NHS Digital Onboarding Service -

This stage verifies that your system can successfully, securely, and reliably exchange data with the National Imaging Registry (NIR). It covers API conformance, and the Integration (INT) Environment testing required to prove readiness before Go/No-Go meetings and live production credentials are issued.

Help and tips for completing this section

mTLS Certificates: Secure connectivity relies on mutual TLS. One of the most common causes of technical failure is expired certificates. Ensure network teams have a documented process for monitoring and proactively renewing these certificates before they expire.

INT Environment Testing: A supplier cannot be granted live production access until their version has undergone Integration (INT) Environment testing. This is triggered by the Data Controller after they have signed their Data Sharing Arrangement with Acceptable Usage Policy and received evidence of a suppliers Technical Conformance Certificate for their version.

Scope: Suppliers should only test and declare the specific API profiles that align with the approved use case (Provider, Consumer, or both). If technical scope changes later, re-approval via DOS is required.

Audit Logs: Suppliers will need to confirm that their system has robust event logging in place which will be evidenced within this section.

Q.1

Are you onboarding as a Data Processor (Supplier) or a Data Controller (End User Organisation)?

Supporting information

Your selection determines the information required during digital onboarding. It directly reflects your clinical safety obligations, legal responsibilities for the NHSE integration, and the specific technical assurance steps you must complete.

Data Processor (Supplier): Typically a software vendor or IT provider. You process data strictly on behalf of the Data Controller. You sign the Connection Agreement with NHSE and assure your product and version are compliant with NHS standards. Your onboarding focuses on technical conformance, security, and product-level clinical safety (DCB0129).

Data Controller (End User Organisation): Typically a Trust, Healthcare Organisation, Imaging Network, or other entity that generates diagnostic data and makes clinical decisions on behalf of patients. You determine the purpose of the data, hold the direct relationship with the patient, and are responsible for local IG approvals (e.g., DPIA, signing the Data Sharing Arrangement). You are also responsible for organisation-level clinical safety (DCB0160).

Data Processor

Data Controller

Q.2

Confirm your connection type

Supporting information

Provider: Your system will publish or supply imaging metadata and records to the National Imaging Registry. This allows local patient imaging history generated at your End User Organisations (EUOs) to be discovered by the wider NHS network.

Consumer: Your system will query and retrieve imaging metadata and records from the National Imaging Registry. This allows your users to search for and view a patient's imaging history that was generated at other external NHS trusts.

Both (Provider & Consumer): Your system will perform a bidirectional integration, contributing local imaging data to the national registry while simultaneously querying the registry to pull external patient records into the local workflow.

Your answer should match your initial selection in Stage 1 of this digital onboarding process.

Provider

Consumer

Both

Q.3

Single result response: XCA/ITI-38 query against the NIR Sandbox, handle successful query response with single result:

Prove the system can execute a successful query for test patient 9694116422 and a single search result is obtained. Example request in Postman Collection: Cross Gateway Query: Single Document From A Single Network (PDF)

Supporting information

Evidence: Upload the response from your system. If your system has a UI, display or viewer component, please include a screenshot of the query results displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.4

Single result response: XCA/ITI-38 - Demonstrate a successful query response from your system for patient with single result:

Provide an example response from your system for an ITI-38 query for a patient with a single result. See the response portion for the example request in Postman Collection: Cross Gateway Query: Single Document From A Single Network (PDF) for an example of the expected format.

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.5

Multiple results response: XCA/ITI-38 query against the NIR Sandbox, handle successful query response with multiple results from a single downstream responding gateway:

Prove the system can execute a successful query for test patient 9898841141 and 2 search results are obtained. Example request in Postman Collection: Cross Gateway Query: Multiple Documents From A Single Network (PDF, DICOM)

Supporting information

Evidence: Upload the response from your system. If your system has a UI, display or viewer component, please include a screenshot of the query results displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.6

Multiple results - XCA/ITI-38 Demonstrate a successful query response from your system for patient with multiple results from a single downstream responding gateway:

Provide an example response from an ITI-38 query for a patient with multiple results. See the response portion for the example request in Postman Collection: Cross Gateway Query: Multiple Documents From A Single Network (PDF, DICOM) for an example of the expected format.

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.7

Multiple responding networks - XCA/ITI-38 query against the NIR Sandbox, handle successful query response with multiple results from multiple responding gateways:

Prove the system can execute a successful query for test patient 9932549118 and 2 search results are obtained. Example request in Postman Collection: Cross Gateway Query: Documents From Multiple Networks (PDF, DICOM, DICOM KOS)

Supporting information

Evidence: Upload the response from your system. If your system has a UI, display or viewer component, please include a screenshot of the query results displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.8

Zero results - XCA/ITI-38 query against the NIR Sandbox, handle successful query response with 0 results:

Prove the system can execute a successful query for test patient 9646337317 and 0 search results are obtained by uploading the response from your system. Example request in Postman Collection: Cross Gateway Query: No Documents Registered.

Supporting information

Evidence: Upload the response from your system. If your system has a UI, display or viewer component, please include a screenshot of the query results displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.9

Zero results - XCA/ITI-38 query, return successful query response with 0 results:

Provide an example response from your system for an ITI-38 query for a patient with zero results. See the response portion for the example request in Postman Collection: Cross Gateway Query: No Documents Registered.

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.10

Document Retrieval: XCA/ITI-39 retrieve against the NIR Sandbox, handle successful retrieve response:

Prove the system can successfully retrieve associated diagnostics documentation. Use one or more of the results obtained previously through an ITI-38 Query to demonstrate a successful document retrieval, depending on what file types your system supports.

Example requests in Postman Collection:
Cross Gateway Retrieve: Single Document From A Single Network (TEXT)
Cross Gateway Retrieve: Multiple Documents From a Single Network - Document 1 (DICOM)
Cross Gateway Retrieve: Multiple Documents From a Single Network - Document 2 (PDF)

Supporting information

Evidence: Upload the response from your system. If your system has a UI, display or viewer component, please include a screenshot of the retrieved document as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.11

Image Retrieval, XCA/ITI-39 retrieve of KOS object followed by XCA-I/RAD-75 retrieve of DICOM from NIR Sandbox

Demonstrate retrieval and display of a single imaging object.

Retrieve the KOS manifest via ITI-39 using homeCommunityId: urn:oid:1.2.34.567.8.1, repositoryUniqueId: 1.1.4567332.1.7, documentUniqueId: 2.25.90214658647374166344513344800741000001. Parse the KOS and extract the referenced StudyInstanceUID / SeriesInstanceUID. Using those, issue a RAD-75 request to retrieve the DICOM. Expected result: a valid DICOM object (MR Brain) is returned"

Example requests in Postman Collection:
ITI-39: “Cross Gateway Retrieve: Single Document From a Single Network (DICOM KOS OBJECT)"
RAD-75: "RAD75 Image Study Retrieve: Single DICOM Study Retrieve (MRBRAIN)"

Supporting information

Evidence: Technical logs showing successful KOS manifest retrieval and subsequent DICOM retrieval. If your system has a UI, display or viewer component, please include a screenshot of the retrieved MRBRAIN DICOM rendered in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.11

Image Retrieval : XCA/ITI-39 retrieve of KOS object followed by XCA-I/RAD-75 retrieve of DICOM.

Provide an example request and response for a RAD-75 image retrieve transaction from your system, with the accompany KOS manifest.

See the request and response portions for an example request and response in the Postman Collection.

Example requests in Postman Collection:
"RAD75 Image Study Retrieve: Single DICOM Study Retrieve (MRBRAIN)"

Supporting information

Evidence: Technical logs showing successful DICOM retrieval, a file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.12

Image retrieval errors - XCA-I/RAD-75 retrieve, Demonstrate that your system can gracefully handle errors from NIR:

Demonstrate that an appropriate error message is displayed for the failed retrieval of a single imaging object.

Make a request to retrieve the DICOM via RAD-75 using studyInstanceUID: 1.3.46.670589.11.0.1.1996082307380000, seriesInstanceUID: 1.3.46.670589.11.0.2.1996082307380000, homeCommunityId: urn:oid:1.2.34.567.8.1, repositoryUniqueId: 1.3.6.1.4.1.21367.13.71.201.1, documentUniqueId: 1.3.46.670589.11.0.4.1996082307380000

Example requests in Postman Collection:
"RAD75 Image Study Retrieve: Error - Invalid DICOM Study Instance ID"

Supporting information

Evidence: Upload the error response from your system. If your system has a UI, display or viewer component, please include a screenshot of the error messages as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.12

Image retrieval errors - XCA-I/RAD-75 retrieve, Demonstrate a RAD-75 retrieval error from your system:

Provide an example response containing an error in response to a failed RAD-75 image retrieve transaction from your system, e.g. for an invalid DICOM Study Instance Id

Example requests in Postman Collection:
"RAD75 Image Study Retrieve: Error - Invalid DICOM Study Instance ID"

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.13

Document Retrieval - XCA/ITI-39, Demonstrate a successful document retrieval response from your system:

Provide an example response from an ITI-39 retrieve transaction for a document.
See the response portions for the example requests in Postman Collection:
Cross Gateway Retrieve: Single Document From A Single Network (TEXT)
Cross Gateway Retrieve: Multiple Documents From a Single Network - Document 1 (DICOM)
Cross Gateway Retrieve: Multiple Documents From a Single Network - Document 2 (PDF)

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.14

Partial Success - XCA/ITI-38 query, Handle query results with partial success (some communities respond with results, others fail):

Confirm that your system can gracefully display query results in the case where some but not all downstream communities have responded with errors

Supporting information

Select yes or no. This will be evidenced during integration testing.

Yes

No

Q.15

Registry Errors - XCA/ITI-38 query, Demonstrate that your system can gracefully handle errors from NIR:

Prove the system can gracefully handle registry errors. Trigger a registry error response from the NIR Sandbox by making a query with an unsupported availability status, i.e. 'urn:oasis:names:tc:ebxml-regrep:StatusType:Deprecated’.

Example request in Postman Collection: Cross Gateway Query: Error - Unsupported Availability Status.

Supporting information

Evidence: Upload the error response from your system. If your system has a UI, display or viewer component, please include a screenshot of the error messages as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.16

Registry Errors - XCA/ITI-38 query, Demonstrate a registry error from your system:

Provide an example response containing an XCA registry error from your system in response to an ITI-38 query.

Supporting information

Evidence: Upload a text file containing the error response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.17

Repository errors - XCA/ITI-39 retrieve, Demonstrate that your system can gracefully handle errors from NIR:

Prove the system can gracefully handle repository errors. Trigger a repository error response from the NIR Sandbox by making a retrieval against invalid repository id: 1.1.4567332.1.3. Example requests in Postman Collection: Cross Gateway Retrieve: Error - Repository Id Not Found.

Supporting information

Evidence: Upload the error response from your system. If your system has a UI, display or viewer component, please include a screenshot of the error messages as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.18

Repository errors - XCA/ITI-39 retrieve, Demonstrate a repository error from your system:

Provide an example response containing an XCA repository error in response to an ITI-39 document retrieval request , e.g. for an invalid repository id.

See the response portions for the example requests in Postman Collection: Example requests in Postman Collection: Cross Gateway Retrieve: Error - Repository Id Not Found

Supporting information

Evidence: Upload a text file containing the error response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.19

HTTP level errors - Demonstrate that your system can gracefully handle HTTP level errors from NIR:

Make an ITI-38 request to https://sandbox.nir.national.nhs.uk/does-not-exist prior to onboarding to live to demonstrate that your system can handle an unsuccessful HTTP status response

Supporting information

Evidence: Upload the error response from your system. If your system has a UI, display or viewer component, please include a screenshot of the error messages as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.20

HTTP level errors - Demonstrate that your system returns HTTP level errors appropriately.

Provide an example response of your system returning a non-200 status code, e.g. 443, 404

Supporting information

Evidence: Upload a text file containing the error response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.21

SOAP Faults - Demonstrate that your system can gracefully handle SOAP faults from NIR:

Make an invalid request to the NIR Sandbox environment, e.g. an ITI-38 request to the ITI-39 endpoint or a request containing invalid XML, to demonstrate that your system can handle SOAP faults.

Supporting information

Evidence: Upload the error response from your system. If your system has a UI, display or viewer component, please include a screenshot of the error messages as displayed in your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.22

SOAP Faults - Demonstrate that your system returns SOAP Faults appropriately.

Provide an example response of your system returning a SOAP Fault, for example, for failed authentication or validation.

Supporting information

Evidence: Upload a text file containing the response from your system. This must be from a test system. Do not upload production or patient data.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.23

XUA SAML Assertions:

Provide an example of the XUA SAML Assertions that your system sends in a request. This must be from a test system. Do not upload real data.

Supporting information

Evidence: Upload a text file

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.24

WS-Security:

Confirm that your system conforms to the WS-Security and XUA SAML requirements in XCA requests as documented here: https://digital.nhs.uk/developer/api-catalogue/national-imaging-registry-api/xca-saml-requirements-guide/xca-saml-and-ws-security-requirements.

Yes

No

Q.25

XUA SAML / WS-Security

Demonstrate that your system is able to comply with NIR’s SAML requirements. Confirm that your system meets the requirements outlined on this page for XUA SAML assertions: https://digital.nhs.uk/developer/api-catalogue/national-imaging-registry-api/xca-saml-requirements-guide/xca-saml-and-ws-security-requirements and provide an example of the XUA SAML Assertions that your system sends in a request. This must be from a test system. Do not upload real data.

Supporting information

Evidence: Upload a text file

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.25

XUA SAML / WS-Security

Confirm that your system is able to handle requests that follow the requirements outlined on this page for XUA SAML assertions: https://digital.nhs.uk/developer/api-catalogue/national-imaging-registry-api/xca-saml-requirements-guide/xca-saml-and-ws-security-requirements.

Yes

No

Q.26

WS-Security Requirements

Demonstrate that your system is able to comply with NIR's WS-Security requirements. Confirm that your system meets the requirements outlined on this page for providing signed requests with WS-Security: https://digital.nhs.uk/developer/api-catalogue/national-imaging-registry-api/xca-saml-requirements-guide/xca-saml-and-ws-security-requirements and provide a request as output by your system containing the complete SOAP envelope (including both the header and body) that demonstrates this for ITI-38/ITI-39/RAD-75. This must be from a test system. Do not upload real data.

Supporting information

Evidence: Upload a text file

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Q.26

WS-Security Requirements

Confirm that your system is able to handle requests signed with WS-Security that follow the requirements outlined on this page: https://digital.nhs.uk/developer/api-catalogue/national-imaging-registry-api/xca-saml-requirements-guide/xca-saml-and-ws-security-requirements.

Yes

No

Q.27

mTLS Requirements

Confirm your system can present a client certificate and authenticate using mTLS on outbound connections to NIR

Yes

No

Q.28

mTLS Requirements

Confirm your system accepts and validates client certificates on inbound connections from NIR when authenticated using mTLS.

Yes

No

Q.2

Please confirm that appropriate user training materials and a deployment plan have been developed and approved for your local users.

Supporting information

Effective training is a critical mitigation for clinical risk. Before connecting to the live network, your organisation must ensure that end-users understand how to use the new NIR features safely. This includes knowing how to search for external imaging, how to handle data mismatches, and how to interpret error messages. You do not need to upload the materials here, but you must confirm they are ready for deployment. Connecting vendors are required to provide updated training materials related to NIR.

Yes

No

Q.3

Please confirm your organisation has a documented local fallback and contingency plan in the unlikely event of an NIR system failure or network outage.

Supporting information

While the national infrastructure is highly resilient, your Trust must have a robust Business Continuity Plan (BCP) in place. If the connection to the NIR goes down, or if external imaging cannot be retrieved, your clinical and operational teams must know what local contingency steps to take (e.g., reverting to local imaging only, using alternative image-sharing portals, or requesting re-scans in emergency situations) to ensure patient care is not compromised.

Yes

No

Q.4

Please confirm that you have provided all appropriate Home Community ID's (HCID) to your system supplier to enable local integration testing.

Supporting information

We require this confirmation to ensure your technical rollout and testing phases are not delayed.
The Home Community ID (HCID) is a globally unique identifier assigned specifically to your organisations's local imaging domain as is usually your ODS code. Your system supplier cannot successfully configure your local systems (such as your PACS or RIS) or commence end-to-end integration testing with the national network without this identifier.

By answering 'Yes', you confirm that this ID has been formally handed over to your supplier's technical or deployment team by your organisation.

The INT environment (sometimes called the integration environment) acts as a mandatory testing environment to prove that the supplier’s system meets all API conformance, security, and technical messaging standards.

Yes

No

Q.5

Please list the Home Community ID(s) (HCID) that your organisation/s have supplied to your vendor for integration.

Supporting information

We require this information to confirm and configure the national test environment and ensure your system can successfully connect during the integration testing phase.

While you may have a primary HCID, some organisations may have secondary HCIDs for other organisational sites. We need to know all the exact IDs your supplier is using to route messages.

You can enter up to 2000 characters

Q.6

Have you signed-off the technical integration work that has been done by your supplier?

Supporting information

Before your organisation can be granted live production access to the NIR, the software supplier providing your connection must have successfully passed technical testing in the NHS Integration (INT) Environment.

By answering 'yes', you confirm that you have verified directly with your supplier that their product and the specific version you are deploying locally, has successfully completed and received NIR sign off on this phase.

Yes

No

Q.7

Please upload your rollout plan for the NIR Service.

Supporting information

What to submit?

Access the rollout plan capture form here: Onboarding - Trust/Organisation Rollout Planning – Fill in form

Instructions: Complete the form. Then upload the "Response Receipt". If you have additional supplementary information, upload as a zip file.

The rollout plan serves as the essential bridge between a technically conformant integration and a live clinical service, ensuring that the transition is managed with the precision required for national diagnostic data sharing. It validates that clinical safety standards (access to DCB0129 and authorship of DCB0160) are met in the live environment, confirms successful integration, and demonstrates the active clinical and operational use of the API. A template will be supplied from NHSE; please complete and upload here.

Upload a file You can upload one file that is smaller than 250MB. If you need to provide multiple files you should zip them up and upload them as a single .zip file.

Stage 3: Technical for NIR