Testing in the Pilot Environment
Have you built your client application using the BRP API mock, and are you ready for the acceptance test in RvIG's environment?
Then you can test the network connection, the access security and the communication with the API in the pilot environment. Every consumer of RvIG or municipality may set up at most one connection to the BRP API pilot environment. No covenant is required yet for connecting to the pilot environment.
Conditions
- connecting is permitted only with an API gateway
- a connection to DigiNetwerk
- TLS with a PKIoverheid certificate with OIN: the PKIoverheid certificate with OIN for the pilot environment can also be used in the production environment. Does your API gateway already use a PKIoverheid certificate for another RvIG product? Then you can reuse that certificate. Do you have a separate API gateway for test and production? Then separate certificates are required. This is because we do not install client certificates; at every transaction the certificate and the OIN are checked for validity.
Before you can use the API you must request a token. To request one you need:
- Client-id: you receive this from RvIG
- Client-secret: you receive this from RvIG
- afnemersindicatie (consumer indicator): this is the number belonging to your authorization decision. You can look it up here.
- OIN: contained in the PKIoverheid certificate you use when connecting.
Step 1: Send a request for client credentials for the pilot environment to [email protected]
- State the correct OIN in the PKIoverheid certificate used, and provide your contact person with name, email address and mobile number.
- Your contact person receives a client ID and a client secret within 2 weeks. These may only be known to your API gateway.
Step 2: Configure your gateway
Important information for configuring your gateway:
- connect via DigiNetwerk
- URL for requesting the token: https://auth.npr.idm.diginetwerk.net/nidp/oauth/nam/token
- URL BRP API Personen: https://apigw.npr.idm.diginetwerk.net/lap/api/brp/personen
- URL BRP API Bewoning: https://apigw.npr.idm.diginetwerk.net/lap/api/bewoning/bewoningen
- URL BRP API Verblijfplaatshistorie: https://apigw.npr.idm.diginetwerk.net/lap/api/brp/verblijfplaatshistorie
Step 3: Retrieve the OAuth token
Send this request to request a token in the pilot environment, replacing everything between double braces with the credentials you have:
curl --location -–request POST 'https://auth.npr.idm.diginetwerk.net/nidp/oauth/nam/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id={{client-id}}' \
--data-urlencode 'client_secret={{client-secret}}' \
--data-urlencode 'scope={{ afnemersindicatie }}-{{OIN}}' \
--data-urlencode 'resourceServer=ResourceServer01'
You then receive an application/json message in reply that looks like this:
{
"access_token": "{{access token}}",
"token_type": "bearer",
"expires_in": {{geldigheidsduur}},
"scope": "{{scope}}"
}
You send the token in “access_token” with every request to the API, by entering it in the request header “Authorization”, preceded by “Bearer ”. Note that there is 1 space between “Bearer” and the token, and no space or other character after the token.
The token has limited validity and can be used for several API requests during the validity period. “expires_in” states how long (in seconds) the token is valid.
Step 4: Send a request
Send this request with a correct example request body to the API in the pilot environment:
curl --location -–request POST 'https://apigw.npr.idm.diginetwerk.net/lap/api/brp/personen' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer {{access_token}} \
--data '{
"fields": ["naam.volledigeNaam", "leeftijd", "geslacht", "adressering"],
"type": "RaadpleegMetBurgerservicenummer",
"burgerservicenummer": ["999993483"]
}'
Step 5: Test your client application
Test your application with this test set. Successful? Then you can request a connection to the production environment.
Connecting to the production environment
Conditions
- a covenant signed by your authorized representative
- a BRP authorization decision and a supplementary authorization decision for information products (not for municipalities)
- connecting is permitted only with an API gateway
- a connection to DigiNetwerk
- TLS with a PKIoverheid certificate or certificates with OIN: the PKIoverheid certificate with OIN for the pilot environment can also be used in the production environment. Do you have a separate API gateway for test and production? Then separate certificates are required. This is because we do not install client certificates; at every transaction the certificate and the OIN are checked for validity.
Step 1: Request the connection to the production environment via [email protected]. You then receive a draft covenant.
- State the correct OIN in the PKIoverheid certificate used, and provide your contact person with name, email address and mobile number.
- The covenant must be signed by the mayor, the municipal secretary or an authorized representative and sent to [email protected]. Enclose a mandate decision if it is signed by an authorized representative. After checking by RvIG, the client credentials can be issued.
- Your contact person receives a client ID and a client secret within 2 weeks. These may only be known to your API gateway.
Step 2: Configure your gateway
Important information for configuring your gateway:
- connect via DigiNetwerk
- URL for requesting the token: https://auth.idm.diginetwerk.net/nidp/oauth/nam/token
- URL BRP API Personen: https://apigw.idm.diginetwerk.net/api/brp/personen
- URL BRP API Bewoning: https://apigw.idm.diginetwerk.net/api/brp/bewoning/bewoningen
- URL BRP API Verblijfplaatshistorie: https://apigw.idm.diginetwerk.net/api/brp/verblijfplaatshistorie