NHS Patient Care Aggregator API Integration

When integrating with the Patient Care Aggregator API, it’s important to design for performance and reliability. The API must return referrals and appointments within 1,000ms at the 95th percentile, with waiting times data returned even faster — within 600ms (P95). Integrators must also handle timeouts, rate limits (25 TPS), and HTTP 504 errors appropriately to ensure a responsive and compliant user experience. At 6B, we design integrations to meet or exceed these performance thresholds as defined by NHS England’s non-functional requirements (NFRs).

The Patient Care Aggregator API requires strong patient authentication via NHS login, using either the OAuth 2.0 authorisation code flow or a token exchange with signed JWT. The integration must also propagate the NHS login ID token to downstream systems such as e-RS and Portal APIs. At 6B, we implement robust OAuth 2.0 flows and ensure secure token handling in line with NHS API Platform policies.

Yes — the NHS provides an Integration Test environment for Patient Care Aggregator API integrations, which includes real endpoints and is connected to the NHS login integration (AOS) environment. However, there is no sandbox environment currently available. At 6B, we guide our partners through structured integration testing using NHS-provided data packs and validate the entire patient journey prior to go-live, ensuring a smooth onboarding process.

The API mandates strict information governance protocols. Logs must omit any personal identifiable data (PID) and be shipped to NHSE’s preferred logging systems, with the X-Correlation-ID propagated for traceability. Additionally, log data must be retained for 90 days, and any production access to PID must be restricted to security-cleared personnel. 6B ensures full compliance with these data handling standards through secure DevOps pipelines and logging infrastructure.

Currently, the API enforces an age restriction policy. Any requests made by patients under 16 years old must be met with an HTTP 403 Forbidden response, clearly indicating the age restriction. If your application serves younger users or guardians, 6B can help you implement appropriate user experience flows to handle these exceptions sensitively and compliantly.

If data retrieval is only partially successful — for example, if one provider’s system fails to respond — the API returns an HTTP 207 Multi-Status response. This enables your app to show users what data was retrieved and where gaps exist. At 6B, we build integrations that gracefully handle partial responses and surface meaningful feedback to users without compromising usability or trust.

Because the API aggregates data from multiple secondary care systems via a centralised service, it offers a scalable foundation for patient-facing applications. Rather than managing bespoke integrations with individual trusts, your application accesses unified data through a single national endpoint. 6B helps you architect modular integrations that can scale as more providers are added to the Aggregator or as additional NHS APIs (e.g. GP Connect, Notify) are integrated.

Before going live, your solution must pass clinical and technical assurance, including SCAL (Supplier Conformance Assessment List) submission, contract testing, and operational readiness against defined service levels (Silver+ 99.5% availability). 6B handles all aspects of assurance, from preparing conformance documentation to engaging with NHS England on your behalf to ensure your application meets all go-live requirements.