Hm Land Registry Authentication

generated: '2026-07-26'
method: searched
source: openapi/hm-land-registry-estimate-completion-date-openapi.yml, openapi/hm-land-registry-land-register-api-openapi.yml,
  openapi/hm-land-registry-official-copy-document-availability-v1-openapi.json, openapi/hm-land-registry-official-copy-document-availability-v2-openapi.json,
  openapi/hm-land-registry-registered-proprietor-names-openapi.json, openapi/hm-land-registry-submit-application-to-change-the-register-v0.3-openapi.json,
  openapi/hm-land-registry-submit-application-to-change-the-register-v1.0-openapi.json
summary:
  types:
  - http
  - apiKey
  - none
  api_key_in:
  - header
  oauth2_flows: []
  note: 'Three estates, three models, and no OAuth anywhere. Business Gateway is HTTP Basic carried inside
    a mutual-TLS session established with an HMLR-issued client certificate — the certificate is the real
    gate and it is not modelled in any OpenAPI securityScheme. Use land and property data is a simple
    API key in the Authorization header, self-serve on account creation, with a second gate behind it:
    a signed per-dataset licence. The open linked-data platform requires no credential at all. The internal
    Land Register API is the only bearer-token surface and is not a developer product.'
schemes:
- name: basicAuth
  type: http
  scheme: basic
  sources:
  - openapi/hm-land-registry-estimate-completion-date-openapi.yml
  - openapi/hm-land-registry-official-copy-document-availability-v1-openapi.json
  - openapi/hm-land-registry-official-copy-document-availability-v2-openapi.json
  - openapi/hm-land-registry-registered-proprietor-names-openapi.json
  - openapi/hm-land-registry-submit-application-to-change-the-register-v0.3-openapi.json
  - openapi/hm-land-registry-submit-application-to-change-the-register-v1.0-openapi.json
  docs: https://landregistry.github.io/bgtechdoc/rest/get_started/developer_guide/index.html
  note: Username and password for an active Business Gateway user account, sent as HTTP Basic. Only meaningful
    inside the mutual-TLS session; without the client certificate the connection never reaches the point
    of returning 401.
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: UUID
  sources:
  - openapi/hm-land-registry-land-register-api-openapi.yml
  note: Land Register API only, an internal HMLR API. A token is minted per consuming service by the Digital
    Register project team; the consumer must file a Fraud Impact Assessment and must not expose the data
    externally. Not obtainable as a developer.
- name: apiKey
  type: apiKey
  in: header
  parameter_name: Authorization
  sources:
  - openapi/hm-land-registry-use-land-property-data-openapi.yml
  docs: https://use-land-property-data.service.gov.uk/api-documentation
  issuance: Issued automatically on self-serve account creation at https://use-land-property-data.service.gov.uk/registration
  note: 'Sent as the Authorization header on every request; Accept: application/json is advised. Verified
    2026-07-26: calling without it returns HTTP 403 "Access denied: You need to provide your API Key to
    perform this operation".'
- name: mutualTLS
  type: mutualTLS
  sources:
  - documented, not declared in any OpenAPI
  docs: https://landregistry.github.io/bgtechdoc/rest/get_started/developer_guide/index.html
  note: 'A valid client digital certificate issued by Business Gateway must be installed in the client
    key store, and HMLR-issued certificates trusted as root. Probed 2026-07-26: businessgateway.landregistry.gov.uk
    and bgtest.landregistry.gov.uk refuse the TLS handshake without it. This control is invisible to any
    client generated from the published contracts.'
- name: none
  type: none
  sources:
  - apis.yml open-data APIs
  note: The SPARQL 1.1 endpoint and the Price Paid / UK House Price Index Linked Data APIs are anonymous.
    Verified HTTP 200 without credentials on 2026-07-26.
docs:
- https://landregistry.github.io/bgtechdoc/rest/get_started/developer_guide/index.html
- https://landregistry.github.io/bg-dev-pack-redesign/how-to-access-business-gateway
- https://use-land-property-data.service.gov.uk/api-documentation
onboarding:
  business_gateway:
    self_serve: false
    steps:
    - Sign the development licence (request from channelpartners@landregistry.gov.uk).
    - HMLR sends a test SSL certificate to the named technical contact.
    - Build with support from the integration support team.
    - Hold a business e-services account, then contact HMLR for live access.
    docs: https://landregistry.github.io/bg-dev-pack-redesign/how-to-access-business-gateway
  use_land_and_property_data:
    self_serve: true
    steps:
    - Create an account; an API key is issued automatically.
    - Sign the licence for each dataset you want.
    - Pay where the dataset is chargeable.
    docs: https://use-land-property-data.service.gov.uk/registration
  open_data:
    self_serve: true
    steps:
    - None. Call the endpoint.
oauth:
  supported: false
  detail: No oauth2 or openIdConnect scheme anywhere in the estate; no /.well-known/oauth-authorization-server
    or /.well-known/openid-configuration on any host (probed 2026-07-26). scopes/ is therefore intentionally
    absent.