# Norwegian Helsenett

ebMS 2.0 with each payload signed by the sender and encrypted for the recipient - Norway's health messaging profile.

Health messaging in Norway uses the national health network's ebXML framework - ebMS 2.0 exchanges in which the business documents themselves are signed and encrypted. The Norwegian profile requires each payload to be signed by the sender and encrypted for the specific recipient, so a message remains protected when it is stored or relayed.

## What the profile mandates {#what-the-profile-mandates}

| Requirement | Where it comes from | In Zato |
| --- | --- | --- |
| ebMS 2.0 message structure | The national ebXML framework | [ebXML messaging](https://zato.io/docs/dev/soap/ebxml/index.html) over an outgoing SOAP connection |
| Payloads signed by the sender | The framework's security profile | `sign=True` on the call |
| Payloads encrypted for the recipient | The framework's security profile | `encrypt=True` on the call |
| Enterprise certificates for both operations | The national PKI | A [WS-Security definition](https://zato.io/docs/dev/soap/security/index.html#x509) holding the PEM material |
| Party identifiers from the addressing registry | The national directory | `from_party` and `to_party` on the call |

## Configuring the connection {#configuring-the-connection}

**Step 1.** Create a [WS-Security](https://zato.io/docs/security/ws-security.html) definition under **Security** > **WS-Security** and fill in its Crypto material tab: your **Signing key** and **Signing certificate chain** for the signatures, the recipient's **Peer certificate** for encryption, and your **Decryption key** with **Trust anchors** for what comes back:

**Step 2.** Create the outgoing connection under **Connections** > **Outgoing** > **SOAP** with the counterparty's address and attach the definition in the Security tab.

**Step 3.** Send with both switches on - each part is signed first, so the signature covers the plaintext, then encrypted for the recipient:

```python
info = EbXMLInfo()
info.from_party = 'my-her-id'
info.to_party = 'their-her-id'
info.cpa_id = 'cpa-identifier'
info.conversation_id = self.cid
info.service = 'urn:example:messaging'
info.action = 'SubmitMessage'

part = Part()
part.content_id = 'payload-1'
part.content_type = 'application/xml'
part.data = clinical_document

ack = self.soap['Helsenett'].invoke_ebxml(info, [part], sign=True, encrypt=True)
```

The signatures and the wrapped content keys of each payload go in the message's security header.

## Learn more {#learn-more}

- [SOAP integrations](https://zato.io/docs/dev/soap/) - Envelopes, versions and Python objects instead of XML
- [SOAP as Python objects](https://zato.io/docs/dev/soap/python-objects/) - Build requests and read responses with dot access, no schemas
- [SOAP security](https://zato.io/docs/dev/soap/security/) - WS-Security, credentials in the body and client certificates
- [MTOM and SwA attachments](https://zato.io/docs/dev/soap/attachments/) - Binary content out of the envelope and into MIME parts
- [SOAP mandates](https://zato.io/docs/dev/soap/mandates/) - What each national and sector profile requires, and how to meet it
- [SOAP tutorial](https://zato.io/tutorials/soap/calling.html) - Call any SOAP service with Python objects, start to finish