Pull data

Gets an access token from a data source, so that your organisation, as the data using service, can call the API of the data source. Name the data disclosure agreement record by its canonicalId. The record must be one that your organisation signed as the data using service (organisationRole data_using_service), and it must be opted in.

The service signs a JWT about the record, finds the access point of the data source from the credential in the signature of the data source, and gets the access token at the token endpoint of the data source (JWT bearer grant). It logs each success as a pull data record.

Send the token as a bearer token to the API of the data source. A data source on iGrant.io checks it with POST /v4/service/consent/data-space/validate-access, and its tokens are valid for 1 hour.

Without individualId the token gives anonymous access (dataClassification anonymous). With individualId it gives access to the data of that individual (pii); the data source then checks that the individual exists there with the externalIdType personNumber and opted in to its data agreement.

Errors have the OAuth 2.0 form (error, error_description):

• 400 invalid_request: the record ID is missing, the record does not exist, your organisation is not its data using service, or the record is not opted in.
• Other statuses: the data source refused the request, or the service could not reach it.