UK Regulatory API Standards — By Sector
| Sector | Mandatory API Standard | Key APIs | ClickMasters Integration Experience |
|---|---|---|---|
| NHS / HealthTech | NHS FHIR R4 (UK Core profiles) | PDS, GP Connect, eRS, NRL, EPS, CSDS, SUS | All NHS FHIR R4 APIs — 12+ NHS integrations |
| FCA FinTech (Open Banking) | OpenAPI 3.0 + OAuth 2.0 PKCE | TrueLayer AISP, GoCardless PISP, OBIE Directory | Open Banking API integrations in 18 FinTech projects |
| GDS Government | REST + OpenAPI 3.0 (GDS Service Standard Pt 16) | GOV.UK Pay, GOV.UK Notify, GOV.UK One Login | GOV.UK common platform APIs on 12 GDS projects |
| HMRC / Tax | HMRC REST APIs (Making Tax Digital) | MTD VAT, MTD ITSA, PAYE, CDS Customs | HMRC MTD VAT and PAYE on 8 UK projects |
| Companies House | Companies House REST API | Company search, filing history, beneficial ownership | Companies House API on 15 FinTech/LegalTech projects |
| DVLA / Transport | DVLA REST APIs | V5C vehicle enquiry, driver licence, MOT history | DVLA API on 8 InsurTech/fleet projects |
| Royal Mail | Royal Mail REST APIs | PAF address lookup, Click and Drop (shipping) | Royal Mail PAF on 12 eCommerce/LogTech projects |
| Land Registry | HMLR REST APIs | Price Paid, INSPIRE Polygons, Digital Street | HMLR on 6 PropTech projects |
OpenAPI 3.0 — UK API Documentation Standard
ClickMasters API documentation standard: every external API we build ships with an OpenAPI 3.0 specification generated from Zod schemas (zod-to-json-schema → OpenAPI components) or written directly in YAML. OpenAPI specification is code-reviewed alongside application code — documentation drift is prevented.
UK API Rate Limiting — NHS and FCA Context
| API | Rate Limit | ClickMasters Mitigation | UK Regulatory Context |
|---|---|---|---|
| NHS PDS FHIR R4 | 200 requests/minute | Redis cache (NHS number → patient demographics, 24hr TTL) | Patient lookup cached — DTAC permits caching with invalidation on change |
| NHS GP Connect | 500 requests/minute | Cache per patient (FHIR Bundle, 15-min TTL for active consultation) | GP record refreshed at consultation start — stale record is clinical risk |
| GOV.UK Pay API | No documented limit (use with care) | Exponential backoff on 429 responses | PCI-DSS: payment API calls must be logged for fraud analysis |
| HMRC Making Tax Digital | Undocumented — typically 1,000/hour | Redis queue (business client → MTD submission queue) | HMRC ITSA — quarterly submission — no burst needed |
| Companies House API | 600 requests/day (free tier), 50,000/month (premium) | Database cache (company data updated daily — stale acceptable) | AML — latest filing data required — cache TTL max 24 hours |
| DVLA Vehicle Enquiry | No documented limit | Rate limit 10 req/sec — DVLA guidance | Insurance pricing — real-time vehicle data at quote — no caching |