Skip to main content
PUT
cURL

Integration Notes

  1. Provider fields go in provider_details. access_roles and email are ignored.
  2. Send hpii_number, given_name, family_name, date_of_birth and sex together — all five must match the Services Australia record.
  3. full_name follows the provider names unless you set full_name yourself.

HPI-I updates and partial user creation

Update User is how you repair a user that Create User returned with a USER_CREATED_PROVIDER_* code. Send the corrected values in provider_details. If the user has no provider record, Parchment creates one; if a record exists, Parchment updates it.

When Parchment re-checks the HI Service

Parchment runs an HI Service lookup when you send provider_details and either:
  • the user’s provider record is not active (this includes a user with no provider record at all), or
  • the hpii_number or the demographics on an active provider record change.
The lookup uses hpii_number, given_name, family_name, date_of_birth and sex. Values you send are used first, and anything you omit is taken from the existing record. Send all five together when you repair a partial creation, so the lookup does not mix new values with stale ones.

What the response tells you

Parchment never returns the HI Service’s own reason, and never returns the HPI-I. Quote the requestId for support.

Repair sequence

  1. PUT .../users/{user_id} with the corrected provider_details. Send all five identity fields together.
  2. GET .../users/{user_id} and check is_escript_ready.can_prescribe.
A 4xx means nothing was written. A 200 means the provider record was written; can_prescribe then tells you whether it is usable.

Request

Update Basic User Information

Update Provider Details

Update Both User and Provider Information

Repair a Partial User Creation

Send the full identity set so the HI Service lookup uses only current values.

User Fields

Provider Details

When updating provider-specific information, use the provider_details object:

Validation Rules

  1. Prescriber Number: Must be 10 characters or less
  2. Provider Number: Must be 10 characters or less
  3. Provider Details Dependencies:
    • If prescriber_type is provided, qualifications must also be provided
    • If prescriber_type is not ‘T’ (podiatrist), prescriber_number is required
  4. Date Format: Date of birth must be in YYYY-MM-DD format
  5. Sex Values: Must be one of: M (Male), F (Female), I (Indeterminate), N (Not-stated)

Prescriber Types

Valid values for prescriber_type:
  • M (Medical Practitioner)
  • E (Eye/Optometrist)
  • U (Nurse)
  • F (Midwife)
  • D (Dentist)
  • V (Veterinarian)
  • T (Podiatrist)
  • C (Pharmacist)

Response

Success Response (200 OK)

Validation Error (422 Unprocessable Entity)

User Not Found (404 Not Found)

HPI-I Already Held by Another Provider (409 Conflict)

HI Service Could Not Match the HPI-I (422)

The HPI-I did not match the given name, family name, date of birth and sex. Correct them; do not retry the same values.

Incomplete Provider Identity (422)

A provider record cannot be created or verified without all five identity fields. Missing values are taken from the stored record first; these were absent from both.

Unauthorized (401)

Insufficient Scope (401 Unauthorized)

Rate Limited (429 Too Many Requests)

Response Fields

Success Response Data

Status Codes

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-organization-secret
string
required

Organization secret for authentication - provided by Parchment

Path Parameters

organization_id
string<uuid>
required

Organization ID

user_id
string<uuid>
required

User ID

Body

application/json

User data to update in Parchment

Fields to update. Send only the fields you want to change. access_roles and email are ignored — use the update-user-roles endpoint to change roles.

full_name
string

User's full name

Example:

"Darlene Scott"

provider_details
object

Provider fields. Intended for a user with the provider or rx_queue_manager role, but the role is not checked. If the user has no provider record yet, sending this object creates one.

Response

User updated successfully

success
boolean
required

Indicates if the request was successful

Example:

true

statusCode
integer
required
Example:

200

message
string
required
Example:

"User updated successfully"

code
string
required

Always SUCCESS. A provider write that fails returns 4xx, not 200.

Example:

"SUCCESS"

data
object
required
timestamp
string<date-time>
required

ISO 8601 timestamp of the response

Example:

"2024-01-15T10:30:00.000Z"

requestId
string
required

Unique identifier for request tracing

Example:

"req_1705312200000_abc123"