From 1751bd5042d0cd38bb3d8f0af554babbf93be5c5 Mon Sep 17 00:00:00 2001
From: David Hamill <109090521+davidhamill1-nhs@users.noreply.github.com>
Date: Tue, 27 Jan 2026 15:01:44 +0000
Subject: [PATCH 1/2] [GPCAPIM-257]: Add stanza for proxy deployment through
 Proxy Generator.

---
 gateway-api/openapi.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/gateway-api/openapi.yaml b/gateway-api/openapi.yaml
index 96b3f30e..0af7e1ee 100644
--- a/gateway-api/openapi.yaml
+++ b/gateway-api/openapi.yaml
@@ -8,11 +8,17 @@ info:
 servers:
   - url: http://localhost:5000
     description: Local development server
+components:
+  securitySchemes:
+    app-level3:
+      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level3
 paths:
   /patient/$gpc.getstructuredrecord:
     post:
       summary: Get structured record
       description: Returns a FHIR Bundle containing patient structured record
+      security:
+      - app-level3: []
       operationId: getStructuredRecord
       parameters:
       - in: header
@@ -145,6 +151,8 @@ paths:
     get:
       summary: Health check
       description: Returns the health status of the API
+      security:
+      - app-level3: []
       operationId: healthCheck
       responses:
         '200':
@@ -160,3 +168,16 @@ paths:
                 required:
                   - status
 
+x-nhsd-apim:
+  monitoring: false
+  access:
+  - title: Application Restricted
+    grants:
+      app-level3: []
+  target:
+    type: external
+    healthcheck: /health
+    url: https://feature-gpcapim-257-route-requests-from-apim-using-proxygen.dev.endpoints.clinical-data-gateway.national.nhs.uk/
+    security:
+      type: mtls
+      secret: <replace-with-secret-name>

From c5b022ce40237488529cbfc2dc27a6bbe0486295 Mon Sep 17 00:00:00 2001
From: David Hamill <109090521+davidhamill1-nhs@users.noreply.github.com>
Date: Thu, 29 Jan 2026 09:43:49 +0000
Subject: [PATCH 2/2] [GPCAPIM-257]: Force templating preview env url; reduce
 auth requirements by only needing static API key in header.

---
 gateway-api/openapi.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/gateway-api/openapi.yaml b/gateway-api/openapi.yaml
index 0af7e1ee..e34347cd 100644
--- a/gateway-api/openapi.yaml
+++ b/gateway-api/openapi.yaml
@@ -10,15 +10,15 @@ servers:
     description: Local development server
 components:
   securitySchemes:
-    app-level3:
-      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level3
+    app-level0:
+      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level0
 paths:
   /patient/$gpc.getstructuredrecord:
     post:
       summary: Get structured record
       description: Returns a FHIR Bundle containing patient structured record
       security:
-      - app-level3: []
+      - app-level0: []
       operationId: getStructuredRecord
       parameters:
       - in: header
@@ -152,7 +152,7 @@ paths:
       summary: Health check
       description: Returns the health status of the API
       security:
-      - app-level3: []
+      - app-level0: []
       operationId: healthCheck
       responses:
         '200':
@@ -173,11 +173,11 @@ x-nhsd-apim:
   access:
   - title: Application Restricted
     grants:
-      app-level3: []
+      app-level0: []
   target:
     type: external
     healthcheck: /health
-    url: https://feature-gpcapim-257-route-requests-from-apim-using-proxygen.dev.endpoints.clinical-data-gateway.national.nhs.uk/
+    url: <preview-endpoint-url>
     security:
       type: mtls
       secret: <replace-with-secret-name>