diff --git a/gateway-api/openapi.yaml b/gateway-api/openapi.yaml
index 96b3f30e..e34347cd 100644
--- a/gateway-api/openapi.yaml
+++ b/gateway-api/openapi.yaml
@@ -8,11 +8,17 @@ info:
 servers:
   - url: http://localhost:5000
     description: Local development server
+components:
+  securitySchemes:
+    app-level0:
+      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level0
 paths:
   /patient/$gpc.getstructuredrecord:
     post:
       summary: Get structured record
       description: Returns a FHIR Bundle containing patient structured record
+      security:
+      - app-level0: []
       operationId: getStructuredRecord
       parameters:
       - in: header
@@ -145,6 +151,8 @@ paths:
     get:
       summary: Health check
       description: Returns the health status of the API
+      security:
+      - app-level0: []
       operationId: healthCheck
       responses:
         '200':
@@ -160,3 +168,16 @@ paths:
                 required:
                   - status
 
+x-nhsd-apim:
+  monitoring: false
+  access:
+  - title: Application Restricted
+    grants:
+      app-level0: []
+  target:
+    type: external
+    healthcheck: /health
+    url: <preview-endpoint-url>
+    security:
+      type: mtls
+      secret: <replace-with-secret-name>