NHS Digital

NHS Digital Referral API

The Referral API from NHS Digital — 2 operation(s) for referral.

GitHub OpenAPI
Business capability
Referral Management BC-2820.10

Operations 2

GET /ServiceRequest Get referral/s for a patient #
GET /ServiceRequest/{id} Get a specific referral #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/nhs-digital/refs/heads/main/openapi/nhs-digital-referral-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/nhs-digital-referral-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

nhs-digital-referral-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  description: This API forms part of the Booking and Referral Standard (BaRS).
  version: 1.0.0
  title: Booking Referral API
  termsOfService: https://developer.nhs.uk/apis/uec-appointments
  contact:
    email: uec.appointmentbooking@nhs.net
    url: https://developer.nhs.uk/apis/uec-appointments
    name: NHS Digital
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://sandbox.api.service.nhs.uk/booking-and-referral/FHIR/R4
  description: Sandbox Server
- url: https://int.api.service.nhs.uk/booking-and-referral/FHIR/R4
  description: Production
- url: https://api.service.nhs.uk/booking-and-referral/FHIR/R4
  description: Integration Server
security:
- OAuth_Token: []
tags:
- name: Referral
paths:
  /ServiceRequest:
    parameters:
    - $ref: '#/components/parameters/RequestId_HParam'
    - $ref: '#/components/parameters/CorrelationId_HParam'
    - $ref: '#/components/parameters/TargetIdentifier_HParam'
    - $ref: '#/components/parameters/RequestingOrganisation_HParam'
    - $ref: '#/components/parameters/RequestingPractitioner_HParam'
    - $ref: '#/components/parameters/RequestingDevice_HParam'
    - $ref: '#/components/parameters/Accept_HParam'
    get:
      tags:
      - Referral
      summary: Get referral/s for a patient
      description: '### Returns service requests for a specified patient


        Use this endpoint to get all service requests for a given patient. All service requests for the specified patient at the specified target endpoint will be returned.


        If a sender wants to cancel a service request, they must perform a read first and amend the response version when updating.'
      operationId: getReferralByPatient
      parameters:
      - $ref: '#/components/parameters/PatientId_QParam'
      - $ref: '#/components/parameters/ServiceRequestId_QParam'
      responses:
        '200':
          description: Success
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/SearchBundleRef'
              example:
                $ref: examples/service_request/GET-success.json
            application/fhir+xml:
              schema:
                $ref: '#/components/schemas/SearchBundleRef'
          headers:
            X-Correlation-Id:
              description: The X-Correlation-Id from the request header, if supplied, mirrored back.
              schema:
                type: string
                format: uuid
                example: 9562466f-c982-4bd5-bb0e-255e9f5e6689
            X-Request-Id:
              description: The X-Request-Id from the request header, if supplied, mirrored back.
              schema:
                type: string
                format: uuid
                example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91
        4XX:
          $ref: '#/components/responses/4XX-BARS'
        5XX:
          $ref: '#/components/responses/5XX-BARS'
  /ServiceRequest/{id}:
    parameters:
    - $ref: '#/components/parameters/RegistryId_Param'
    - $ref: '#/components/parameters/RequestId_HParam'
    - $ref: '#/components/parameters/CorrelationId_HParam'
    - $ref: '#/components/parameters/TargetIdentifier_HParam'
    - $ref: '#/components/parameters/RequestingOrganisation_HParam'
    - $ref: '#/components/parameters/RequestingPractitioner_HParam'
    - $ref: '#/components/parameters/RequestingDevice_HParam'
    - $ref: '#/components/parameters/Accept_HParam'
    get:
      tags:
      - Referral
      summary: Get a specific referral
      description: '### Returns specific service request by id

        Use this endpoint to get a specific service request by its unique id. A service request with the specified identifier at the specified target endpoint will be returned, should it exist.


        If a sender wants to cancel a service request, they must perform a read first, comparing and amending the details prior to performing the update.'
      operationId: getReferral
      responses:
        '200':
          description: Success
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/ServiceRequest'
              example:
                $ref: examples/service_request/id/GET-success.json
            application/fhir+xml:
              schema:
                $ref: '#/components/schemas/ServiceRequest'
          headers:
            X-Correlation-Id:
              description: The X-Correlation-Id from the request header, if supplied, mirrored back.
              schema:
                type: string
                format: uuid
                example: 9562466f-c982-4bd5-bb0e-255e9f5e6689
            X-Request-Id:
              description: The X-Request-Id from the request header, if supplied, mirrored back.
              schema:
                type: string
                format: uuid
                example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91
        4XX:
          $ref: '#/components/responses/4XX-BARS'
        5XX:
          $ref: '#/components/responses/5XX-BARS'
components:
  schemas:
    TargetIdentifier:
      $ref: schemas/TargetIdentifier.yaml
    RequestingPractitionerToken:
      $ref: schemas/RequestingPractitioner.yaml
    OperationalOutcome:
      $ref: schemas/OperationalOutcome.yaml
    SearchBundleRef:
      $ref: schemas/SearchBundleRef.yaml
    RequestingOrganisationToken:
      $ref: schemas/RequestingOrganisation.yaml
    RequestingSoftwareToken:
      $ref: schemas/RequestingSoftware.yaml
    ServiceRequest:
      $ref: schemas/ServiceRequest.yaml
  parameters:
    Accept_HParam:
      name: Accept
      description: The Accept Header must also contain the version of the API required.
      in: header
      required: true
      schema:
        type: string
        example: "'application/fhir+json; version=1.0.0'        \n"
    RequestingDevice_HParam:
      name: NHSD-Requesting-Software
      description: "Requesting Software described in an object based on a FHIR 'Device' resource (Standard Base64 encoded JSON).\nDifferent BaRS Applications may have different standards and requirements for the Access Control which these headers are used for. \n\nThe identifier used, though arbitrary, should be consistent across instances of a product, the name and version of the product should also be accurate and consistent.\n"
      required: true
      in: header
      schema:
        $ref: '#/components/schemas/RequestingSoftwareToken'
    RegistryId_Param:
      name: id
      description: The identifier of the registry object.
      in: path
      schema:
        type: string
        format: uuid
        example: c3f6145e-1a26-4345-b3f2-dccbcba62049
      required: true
      allowEmptyValue: false
    RequestingPractitioner_HParam:
      name: NHSD-Requesting-Practitioner
      description: 'Requesting Practitioner described in an object based on a FHIR ''PractitionerRole'' resource (Standard Base64 encoded JSON).


        This item is not mandatory, however if the information is available it must be included in the request. Only in the event that it is not available, should it be omitted.


        The example given shows a General Practitioner and their SDS Role profile Id.

        '
      required: false
      in: header
      schema:
        $ref: '#/components/schemas/RequestingPractitionerToken'
    RequestingOrganisation_HParam:
      name: NHSD-End-User-Organisation
      description: "Requesting Organization described in an object based on a FHIR 'Organization' resource (Standard Base64 encoded JSON).\nDifferent BaRS Applications may have different standards and requirements for the Access Control which these headers are used for. \nIn the example given an ODS code and the Organisation name is provided. Other identifiers are permitted if required. \n"
      required: true
      in: header
      schema:
        $ref: '#/components/schemas/RequestingOrganisationToken'
    PatientId_QParam:
      name: patient:identifier
      description: 'The patient''s NHS number. The primary identifier of a patient across systems, unique to NHS England and Wales.


        |Type           |Expression|

        |-------             | --------|

        |[token](https://hl7.org/implement/standards/FHIR/search.html#token) |Appointment.participant.actor:identifier |

        '
      required: true
      in: query
      schema:
        type: string
        example: https%3A%2F%2Ffhir.nhs.uk%2FId%2Fnhs-number%7C4857773456
    ServiceRequestId_QParam:
      name: ServiceRequest.identifier
      description: "The unique booking reference number of the refferal, or the Unique GUID/UUID of the referral request. This is not the same as ServiceRequest.id. The preferred format is system|value however a value should be accepted and honoured as per [FHIR guidance](https://www.hl7.org/fhir/search.html#token).\n     \n|Type           |Expression|\n|-------             | --------|\n|[token](https://hl7.org/fhir/R4/servicerequest.html#search) |ServiceRequest.identifier |\n"
      required: false
      in: query
      schema:
        type: string
        example: http%3A%2F%2Fservicerequest.system%7C10000000000
    RequestId_HParam:
      name: X-Request-Id
      description: The X-Request-Id for the request header, when supplied, mirrored back by the receiver.
      required: true
      in: header
      schema:
        type: string
        format: uuid
        example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91
    TargetIdentifier_HParam:
      name: NHSD-Target-Identifier
      description: The identifier of the Target system. A Base64 encoded object containing value and system properties.
      required: true
      in: header
      schema:
        $ref: '#/components/schemas/TargetIdentifier'
    CorrelationId_HParam:
      name: X-Correlation-Id
      description: The X-Correlation-Id for the request header, when supplied, mirrored back by the receiver.
      required: true
      in: header
      schema:
        type: string
        format: uuid
        example: 9562466f-c982-4bd5-bb0e-255e9f5e6689
  responses:
    5XX-BARS:
      description: "Below are examples of potential HTTP status codes and their associated error codes, which could be returned in the event of a fault. \nGuidance on error handling within BaRS can be found [here](https://simplifier.net/guide/nhsbookingandreferralstandard/Home/Design/Design--Core#Error-handling).\n\n| HTTP status | Error code                 | Description |\n| ----------- | -------------------------- | --------------------------------------------- |\n| 500         | REC_SERVER_ERROR           | The receiver server has encountered an Error processing the request. |\n| 500         | PROXY_SERVER_ERROR         | Proxy Error. |\n| 501         | SEND_NOT_IMPLEMENTED       | The Request was not recognized. |\n| 501         | REC_NOT_IMPLEMENTED        | The Receiver did not recognize the request. |\n| 501         | PROXY_NOT_IMPLEMENTED      | The Proxy did not recognize the request. |\n| 503         | REC_UNAVAILABLE            | The Receiver was unavailable to service the request.|\n| 503         | PROXY_UNAVAILABLE          | The Proxy was unavailable to service the request. |\n"
      content:
        application/fhir+json:
          schema:
            $ref: '#/components/schemas/OperationalOutcome'
          example:
            $ref: examples/500-REC.json
      headers:
        X-Correlation-Id:
          description: The X-Correlation-Id from the request header, if supplied, mirrored back.
          schema:
            type: string
            format: uuid
            example: 9562466f-c982-4bd5-bb0e-255e9f5e6689
        X-Request-Id:
          description: The X-Request-Id from the request header, if supplied, mirrored back.
          schema:
            type: string
            format: uuid
            example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91
    4XX-BARS:
      description: "Below are examples of potential HTTP status codes and their associated error codes, which could be returned in the event of a fault. \nGuidance on error handling within BaRS can be found [here](https://simplifier.net/guide/nhsbookingandreferralstandard/Home/Design/Design--Core#Error-handling).\n\n| HTTP status | Error code                 | Description |\n| ----------- | -------------------------- | --------------------------------------------- |\n| 400         | SEND_BAD_REQUEST           | The API was unable to process the request. |\n| 400         | REC_BAD_REQUEST            | The Receiver has responded stating the message was malformed. |\n| 401         | SEND_UNAUTHORIZED          | The API deemed you unauthorized to make this request. |\n| 401         | REC_UNAUTHORIZED           | The receiver deemed you unauthorized to make request. |\n| 403         | SEND_FORBIDDEN             | Missing or Expired Token. |\n| 404         | PROXY_NOT_FOUND            | No related people exist for given NHS number. |\n| 404         | REC_NOT_FOUND              | Patient record for given NHS number has been invalidated and not superseded by another NHS number. |\n| 405         | SEND_METHOD_NOT_ALLOWED    | HTTP Verb is not correct for this scenario.|\n| 405         | REC_METHOD_NOT_ALLOWED     | Receiver does not allow this.|\n| 405         | PROXY_METHOD_NOT_ALLOWED   | Proxy does not allow this.|\n| 406         | SEND_NOT_ACCEPTABLE        | Senders message had an incorrect content type defined for a response.|\n| 408         | REC_TIMEOUT                | The downstream domain processing has not completed within the configured timeout period. |\n| 409         | SEND_CONFLICT              |  |\n| 409         | REC_CONFLICT               |  |\n| 409         | PROXY_CONFLICT             |  |\n| 422         | SEND_UNPROCESSABLE_ENTITY  | Message was not malformed but deemed unprocessable. |\n| 422         | REC_UNPROCESSABLE_ENTITY   | Message was not malformed but deemed unprocessable. |         \n| 422         | PROXY_UNPROCESSABLE_ENTITY | Message was not malformed but deemed unprocessable. |         \n| 429         | SEND_TOO_MANY_REQUESTS     | The user has sent too many requests in a given amount of time|\n| 429         | REC_TOO_MANY_REQUESTS      | The user has sent too many requests in a given amount of time|\n"
      content:
        application/fhir+json:
          schema:
            $ref: '#/components/schemas/OperationalOutcome'
          example:
            $ref: examples/400-SEND.json
      headers:
        X-Correlation-Id:
          description: The X-Correlation-Id from the request header, if supplied, mirrored back.
          schema:
            type: string
            format: uuid
            example: 9562466f-c982-4bd5-bb0e-255e9f5e6689
        X-Request-Id:
          description: The X-Request-Id from the request header, if supplied, mirrored back.
          schema:
            type: string
            format: uuid
            example: c1ab3fba-6bae-4ba4-b257-5a87c44d4a91
  securitySchemes:
    OAuth_Token:
      type: http
      scheme: bearer