not documented.

Is anyone able to advise?

2

Hi, we had a similar issue, NHS E had to add some additional permissions to the DOS entry.

3

Thanks!

I’ll pass that onto NHSE

4

Hello, I am facing the same issue, how did you contact NHS England?
Thank you!

5

Hi

The calling-system you see in the error message isn’t something you add in the request — it’s an application attribute on your API Platform app record.

You’ll need to log a request with the API Platform team via ServiceNOW (registration needed) to add the required attribute/permission to your application in the Digital Onboarding Service (DOS).

Include the following details:

  • Your application name and Client ID
  • The environment (e.g. INT)
  • The API you are calling: Patient Flags Service – FHIR
  • The error you’re seeing (calling-system missing)

The team will update your application’s configuration so that the calling-system attribute is present, which resolves the 400 error.

Hope the above helps.

Thanks,

NHS England API Platform team

Please note: The API Platform team can only address queries relevant to the NHS England API platform, including security, rate limiting, logging, monitoring and alerting. For any API specific queries, please reach out the relevant API teams.