{
 "categories": [
  "identity",
  "healthcare",
  "public-sector"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-08-30",
   "fact": "homepage",
   "note": "Norsk Helsenett presents HelseID as the shared login solution for the health and care sector, covering authentication of users, systems, and organisations.",
   "source": "https://www.nhn.no/helseid",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "vendor",
   "note": "The NHN developer portal describes HelseID as the common login for health personnel and the security layer for system communication.",
   "source": "https://utviklerportal.nhn.no/om-utviklerportalen",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "license",
   "note": "Access is sector-gated through leverand\u00f8rvilk\u00e5r and production code review, not a commercial IdP tenant.",
   "source": "https://utviklerportal.nhn.no/informasjonstjenester/helseid/helseid-selvbetjening",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.exists",
   "note": "NHN documents user-login, machine-to-machine, and protect-API patterns. Citizen login is explicitly out of scope.",
   "source": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.kinds[0]",
   "note": "The security profile requires authorization-code plus PKCE and PAR for user clients (published 2026-06-10).",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/protokoller-og-sikkerhetsprofil/sikkerhetsprofil/docs/sikkerhetskrav_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.kinds[1]",
   "note": "The token endpoint at /connect/token documents client_credentials, authorization_code, refresh_token, and token_exchange grants.",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/bruksmoenstre-og-eksempelkode/bruk-av-helseid/docs/teknisk-referanse/endepunkt/token-endepunktet_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.auth[0]",
   "note": "Client authentication is private_key_jwt only. Client secret and mTLS client auth are not used. The public key is registered in Selvbetjening.",
   "source": "https://utviklerportal.nhn.no/informasjonstjenester/helseid/bruksmoenstre-og-eksempelkode/bruk-av-helseid/docs/tekniske-mekanismer/bruk_av_client_assertion_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.auth[1]",
   "note": "DPoP is required on all token grants, including a nonce handshake (published 2026-04-15).",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/bruksmoenstre-og-eksempelkode/bruk-av-helseid/docs/dpop/dpop_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.coverage",
   "note": "Coverage is scope- and bruksvilk\u00e5r-gated. Multi-tenant clients can receive rejected_scope. Frontend-only apps are rejected; all clients must be confidential.",
   "source": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.sdk.exists",
   "note": "NHN lists official HelseID.Library for client-credentials and forbids implementing OAuth or OIDC yourself for production.",
   "source": "https://utviklerportal.nhn.no/informasjonstjenester/helseid/protokoller-og-sikkerhetsprofil/sikkerhetsprofil/docs/vedlegg/anbefalte_biblioteker_enmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.sdk.languages[0]",
   "note": "NorskHelsenett/HelseID.Library is the official .NET client-credentials library.",
   "source": "https://github.com/NorskHelsenett/HelseID.Library",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.extensibility.scripting[0]",
   "note": "Suppliers register systems and APIs in HelseID Selvbetjening at selvbetjening.nhn.no (production) and selvbetjening.test.nhn.no (test).",
   "source": "https://selvbetjening.nhn.no/",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.extensibility.scripting[1]",
   "note": "Integrators implement confidential OIDC or OAuth clients; they must not be frontend-only.",
   "source": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.data_access.export[0]",
   "note": "The token endpoint issues access tokens and, for user flows, ID tokens and optional refresh tokens.",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/bruksmoenstre-og-eksempelkode/bruk-av-helseid/docs/teknisk-referanse/endepunkt/token-endepunktet_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "https://www.nhn.no/llms.txt returned 404 on 2026-08-30.",
   "source": "https://www.nhn.no/llms.txt",
   "tier": "scraped"
  },
  {
   "date": "2026-08-30",
   "fact": "verdict.scores.api",
   "note": "The OIDC and OAuth surface is documented, maintained, and practical for confidential clients, with DPoP, code review, and supplier terms as material operational limits.",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/protokoller-og-sikkerhetsprofil/sikkerhetsprofil/docs/sikkerhetskrav_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as NHN's current HelseID product page.",
   "source": "https://www.nhn.no/helseid",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current usage-pattern page, including the no-citizen-login rule and DPoP requirement for new APIs.",
   "source": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current security-profile requirements, published 2026-06-10.",
   "source": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/protokoller-og-sikkerhetsprofil/sikkerhetsprofil/docs/sikkerhetskrav_no_nbmd",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the production HelseID Selvbetjening portal.",
   "source": "https://selvbetjening.nhn.no/",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-08-30",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://www.nhn.no/helseid"
   },
   {
    "type": "docs",
    "url": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation"
   },
   {
    "type": "docs",
    "url": "https://utviklerportal.nhn.no/no/informasjonstjenester/helseid/protokoller-og-sikkerhetsprofil/sikkerhetsprofil/docs/sikkerhetskrav_no_nbmd"
   },
   {
    "type": "docs",
    "url": "https://selvbetjening.nhn.no/"
   }
  ]
 },
 "homepage": "https://www.nhn.no/helseid",
 "id": "helseid",
 "license": "free",
 "modalities": {
  "agent_docs": {
   "llms_txt": false
  },
  "api": {
   "auth": [
    "private-key-jwt",
    "dpop"
   ],
   "coverage": "partial",
   "docs": "https://utviklerportal.nhn.no/en/information-services/helseid/usage-patterns-and-technical-documentation",
   "exists": true,
   "kinds": [
    "openid-connect",
    "oauth2"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "id-token",
    "access-token",
    "refresh-token"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [
    "self-service-portal",
    "oidc-client"
   ],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. HelseID is an authorization server, not a journal or citizen portal. The documented path is a confidential client using private_key_jwt and DPoP against helseid-sts.nhn.no.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "dotnet"
   ],
   "official": true
  }
 },
 "name": "HelseID",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "id-porten",
   "feide",
   "helsenorge"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Norsk Helsenett",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 7,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 7,
   "rpa": null
  },
  "summary": "HelseID is automatable as NHN's healthcare authorization server, not as Helsenorge and not as ID-porten. Personnel-facing clients use OpenID Connect authorization code with PAR, PKCE, and private_key_jwt. System clients use client credentials the same way. HelseID documents DPoP on every token request, including a nonce handshake, and forbids client-secret and mTLS client authentication. Citizens cannot log in here. Suppliers register klientsystemer and klientkonfigurasjoner in HelseID Selvbetjening, then promote from test to production after code review and leverand\u00f8rvilk\u00e5r. NHN publishes an official .NET client-credentials library. Other stacks must use approved OIDC libraries, not a hand-rolled protocol. Virksomhetssertifikat is not the documented HelseID client-auth method. First-party MCP ownership is not established. Computer-use viability is unassessed.\n"
 }
}