The 2 parts of conformance
Conformance is the next step after the eligibility check. Before you can access the application programming interface (API) in a production environment, you must complete conformance requirements in 2 areas:
- Technical and API conformance: you verify this through a test submission in our sandbox environment and we keep the evidence in our API Register.
- Security and operational conformance: you self-attest (declare) this as part of registration. We can ask for evidence of this at any time.
Technical and API conformance
Technical and API conformance confirms that your system can interact with the API correctly. Before you can move to production, you must show this by completing a successful test submission in our sandbox environment. The test covers activities such as:
- registering with the API before first use
- authenticating correctly and managing your access token
- exchanging public certificates to establish connectivity
- including the correct software and organisation identifiers in every submission
- structuring submissions in line with the API specification requirements
- correctly handling API responses, including error outcomes
- presenting error messages so your users can understand and fix them
- capturing user attestation before submission, where this applies
- completing a successful test submission, with evidence recorded in our API Register.
Submitting your test evidence
To show technical and API conformance you need to:
- get access to our sandbox environment during onboarding
- run test cases in the sandbox environment, covering the areas listed above
- send your evidence to our Integration Team when we ask for it (email it to apisupport@agedcarequality.gov.au).
We’ll check your evidence and confirm that it meets our requirements. If it does, we’ll give you access to the API production environment.
Security and operational conformance
Security and operational conformance confirms that your system meets our operational and security expectations. Because we can't observe these controls from outside your system, you must self-attest (declare) that you meet the conformance requirements.
You declare your system aligns with our requirements in a single declaration on the API registration form. This declaration covers:
- identity and access management – for example, role-based access and multi-factor authentication for administrator accounts
- audit and accountability – for example, logging every submission and making sure no-one changes those records
- data protection and cryptography – for example, never storing credentials in plain text
- secure development and operational resilience – for example, applying security patches quickly.
We don't collect evidence when you register, but we can request it at any time. For example:
- as a spot check
- after an incident
- if something we identify during technical testing doesn't match what you've declared.
If you use a third-party software operator
The conformance process is slightly different if you use a third-party software operator.
Self-implementing providers need to:
- do a full test for technical and API conformance
- make a declaration for security and operational conformance.
Providers using a third-party software operator can:
- use the conformance evidence the operator established during their own registration for technical and API conformance
- use the operator's declaration and evidence they collected through the software agreement for security and operational conformance.
A third-party operator that manages submissions for more than one provider doesn't need to re-declare security and operational conformance for every new provider.
When you need to reconfirm conformance
You must tell us if you make a significant change that could affect the way you connect to or use the API. For example, if you change your:
- hosting environment
- authentication method
- third-party software operator.
We may need to reassess conformance when this happens.
What happens if you don't meet conformance
Technical and API conformance
If you don’t meet technical and API conformance, you stay in the Testing in Progress stage. You can fix the issue and try again. You don't need to restart your registration.
Security and operational conformance
If you don’t meet security and operational conformance, we block your registration and record this in our API Register. This applies if:
- we find that your declaration is false after you have registered with the API
- the evidence you give us isn't good enough.
Getting production access
We issue your production client credentials after confirming your eligibility and conformance.
More information
This page is a summary of the conformance requirements. You can find the complete list in the API Conformance Specification.