We’re trying to interface our service platform to MESH, to allow us to send correspondence to GP practices (outpatient attendance letters, discharges, etc). As a first step, I’m trying to use the MESH Endpoint Lookup Service using the API specified in Section 4.2 of this specification.
I have previously obtained a MESH API certificate from NHS Digital and am using this alongside the RootCA and SubCA certificates also obtained from NHS Digital. I have manually checked the certificate chain and everything is in order.
I’m calling the API using curl from the commandline, and have tried the example given in the spec:
and also various others replacing “X26” with the ODS code of a GP practice we’re going to be communicating with, and the Workflow ID with other varients, including “TOC_FHIR_OP-ATTEN”, “TOC_OUTP_ATT_DMS” and “GP2GP”.
The command I’m using is:
In all cases I get a simple “404 Not Found” response from the server (which appears to be running nginx). The debug from curl shows me the progress of the call, and I can see TLS being negotiated, the client and server certificate exchange, and then the “404 Not Found” response.
I’ve also (accidentally) tried using the simple-sync server (which requires a Spine certificate, not a MESH certificate), and in that case, as expected,. I get “403 Forbidden”), which gives me further confidence that the certificate chain and exchange is working correctly.
Any suggestions as to what I’m doing wrong, or how I can debug further?
Thanks in advance.