Use the correct API access contract

Who this is for

This is for an authorised application developer, not a route around a user's choices. Individual OAuth is unavailable pending the real provider contract and named-client acceptance. The existing confidential-host flow delegates a consenting person's permitted access. An organisation service key authenticates organisation automation and cannot replace personal consent or impersonate a staff member.

Start here

1. Follow Developer to confirm the purpose, exact registered origins, exact return URLs and approved permissions before using a protected API.
2. Keep application credentials and user delegation server-side. Do not manually construct session cookies, accept a browser-supplied user as authority, or pass an organisation service key into a personal tool.
3. Use the contract supplied for your accepted application. The existing connection contract includes discovery, connection summary, permission request and one-use link exchange. Read-only discovery does not approve an operation or change notification preferences.
4. For a provisioned confidential host, /api/connect/requests starts the host-bound consent sequence; /api/connect/link exchanges its short-lived code once. /api/connect/connection describes that delegated connection and supports its explicit revocation. The host must validate request state and exact registered origin throughout. These are not generic individual OAuth endpoints.
5. Request only current permitted reads. Check the returned source dates, version, rights and gaps before representing a result as applicable. Keep organisation governance within the authorised organisation. Future extended actions need their own accepted interface, permissions and confirmation; a read scope is insufficient.

The downloadable public API specification is not published yet. Its intended help address is /api/connect-abe.openapi.json; this guide does not link that missing artefact as a working download. Ask support for the reviewed contract for your approved project. The repository's existing specification is not a published public API download, and no new service catalogue endpoint is invented here.

/api/connect/mcp currently reports the unavailable provider contract. Existing /api/mcp organisation-service behaviour is a different contract and does not prove individual OAuth or universal assistant compatibility. See MCP.

What success looks like

The exact authenticated actor, registered application, organisation and granted scope permit the intended source-backed read. A dated public PD engine observation does not establish customer-channel acceptance. Neither a service catalogue nor a funding receipt grants access by itself. Permitted link or metadata use does not automatically permit source-body redistribution. Do not send patient information or private criteria to another application without a separately accepted purpose and permission; this reference scope excludes patient data.

If it does not work

Response	Meaning	Next step
401	Authentication is missing or invalid.	Check your own supported sign-in or provisioned credential; do not borrow another user's authority.
402	No current recorded licence for the requested capability.	Check existing funding before another purchase; payment and app consent are separate.
403	Organisation, application, origin, scope or consent is not permitted.	Stop and correct the exact permission problem.
409	Confirmation or revision conflicts with current state.	Read the current record before confirming the same intended change again.
429	An operational limit was reached.	Respect Retry-After; a rate limit is not a quoted paid allowance.
503	Verification, provider or service is unavailable.	Keep it unavailable and contact support; do not switch identity or claim success.

An uncertain side effect is not a definitive failure. Check existing state before repeating it. Report the route, time and safe error to support, without keys, request bodies, private interests or patient information.

Stop or change your choices

Revoke only the intended connection through its supported confirmation flow, then verify the old delegated access is denied. Stop the host locally while remote revocation is pending. Organisation credentials need their separately authorised rotation or revocation; they do not cancel a person's subscription. Saved preferences, app consent and billing cancellation remain separate; use Manage and cancel.