Australian Digital Health Agency · Authentication Profile

Australian Digital Health Agency Authentication

Authentication

Australian Digital Health Agency secures its APIs with mutualTLS, oauth2, and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions.

HealthcareAustraliaNational Health SystemFHIRHL7InteroperabilitySMART on FHIRElectronic Health Recorde-PrescribingTerminologyGovernment

Methods: mutualTLS, oauth2, openIdConnect Schemes: 3 OAuth flows: API key in:

Security Schemes

NASH-PKI-mTLS mutualTLS

SMART-on-FHIR-OAuth2 oauth2

· flows: authorizationCode

OpenIDConnect openIdConnect

Source

Authentication Profile

generated: '2026-07-24'
method: searched
source: >-
  fhir/ncts-terminology-server-capabilitystatement.json (CapabilityStatement.rest.security),
  well-known/australian-digital-health-agency-smart-configuration.json,
  https://implementer.digitalhealth.gov.au/resources/services/national-authentication-service-for-health-nash
summary:
  types: [mutualTLS, oauth2, openIdConnect]
  models:
    - national-record-systems: NASH SHA-2 PKI client certificate over mutual TLS
    - terminology-server: SMART-on-FHIR OAuth2 (authorization code) + OpenID Connect
schemes:
  - name: NASH-PKI-mTLS
    type: mutualTLS
    applies_to:
      - My Health Record FHIR Gateway (B2B)
      - My Health Record FHIR Mobile Gateway
      - Healthcare Identifiers (HI) Service
      - Electronic Prescribing
    description: >-
      Connections to the national record systems are authenticated with a National
      Authentication Service for Health (NASH) SHA-2 PKI certificate presented over
      mutual TLS. NASH certificates are issued to conformant, registered healthcare
      organisations (identified by an HPI-O) after onboarding and conformance testing.
    issuance: Gated — registration + conformance + NASH certificate issuance (Services Australia).
    docs: https://implementer.digitalhealth.gov.au/resources/services/national-authentication-service-for-health-nash
  - name: SMART-on-FHIR-OAuth2
    type: oauth2
    applies_to:
      - NCTS FHIR Terminology Server
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.healthterminologies.gov.au/oauth2/login
        tokenUrl: https://api.healthterminologies.gov.au/oauth2/token
        scopes:
          openid: OpenID Connect authentication
          profile: Basic profile claims
    profile: SMART-on-FHIR (http://docs.smarthealthit.org)
    cors: true
    sources:
      - fhir/ncts-terminology-server-capabilitystatement.json
      - well-known/australian-digital-health-agency-smart-configuration.json
  - name: OpenIDConnect
    type: openIdConnect
    applies_to:
      - NCTS FHIR Terminology Server
    description: The NCTS terminology server advertises the openid scope alongside SMART-on-FHIR OAuth2.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/australian-digital-health-agency-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.