HSID EDA portal implementation FAQs

Common integration issues & troubleshooting

1. I am unable to register a user and receive "Unable to verify (the details provided do not match our records)" (EDA) or "No Record Found (Error code 10001)" (Non-EDA). What does this mean?
   This means HSID was unable to locate the user's record in EiMP using the information provided. Double-check that the information is correct and try to locate the record using the User Service /search endpoint using FN (first name), LN (last name), DOB (date of birth), and search_keys.
   Important notes:

   • For EDA: The identifier being used must be contained within search_keys.
   • For Non-EDA: The identifier will likely also need to be present in search_keys, but this depends on the portal configuration.
2. I'm getting error "10002, User not Eligible" (Non-EDA). What should I check?
   HSID is getting a "Not Eligible" response from the portal eligibility API, is not able to get a response (timeout, etc.), or is failing to make the request.
   Troubleshooting steps:

   1. Check the eligibility API logs to determine if you are sending back "NO_ELIGIBILITY" in the response or failing to respond.
   2. If either of these conditions occurs, the error is expected.
   3. If you are not receiving a request, or are sending back "FULL_ELIGIBILITY", it is an issue on the HSID side. Join HSID office hours to troubleshoot the issue.
3. During login and/or registration I am receiving errors 20001, 20002, or 20003. What causes this?
   This is due to the digital identity and fraud prevention platform flagging the authentication attempt. This is intentionally vague but is due to a combination of factors:

   • Velocity is too high.
   • Geolocation is from a country with high risk.
   • Phone linked to too many accounts.
   • The email address is from a high-risk domain.
4. Why am I getting "invalid_request" "code_challenge_required" during a login or registration attempt?
   This error occurs if your client is configured to use the Proof Key for Code Exchange (PKCE) flow and the authorization request does not include the two additional PKCE parameters: code_challenge and code_challenge_method.
   Solution: Include the required PKCE parameters in the authorization request. See the Mobile PKCE section of the implementation guide and external PKCE resources online.
   Reference : Mobile PKCE – OIDC
5. How do I send a user to the HSID Manage Profile page (EDA)?
   There are two methods, depending on whether the user accesses HSID through a mobile app with biometrics.

   1. For web users:
      https://nonprod.identity.healthsafe-id.com/web/redirect?to=manage-profile&target=<back_to_application_url>&post_logout_redirect_uri=<redirect_uri>
   2. For mobile app with biometrics (using SSO endpoint):
      POST https://nonprod.identity.healthsafe-id.com/web/sso sso_identifier=<static_identifier_configured_for_client>& assertion=<id_token>& redirect_uri=<uriEncoded(https://nonprod.identity.healthsafe-id.com/web/redirect?to=manage-profile&target=<portal_return_to_rp_link>&post_logout_redirect_uri=<redirect_uri>)>
   Reference : HSID settings
6. My team is migrating to EDA and we currently use the Cache API or Keychain API to obtain user information after authentication. Will these be available for EDA?
   No. The Cache API and Keychain API are populated with responses from eligibility APIs. Because EDA is decoupled, HSID is no longer handling the eligibility component, so the Cache and Keychain APIs are obsolete.
   Solution: Use the User service to obtain user identity information instead.
   Reference : HCP (Healthcare platform) user service integration