# Unauthorised - 401 eRS Document Retrieval **URL:** \ **Category:** e-Referral Service (e-RS)\ **Tags:** testing\ **Created:** [6 February 2025 16:28 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368 "2025-02-06T16:28:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [6 February 2025 16:28 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/1 "2025-02-06T16:28:48Z")
I am receiving a 401 error when trying to retrieve documents associated with appointments in eRS. CIS2 has been setup and working and using the ID token we call into the developer API platform to get an access token as per [https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/application-restricted-restful-apis-signed-jwt-authentication](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/application-restricted-restful-apis-signed-jwt-authentication) This token is then used as per guidance to call the API e-Referral Service - Application Restricted ( Integration Testing ). Application has been registered as per [https://digital.nhs.uk/services/e-referral-service/api/integration-process/build#2-2-create-and-register-your-application](https://digital.nhs.uk/services/e-referral-service/api/integration-process/build#2-2-create-and-register-your-application). Application ID: ff20dedf-6bef-4b83-8455-4cd3bfe5f01a Can we please get advice on why we get this error and how to proceed. ---
**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\ **Post date:** [7 February 2025 13:02 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/2 "2025-02-07T13:02:44Z")
Hi @jon.goody, Can you confirm you have completed the “API platform configuration” step under [https://digital.nhs.uk/services/e-referral-service/api/integration-process/build#2-2-create-and-register-your-application](https://digital.nhs.uk/services/e-referral-service/api/integration-process/build#2-2-create-and-register-your-application) and had confirmation it has been configured? @nhserspartners FYI Regards, Adam. ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [7 February 2025 14:39 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/3 "2025-02-07T14:39:06Z")
Hi @adam.oldfield Yes this has been followed. Application ID: ff20dedf-6bef-4b83-8455-4cd3bfe5f01a has all details associated with this. Regards Jon ---
**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\ **Post date:** [7 February 2025 17:32 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/4 "2025-02-07T17:32:27Z")
Hi @jon.goody, I don’t see the ASID, Organisation ODS Code or User ID configured on our side. This is done by @nhserspartners off the back of the email sent in the “API platform configuration” step. I’m struggling to track down one of your failed requests on our side using your Application ID. Can you provide the `X-Correlation-ID` of on of your requests so I can trace it? Thanks, Adam. ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [7 February 2025 18:10 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/5 "2025-02-07T18:10:43Z")
Hi @adam.oldfield Details below as requested. ASID: 200000000068 Party Key: RB8-200244 Can you clarify where i can get the X-Correlation-ID from please. Regards Jon ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [10 February 2025 10:30 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/6 "2025-02-10T10:30:20Z")
X-Correlation-ID for last attempt was: 0B03BC5E-E2F8-11EF-9709-005056B4EE83 API Key is also mEGvQWNBpW4Ha3XfzfhVfGhWvnlZXCIO if this helps ---
**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\ **Post date:** [10 February 2025 14:30 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/7 "2025-02-10T14:30:47Z")
Hi @jon.goody, I can see a request using `X-Correlation-ID` `0B03BC5E-E2F8-11EF-9709-005056B4EE83` n the 4/2/2025. This was rejected with a 401 “Invalid access token”. As this failed authorisation it isn’t getting as far as the e-RS API. If you need support troubleshooting the token generation flow please contact APIM/API Platform support. Regards, Adam. ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [10 February 2025 14:47 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/8 "2025-02-10T14:47:23Z")
Thanks @adam.oldfield Here is another X-Correlation-ID: DDEB6F08-E2F4-11EF-9705-005056B4EE83 I am slightly confused on how this is being classed as invalid access token. We are successfully authenticating with the NHS Developer API which returns this access token. This is then passed onto the eRS API. Regards Jon ---
**Author:** ![andrew.clayton3](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@andrew.clayton3](https://developer.community.nhs.uk/u/andrew.clayton3)\ **Post date:** [11 February 2025 07:31 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/9 "2025-02-11T07:31:41Z")
Hi In theory all should already be in place but as the respective environments (Intersystems and NHSE INT) are invisible to me, all I can do is ‘do it again’. I have this morning requested that the App ID is bound to ASID 200000000068 and will update this ticket when it is confirmed back to me that this is complete. Kind regards Andrew ---
**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\ **Post date:** [11 February 2025 07:50 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/10 "2025-02-11T07:50:20Z")
> [@jon.goody](#): > > Thanks @adam.oldfield > Here is another X-Correlation-ID: DDEB6F08-E2F4-11EF-9705-005056B4EE83 > > I am slightly confused on how this is being classed as invalid access token. We are successfully authenticating with the NHS Developer API which returns this access token. This is then passed onto the eRS API. > > Regards > Jon Hi @jon.goody, It looks like the request with that correlation ID has the same issue. You are best speaking with APIM support where they can help you debug the issue. @andrew.clayton3 are you able to help put Jon in touch with someone at APIM? @andrew.clayton3 It doesn’t look like the ASID is bound to the Application, however I don’t think this would cause this specific issue. However would cause an issue later down the line. It looks like Jon is wanting to use application-restricted access so will need the additional properties configuring too. Regards, Adam. ---
**Author:** ![andrew.clayton3](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@andrew.clayton3](https://developer.community.nhs.uk/u/andrew.clayton3)\ **Post date:** [11 February 2025 09:01 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/11 "2025-02-11T09:01:19Z")
@adam.oldfield hi - I have submitted the binding request. As Yeovil is User Restricted in live I have gone down the User Restricted route (and not App Restricted) when going back to INT. I’ll look back through paperwork re App Restricted. Cheers ---
**Author:** ![andrew.clayton3](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@andrew.clayton3](https://developer.community.nhs.uk/u/andrew.clayton3)\ **Post date:** [11 February 2025 11:49 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/12 "2025-02-11T11:49:36Z")
hi - this binding is complete for User Restricted (Yeovil is User Restricted in the Prod environment) ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [11 February 2025 16:25 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/13 "2025-02-11T16:25:06Z")
Hi @andrew.clayton3 We have attempted to run again and still getting a 401 error. When we connect to the Developer API we get the access token based on CIS2 ID token. So from what i can see this part is working correctly. See JSON payload response from API call: {“access\_token”:“a7BZ0eNUBIFYbSyzDf53ECrmSk65”,“expires\_in”:“599”,“token\_type”:“Bearer”,“issued\_token\_type”:“urn:ietf:params:oauth:token-type:access\_token”,“refresh\_token”:“t39ug2qqxqLBBvdICRA2bBDnDV48783A”,“refresh\_token\_expires\_in”:“43199”,“refresh\_count”:“0”} We then use this access token along with the X-Correlation-ID (sessionId) to call the Referral Service: ![image](https://europe1.discourse-cdn.com/nhsdigitaldeveloper/original/1X/b9481bf5728a11cb3f8144b60173d504284bf046.png) Response: ![image](https://europe1.discourse-cdn.com/nhsdigitaldeveloper/original/1X/b73451cfbc93e2b09764bf01740e61593f5a7666.png) From the application: ![image](https://europe1.discourse-cdn.com/nhsdigitaldeveloper/original/1X/825b2b0e81daf81970eea1cb1fa4400a5ab43d13.png) The connected services: Application ID: ff20dedf-6bef-4b83-8455-4cd3bfe5f01a API Key: mEGvQWNBpW4Ha3XfzfhVfGhWvnlZXCIO ![image](https://europe1.discourse-cdn.com/nhsdigitaldeveloper/original/1X/5caa8c7c9964628c7c8ec3f90f6ea39cb4b03214.png) Would it be best to organise a call to discuss further and help understand what is missing. Please note this is internal setup and not at Yeovil. Regards Jon ---
**Author:** ![adam.oldfield](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/adam.oldfield/32/327_2.png) [@adam.oldfield](https://developer.community.nhs.uk/u/adam.oldfield)\ **Post date:** [12 February 2025 08:30 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/14 "2025-02-12T08:30:34Z")
Hi @jon.goody, If you are not using Application Restricted access can you try removing it from the “Connected APIs” associated with your Application? It may not help but just want to rule it out. Thanks, Adam. ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [12 February 2025 09:59 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/15 "2025-02-12T09:59:07Z")
Thanks @adam.oldfield I have removed the application restricted service and retested. Unfortunately I still get same error. Can we organise a call if possible to establish how we move forward. Regards Jon ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [15 February 2025 16:19 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/16 "2025-02-15T16:19:13Z")
Hi @adam.oldfield / @andrew.clayton3 I have reviewed the details of our setup and from what i can see it looks correct. Launch application and authenticate with smartcard using CIS2. CIS2 OAuth URL: [https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare](https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare) Get ID Token once authenticated. Then call Developer API exchanging ID Token with access token. Developer API OAuth2: URL: [https://int.api.service.nhs.uk/oauth2/token](https://int.api.service.nhs.uk/oauth2/token) Once access token received from developer API pass onto the eReferral service API. eReferral Service API: server is [int.api.service.nhs.uk](http://int.api.service.nhs.uk) URL /referrals/FHIR I have also added an additional service (Booking and Referral FHIR API) to our API just in case it is needed. Can you confirm what is defined below is correct. ![image](https://europe1.discourse-cdn.com/nhsdigitaldeveloper/original/1X/a3fae6e945245d6a8c40ac66ccc6af7a7b4f7ac5.png) Can you confirm this looks right and what next steps are to establish why 401 errors are still occuring. Regards Jon ---
**Author:** ![sophie.clayton12](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/sophie.clayton12/32/45_2.png) [@sophie.clayton12](https://developer.community.nhs.uk/u/sophie.clayton12)\ **Post date:** [20 February 2025 15:17 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/17 "2025-02-20T15:17:54Z")
Hi Jon, I’m from the API management team and would like to help with your query. From the steps you have detailed they sound right to me ([https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-nhs-cis2-separate-authentication-and-authorisation#top](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-nhs-cis2-separate-authentication-and-authorisation#top)) From our logs I can see successful requests to get the access token, however it appears that when you call e-RS with the access token I cannot see any authentication metadata coming through that indicates you have authenticated with a smart card. Please let me know your availability, lets try and arrange a teams call to screen share and go through the issue Kind regards, Sophie ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [20 February 2025 22:09 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/18 "2025-02-20T22:09:36Z")
Hi @sophie.clayton12 Thanks for getting back to me. A call to walk through this sounds perfect. I will need others on the call too. Available dates and times currently available: Monday 2-5 Tuesday 9-10:30, 4-5 Wednesday 11-12, 2-5 If you can let me know which ones work for you I can liaise with my colleagues to firm up best option. Regards Jon ---
**Author:** ![sophie.clayton12](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/sophie.clayton12/32/45_2.png) [@sophie.clayton12](https://developer.community.nhs.uk/u/sophie.clayton12)\ **Post date:** [21 February 2025 08:22 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/19 "2025-02-21T08:22:12Z")
Hi Jon, Sounds good! Looking at the timeslots I can do Monday 3-5, Tuesday 4-5 or Wednesday 4-5. Once firmed up with your colleagues, please message me your preferred time and email and I’ll send over an invite. Kind regards, Sophie ---
**Author:** ![jon.goody](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jon.goody](https://developer.community.nhs.uk/u/jon.goody)\ **Post date:** [21 February 2025 08:52 UTC](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368/20 "2025-02-21T08:52:48Z")
Thanks @sophie.clayton12 Can we please go for Monday at 3-4. If you send email to me at [Jon.goody@intersystems.com](mailto:Jon.goody@intersystems.com) I can forward on to the others. Many thanks Jon [Next page](https://developer.community.nhs.uk/t/unauthorised-401-ers-document-retrieval/4368.md?page=2)