UK API Strategy Guide (2026)

🔌 APIs⚖️ NHS FHIR R4🏦 Open Banking🔒 UK GDPR🆓 Free Review
March 202612 min readJames Whitmore, CTO

Direct Answer

A UK API strategy must address three layers: external APIs (OpenAPI 3.0 — NHS FHIR R4, FCA Open Banking PSRs, GDS Service Standard all mandate REST + OpenAPI), internal APIs (tRPC for TypeScript full-stack, REST for cross-language), and third-party APIs (NHS Spine, HMRC Making Tax Digital, DVLA, Companies House — all REST). ClickMasters has built 200+ UK API integrations across NHS, FCA, GDS, and enterprise.

UK Regulatory API Standards — By Sector

SectorMandatory API StandardKey APIsClickMasters Integration Experience
NHS / HealthTechNHS FHIR R4 (UK Core profiles)PDS, GP Connect, eRS, NRL, EPS, CSDS, SUSAll NHS FHIR R4 APIs — 12+ NHS integrations
FCA FinTech (Open Banking)OpenAPI 3.0 + OAuth 2.0 PKCETrueLayer AISP, GoCardless PISP, OBIE DirectoryOpen Banking API integrations in 18 FinTech projects
GDS GovernmentREST + OpenAPI 3.0 (GDS Service Standard Pt 16)GOV.UK Pay, GOV.UK Notify, GOV.UK One LoginGOV.UK common platform APIs on 12 GDS projects
HMRC / TaxHMRC REST APIs (Making Tax Digital)MTD VAT, MTD ITSA, PAYE, CDS CustomsHMRC MTD VAT and PAYE on 8 UK projects
Companies HouseCompanies House REST APICompany search, filing history, beneficial ownershipCompanies House API on 15 FinTech/LegalTech projects
DVLA / TransportDVLA REST APIsV5C vehicle enquiry, driver licence, MOT historyDVLA API on 8 InsurTech/fleet projects
Royal MailRoyal Mail REST APIsPAF address lookup, Click and Drop (shipping)Royal Mail PAF on 12 eCommerce/LogTech projects
Land RegistryHMLR REST APIsPrice Paid, INSPIRE Polygons, Digital StreetHMLR on 6 PropTech projects

OpenAPI 3.0 — UK API Documentation Standard

ClickMasters API documentation standard: every external API we build ships with an OpenAPI 3.0 specification generated from Zod schemas (zod-to-json-schema → OpenAPI components) or written directly in YAML. OpenAPI specification is code-reviewed alongside application code — documentation drift is prevented.

UK API Rate Limiting — NHS and FCA Context

APIRate LimitClickMasters MitigationUK Regulatory Context
NHS PDS FHIR R4200 requests/minuteRedis cache (NHS number → patient demographics, 24hr TTL)Patient lookup cached — DTAC permits caching with invalidation on change
NHS GP Connect500 requests/minuteCache per patient (FHIR Bundle, 15-min TTL for active consultation)GP record refreshed at consultation start — stale record is clinical risk
GOV.UK Pay APINo documented limit (use with care)Exponential backoff on 429 responsesPCI-DSS: payment API calls must be logged for fraud analysis
HMRC Making Tax DigitalUndocumented — typically 1,000/hourRedis queue (business client → MTD submission queue)HMRC ITSA — quarterly submission — no burst needed
Companies House API600 requests/day (free tier), 50,000/month (premium)Database cache (company data updated daily — stale acceptable)AML — latest filing data required — cache TTL max 24 hours
DVLA Vehicle EnquiryNo documented limitRate limit 10 req/sec — DVLA guidanceInsurance pricing — real-time vehicle data at quote — no caching

Frequently Asked Questions

Common questions about uk api strategy guide (2026).

ClickMasters NHS FHIR R4 API integration costs: (1) PDS (Personal Demographics Service — patient NHS number lookup): £6,000–£12,000 (3–5 weeks including NHS sandbox testing and onboarding). (2) GP Connect (structured patient record): £15,000–£28,000 (6–10 weeks including GPSoC clinical assurance). (3) EPS (Electronic Prescription Service R3): £20,000–£40,000 (8–14 weeks). (4) NHS e-Referral Service (eRS FHIR R4): £14,000–£25,000 (6–10 weeks). All prices include NHS Digital onboarding, DTAC evidence generation, and IEC 62304 API documentation. NHS API onboarding adds 2–4 weeks regardless of development complexity — ClickMasters has established relationships with NHS Digital onboarding team.

AISP (Account Information Service Provider): access customer bank account information (balance, transactions, standing orders, direct debits) with customer consent. Use cases: affordability assessment for lending, personal finance management, account aggregation. PISP (Payment Initiation Service Provider): initiate a payment from customer's bank account with customer consent (account-to-account payment — no card needed). Use cases: e-commerce payment alternative to card, instant bank transfer. Regulatory difference: AISP requires FCA registration (Article 33 PSD2 exemption or full authorisation), PISP requires full FCA authorisation (higher bar — PISP can move money). UK implementation: TrueLayer (AISP + PISP), GoCardless (PISP — Variable Recurring Payments). ClickMasters has implemented both AISP and PISP for UK FinTech clients.

About the Author

James Whitmore, CTO UK API specialist — NHS FHIR R4, FCA Open Banking, GDS service standard ClickMasters has built 200+ UK API integrations. OpenAPI 3.0 standard on every external API.

Free API Strategy Review ClickMasters will...

Free API Strategy Review ClickMasters will review your API strategy and NHS/FCA/GDS compliance requirements. → clickmasterssoftwaredevelopmentcompany.co.uk/contact/

Book a Free Consultation