NHSDigital · amitkr-22 · Mar 16, 2026 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026
diff --git a/azure/templates/post-deploy.yml b/azure/templates/post-deploy.yml
@@ -35,55 +35,55 @@ steps:
       profile: "apim-dev"
       aws_account: "dev"
 
-  #- bash: |
-  #    set -e
-  #    if ! [[ $APIGEE_ENVIRONMENT =~ .*-*sandbox ]]; then
-  #        export AWS_PROFILE=apim-dev
-  #        aws_account_no="$(aws sts get-caller-identity --query Account --output text)"
-
-  #        service_name=$(FULLY_QUALIFIED_SERVICE_NAME)
-
-  #        introspection_client_id=$(INTROSPECTION_CLIENT_ID)
-  #        introspection_client_secret=$(INTROSPECTION_CLIENT_SECRET)
-  #        if [[ $APIGEE_ENVIRONMENT = int ]]; then
-  #          introspection_client_id=$(INTROSPECTION_CLIENT_ID_INT)
-  #          introspection_client_secret=$(INTROSPECTION_CLIENT_SECRET_INT)
-  #        fi
-
-  #        pr_no=$(echo $service_name | { grep -oE '[0-9]+$' || true; })
-  #        if [ -z $pr_no ]; then
-  #          workspace=$APIGEE_ENVIRONMENT
-  #        else
-  #          workspace=pr-$pr_no
-  #        fi
-
-  #        echo Deploy mock provider with following parameters:
-  #        echo service_name: $service_name
-  #        echo workspace: $workspace
-  #        echo Apigee environment: $APIGEE_ENVIRONMENT
-  #        echo pr_no: $pr_no
-  #        echo introspection client id: $introspection_client_id
-
-  #        cd terraform
-
-  #        make init
-  #        make apply aws_account_no=${aws_account_no} environment=$workspace \
-  #          client_id=$introspection_client_id \
-  #          client_secret=$introspection_client_secret \
-  #          keycloak_environment=$APIGEE_ENVIRONMENT
-  #        cd ..
-
-  #        if [ -n "$pr_no" ]; then
-  #          echo add KVM for PR-$pr_no
-  #          source .venv/bin/activate
-  #          domain_name=https://$(make -C terraform -s output name=service_domain_name)
-  #          oauth_endpoint="https://identity.ptl.api.platform.nhs.uk/realms/gpconnect-pfs-mock-$APIGEE_ENVIRONMENT/protocol/openid-connect/token"
-  #          python scripts/apigee_kvm.py --env $APIGEE_ENVIRONMENT --access-token $(secret.AccessToken) populate-interaction-ids gp-connect-user-permissions-endpoints-pr-$pr_no --ods H81109 --provider-endpoint $domain_name --oauth-endpoint $oauth_endpoint
-  #        fi
-  #    fi
-  #  displayName: Deploy mock provider
-  #  workingDirectory: "$(Pipeline.Workspace)/s/$(SERVICE_NAME)/$(SERVICE_ARTIFACT_NAME)"
-  #  retryCountOnTaskFailure: 2
+  - bash: |
+     set -e
+     if ! [[ $APIGEE_ENVIRONMENT =~ .*-*sandbox || $APIGEE_ENVIRONMENT == "int" ]]; then
+         export AWS_PROFILE=apim-dev
+         aws_account_no="$(aws sts get-caller-identity --query Account --output text)"
+
+         service_name=$(FULLY_QUALIFIED_SERVICE_NAME)
+
+         introspection_client_id=$(INTROSPECTION_CLIENT_ID)
+         introspection_client_secret=$(INTROSPECTION_CLIENT_SECRET)
+         if [[ $APIGEE_ENVIRONMENT = int ]]; then
+           introspection_client_id=$(INTROSPECTION_CLIENT_ID_INT)
+           introspection_client_secret=$(INTROSPECTION_CLIENT_SECRET_INT)
+         fi
+
+         pr_no=$(echo $service_name | { grep -oE '[0-9]+$' || true; })
+         if [ -z $pr_no ]; then
+           workspace=$APIGEE_ENVIRONMENT
+         else
+           workspace=pr-$pr_no
+         fi
+
+         echo Deploy mock provider with following parameters:
+         echo service_name: $service_name
+         echo workspace: $workspace
+         echo Apigee environment: $APIGEE_ENVIRONMENT
+         echo pr_no: $pr_no
+         echo introspection client id: $introspection_client_id
+
+         cd terraform
+
+         make init
+         make apply aws_account_no=${aws_account_no} environment=$workspace \
+           client_id=$introspection_client_id \
+           client_secret=$introspection_client_secret \
+           keycloak_environment=$APIGEE_ENVIRONMENT
+         cd ..
+
+         if [ -n "$pr_no" ]; then
+           echo add KVM for PR-$pr_no
+           source .venv/bin/activate
+           domain_name=https://$(make -C terraform -s output name=service_domain_name)
+           oauth_endpoint="https://identity.ptl.api.platform.nhs.uk/realms/gpconnect-pfs-mock-$APIGEE_ENVIRONMENT/protocol/openid-connect/token"
+           python scripts/apigee_kvm.py --env $APIGEE_ENVIRONMENT --access-token $(secret.AccessToken) populate-interaction-ids gp-connect-user-permissions-endpoints-pr-$pr_no --ods H81109 --provider-endpoint $domain_name --oauth-endpoint $oauth_endpoint
+         fi
+     fi
+    displayName: Deploy mock provider
+    workingDirectory: "$(Pipeline.Workspace)/s/$(SERVICE_NAME)/$(SERVICE_ARTIFACT_NAME)"
+    retryCountOnTaskFailure: 2
 
   - bash: |
       set -e

diff --git a/proxies/live/apiproxy/policies/AssignMessage.GPCAuthError400Response.xml b/proxies/live/apiproxy/policies/AssignMessage.GPCAuthError400Response.xml
@@ -8,7 +8,7 @@
             "issue": [
                 {
                     "severity": "error",
-                    "code": "400",
+                    "code": "exception",
                     "details": {
                         "coding": [{"code": "400", 
                         "display": "Bad Request"}]

diff --git a/proxies/live/apiproxy/policies/AssignMessage.ODSNotFoundErrorResponse.xml b/proxies/live/apiproxy/policies/AssignMessage.ODSNotFoundErrorResponse.xml
@@ -8,7 +8,7 @@
             "issue": [
                 {
                     "severity": "error",
-                    "code": "Bad Request",
+                    "code": "value",
                     "details": {
                         "coding": [{"code": "BAD_REQUEST", "display": "ODS code not found"}]
                     },

diff --git a/proxies/live/apiproxy/policies/AssignMessage.TooBigBodyErrorResponse.xml b/proxies/live/apiproxy/policies/AssignMessage.TooBigBodyErrorResponse.xml
diff --git a/proxies/live/apiproxy/resources/jsc/HandleErrorContent.js b/proxies/live/apiproxy/resources/jsc/HandleErrorContent.js
@@ -21,16 +21,36 @@
     context.setVariable("Error-Handled", "passthrough");
 }
 
+// --- For Body buffer overflow ---
+else if (parsed && parsed.fault && parsed.fault.faultstring === "Body buffer overflow") {
+    error.status.code = "400"
+    responseContent = {
+        resourceType: "OperationOutcome",
+        issue: [
+            {
+                severity: "error",
+                code: "processing",
+                details: {
+                    coding: [{ system: "https://fhir.nhs.uk/R4/CodeSystem/Spine-ErrorOrWarningCode", code: "BAD_GATEWAY_BUFFER_OVERFLOW", display: "Response body exceeded buffer limit" }]
+                },
+                diagnostics: "Body buffer overflow: response exceeded 10MB limit"
+            }
+        ]
+    };
+    context.setVariable("Error-Handled", "transformed-raisefault");
+
+}
+
 // --- Apigee RaiseFault / ServiceCallout format ---
 else if (parsed && parsed.fault && parsed.fault.faultstring) {
     responseContent = {
         resourceType: "OperationOutcome",
         issue: [
             {
                 severity: "error",
-                code: statusCode.toString(),
+                code: "exception",
                 details: {
-                    coding: [{ code: statusCode.toString(), display: reasonPhrase }]
+                    coding: [{ system: "https://fhir.nhs.uk/R4/CodeSystem/Spine-ErrorOrWarningCode", code: statusCode.toString(), display: reasonPhrase }]
                 },
                 diagnostics: parsed.fault.faultstring
             }
@@ -47,9 +67,9 @@
         issue: [
             {
                 severity: "error",
-                code: statusCode.toString(),
+                code: "exception",
                 details: {
-                    coding: [{ code: statusCode.toString(), display: reasonPhrase }]
+                    coding: [{ system: "https://fhir.nhs.uk/R4/CodeSystem/Spine-ErrorOrWarningCode", code: statusCode.toString(), display: reasonPhrase }]
                 },
                 diagnostics: parsed.faultstring
             }
@@ -65,9 +85,9 @@
         issue: [
             {
                 severity: "error",
-                code: statusCode.toString(),
+                code: "exception",
                 details: {
-                    coding: [{ code: statusCode.toString(), display: reasonPhrase }]
+                    coding: [{ system: "https://fhir.nhs.uk/R4/CodeSystem/Spine-ErrorOrWarningCode", code: statusCode.toString(), display: reasonPhrase }]
                 },
                 diagnostics: errorContent || ""
             }

diff --git a/proxies/live/apiproxy/targets/target.xml b/proxies/live/apiproxy/targets/target.xml
@@ -98,12 +98,6 @@
       </Step>
       <Condition>endpoints = null</Condition>
     </FaultRule>
-    <FaultRule name="body_buffer_overflow">
-      <Step>
-          <Name>AssignMessage.TooBigErrorResponse</Name>
-      </Step>
-      <Condition>fault.errorcode = "protocol.http.TooBigBody"</Condition>
-    </FaultRule>
   </FaultRules>
   <DefaultFaultRule>
     <Step>

diff --git a/proxies/live/apiproxy/targets/targetdev.xml b/proxies/live/apiproxy/targets/targetdev.xml
@@ -108,12 +108,6 @@
             </Step>
             <Condition>endpoints = null</Condition>
         </FaultRule>
-        <FaultRule name="body_buffer_overflow">
-            <Step>
-                <Name>AssignMessage.TooBigErrorResponse</Name>
-            </Step>
-            <Condition>fault.errorcode = "protocol.http.TooBigBody"</Condition>
-        </FaultRule>
     </FaultRules>
     <DefaultFaultRule>
     <Step>

diff --git a/terraform/api/lambda.tf b/terraform/api/lambda.tf
@@ -26,7 +26,7 @@ resource "null_resource" "push_token_validator_image" {
     interpreter = ["bash", "-c"]
     command = <<EOF
       aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${data.aws_caller_identity.current.account_id}.dkr.ecr.eu-west-2.amazonaws.com
-      docker build -t ${local.validator_ecr_tag} -f ${local.validator_path}/Dockerfile ${local.validator_path}
+      DOCKER_BUILDKIT=0 docker build -t ${local.validator_ecr_tag} -f ${local.validator_path}/Dockerfile ${local.validator_path}
       docker push ${local.validator_ecr_tag}
       EOF
     working_dir = "."

diff --git a/terraform/mock-provider/container_image.tf b/terraform/mock-provider/container_image.tf
@@ -34,7 +34,7 @@ export AWS_PROFILE=apim-dev
 aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${data.aws_caller_identity.current.account_id}.dkr.ecr.eu-west-2.amazonaws.com
 ecr_url=${data.aws_ecr_repository.mock_provider_repository.repository_url}
 image_tag=$ecr_url:${var.image_version}
-docker build -t $image_tag -f ${local.mock_provider_path}/Dockerfile ${local.mock_provider_path}
+DOCKER_BUILDKIT=0 docker build -t $image_tag -f ${local.mock_provider_path}/Dockerfile ${local.mock_provider_path}
 docker push -a $ecr_url
 aws ecs update-service --cluster ${var.prefix} --service ${var.prefix} --force-new-deployment --region eu-west-2
 sleep 50

diff --git a/tests/test_endpoints.py b/tests/test_endpoints.py
@@ -8,7 +8,7 @@
 import pytest
 import os
 from os import getenv
-# from .example_loader import load_example
+from .example_loader import load_example
 
 
 @pytest.fixture()
@@ -105,29 +105,29 @@ def test_nhs_login_p9(nhsd_apim_proxy_url, nhsd_apim_auth_headers):
         f"{nhsd_apim_proxy_url}/Patient/9000000009",
         headers=headers
     )
-    assert resp.status_code == 500
-
-
-# @pytest.mark.auth
-# @pytest.mark.integration
-# @pytest.mark.nhsd_apim_authorization(
-#    {
-#        "access": "patient",
-#        "level": "P9",
-#        "login_form": {"username": "9734644475"}
-#    }
-# )
-# def test_prism_returns_external_file(nhsd_apim_proxy_url, nhsd_apim_auth_headers):
-#    headers = {
-#        "accept": "*/*",
-#        "X-Correlation-ID": "11C46F5F-CDEF-4865-94B2-0EE0EDCC26DA",
-#        "X-Request-ID": "60E0B220-8136-4CA5-AE46-1D97EF59D068"
-#    }
-#    headers.update(nhsd_apim_auth_headers)
-
-#    resp = requests.get(
-#        f"{nhsd_apim_proxy_url}/Patient/9000000009",
-#        headers=headers
-#    )
-#    expected_response = load_example("GetResponsePermissionsFull.yaml")
-#    assert resp.json() == expected_response.get("value")
+    assert resp.status_code == 200
+
+
+@pytest.mark.auth
+@pytest.mark.integration
+@pytest.mark.nhsd_apim_authorization(
+   {
+       "access": "patient",
+       "level": "P9",
+       "login_form": {"username": "9734644475"}
+   }
+)
+def test_prism_returns_external_file(nhsd_apim_proxy_url, nhsd_apim_auth_headers):
+    headers = {
+        "accept": "*/*",
+        "X-Correlation-ID": "11C46F5F-CDEF-4865-94B2-0EE0EDCC26DA",
+        "X-Request-ID": "60E0B220-8136-4CA5-AE46-1D97EF59D068"
+    }
+    headers.update(nhsd_apim_auth_headers)
+
+    resp = requests.get(
+        f"{nhsd_apim_proxy_url}/Patient/9000000009",
+        headers=headers
+    )
+    expected_response = load_example("GetResponsePermissionsFull.yaml")
+    assert resp.json() == expected_response.get("value")
diff --git a/tests/test_mock_provider.py b/tests/test_mock_provider.py
@@ -20,4 +20,4 @@ def test_mock_receiver_patient_record_path(nhsd_apim_proxy_url, nhsd_apim_auth_h
         f"{nhsd_apim_proxy_url}/Patient/9000000009",
         headers=headers
     )
-    assert resp.status_code == 500
+    assert resp.status_code == 200