# Request Headers - Aotearoa Immunisation Register (AIR) FHIR Implementation Guide (API-V1) v1.27.0

* [**Table of Contents**](toc.md)
* **Request Headers**

## Request Headers

The following headers may be presented in the request.

| | | | | |
| :--- | :--- | :--- | :--- | :--- |
| Authorization | Base64URL encoded string | yes | eyJraWQiOiJETW5ZNzV1Nk03ZkZicEFUdkI2bXRlOEJ5dW1jODNpdDRpb2hldW1lWWhrPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiIzNjYyZ*** | authorization bearer token |
| UserId | String | Yes |  | Client providedAll requests for all resources must include an http header UserId that uniquely identifies the individual initiating the request.Preferably the hpi-person-id of the user would be provided if known, otherwise a userid that allows the authenticated organisation to identify the individual. |
| FacilityId | String | Recommended |  | Client providedIt is recommendedthat all requests for all resources must include an http header Facilityid that uniquely identifies the Facility initiating the request.Preferably the HPI-F id of the Facility would be provided if known, otherwise a FacilityId that allows the identification of the Facility. |
| x-api-key | Base64URL encoded string | yes(to use the Gateway URL) | KAnHVzZXJJZGVudGlmaWVy4oCdOiDigJx4eXrigJ19 | As per NIA standard, there is an api key requirement. This is used in scenarios like usage plans, etc.API Gateway reads the key and compares it against the keys in the usage plan. If there is a match, API Gateway throttles the requests based on the plan's request limit and quota. Otherwise, it throws an InvalidKeyParameter exception. As a result, the caller receives a 403 Forbidden response.This header is not used by the immunisation Service, only by API Gateway. |
| If-Match | number | on update |  | The resource number (version number) |
| X-Correlation-ID | String.UUID recommended, but not required. | no | 123e4567-e89b-12d3-a456-426614174000this-is-a-valid-id-too |  |
| SourceSystemID | String | no | HSAPP0232 | Source System ID |
| Api-Version | String | no | 1 | Api Version for request and response |

