Support and services for older people in Nigeria
Catalogue updated 2026-10-01
API & data standards
API standards
| Area | Requirement |
|---|---|
| Specification | Every API published with an OpenAPI 3.1 specification before go-live; spec is the contract. |
| Authentication | OAuth 2.0 client credentials for systems; OIDC for people. Partner keys scoped to agreed datasets. |
| Transport | TLS 1.3 only; HSTS; mTLS for government-to-government links. |
| Rate limits | PENDING APPROVAL — proposed: 60 requests/min per key, burst 120; 429 with Retry-After |
| Idempotency | All POST/PUT accept an Idempotency-Key header; replays within 24 h return the original result. |
| Error model | RFC 9457 problem+json: type, title, status, detail, instance, plus correlation_id. |
| Sandbox | Sandbox environment with synthetic data and the same contract; keys never valid across environments. |
| Versioning & deprecation | Breaking changes only in a new major version, with 6 months' notice and parallel running of old and new versions. |
| Audit | Every API call logged with client, key, dataset, purpose code, status and latency. Retention: PENDING APPROVAL — proposed: at least 6 years |
File exchange standards
| Area | Requirement |
|---|---|
| Transfer | SFTP (key-based) or approved secure transfer; no email attachments. |
| Encryption | PGP for files in transit; AES-256 at rest. |
| Manifest | Every file has a manifest: record count, schema version, SHA-256 checksum, extract timestamp, source ID. |
| Acknowledgement | Receipt acknowledgement within 1 hour; reconciliation report (received / accepted / quarantined / rejected) within 24 hours. |
| Encoding & dates | UTF-8; ISO 8601 dates (YYYY-MM-DD) and timestamps with offset. |
| Exceptions | Exception file returned with row number, field and reason code (e.g. E01 missing mandatory, E02 invalid code, E03 duplicate). |
manifest.json
{ "source": "PENCOM", "schema_version": "2.1", "record_count": 18230,
"sha256": "9f2c…e1", "extracted_at": "2026-10-15T02:00:00+01:00" }Identity verification options
| Option | Description | Use case | Volume / latency | Fallback |
|---|---|---|---|---|
| Real-time single | One NIN checked against NIMC at registration. | Self-registration, agent capture | Single; <3 s | Queue for batch; register as unverified |
| Batch | Nightly file of NINs sent to NIMC; results matched back. | Bulk ingestion, re-verification | Up to 500k/night; next day | Retry next cycle; assisted verification |
| Assisted | Agent verifies documents in person and records evidence. | No NIN, NIMC down | Single; same visit | Community validation |
| Community validation | Two recognised community leaders attest identity and age. | No documents, rural areas | Single; days | Provisional record with review date |
| Remote documentary (diaspora) | Foreign passport / ID reviewed remotely; documentary assurance only, never NIN-verified. | Nigerians abroad without NIN | Single; 5 working days | Verify NIN on return |
USSD / SMS gateway requirements
| Area | Requirement |
|---|---|
| Short code | One shortcode live on all major networks (MTN, Airtel, Glo, 9mobile). |
| Menu depth | Up to 8 menu levels; session timeout handled with resume. |
| Languages | English, Hausa, Igbo, Yoruba and Nigerian Pidgin. |
| Cost | Zero-rated / subsidised sessions for older persons. |
| Inbound keywords | HELP, STATUS, STOP, YES <code>, CALL handled with auto-reply. |
| Diaspora | International SMS route for diaspora registrants. |
| Resilience | Two aggregators with automatic failover. |
Standards register
| Standard | Used for | Where |
|---|---|---|
| HL7 FHIR R4 | Health data exchange | NHIA, DHIS2 |
| DHIS2 | Health indicators & org units | FMOH |
| WHO ICF / ICOPE | Functional ability & intrinsic capacity | Needs assessment |
| ICD-11 | Diagnosis coding | Health domain |
| NPC / NBS geographic codes | State, LGA, ward codes | All modules |
| ISO 639 | Language codes | Preferences, templates |
| ISO 8601 | Dates and times | All exchanges |
| ISO 3166 | Country codes | Diaspora |
| WCAG 2.1 AA | Accessibility | All screens |
| NDPA 2023 | Data protection law | All processing |
| TLS 1.3 | Transport security | All APIs |
| OAuth 2.0 | Authorisation | APIs, partner keys |
| AES-256 | Encryption at rest | Storage, files |
| IATI | Funding transparency | Recognition ledger |
Decision register — partner access and integrations
| Ref | Decision | Value | Status | Owner | Source |
|---|---|---|---|---|---|
| D-P01 | Personal and de-identified data need a data steward and a different-person DPO approval | Two approvals from two people | Confirmed | DPO | Stage 13 brief |
| D-P02 | Partner API keys serve aggregate datasets only | Microdata only in the controlled environment | Confirmed | DPO | Stage 13 brief |
| D-P03 | Access ends automatically when a grant expires; its API keys stop working | Automatic, no manual step | Confirmed | DPO | Stage 13 brief |
| D-P04 | A licence breach suspends the grant, its microdata access and its API keys until reinstated | Immediate suspension | Confirmed | DPO | Stage 13 brief |
| D-P05 | Staff roles allowed to act as data steward | PENDING APPROVAL — proposed: HQ Ops, Sysadmin or Analyst | Pending approval | DG / DPO | Not yet approved |
| D-P06 | Named NSCC integration steward per system | PENDING APPROVAL — proposed: one named steward per interface | Pending approval | Head of ICT | Signed ICDs |
| D-P07 | Named data steward per dataset | PENDING APPROVAL — proposed: role-holder listed on each dataset | Pending approval | Head of M&E | Not yet approved |
| D-P08 | Interface quality thresholds | PENDING APPROVAL — proposed: figures shown on each interface | Pending approval | Head of ICT with each partner | Signed ICDs |
| D-P09 | Integration phase per system | PENDING APPROVAL — proposed: phases 1–3 shown on each interface | Pending approval | Programme board | Implementation plan |
| D-P10 | Feed suspension trigger | PENDING APPROVAL — proposed: 2 consecutive threshold breaches or a security incident | Pending approval | Head of ICT | Signed ICDs |
| D-P11 | API rate limits | PENDING APPROVAL — proposed: 60 requests/min per key, burst 120; 429 with Retry-After | Pending approval | Head of ICT | Not yet approved |
| D-P12 | Small-cell suppression threshold | PENDING APPROVAL — proposed: cells under 5 suppressed | Pending approval | DPO / Head of M&E | Not yet approved |
| D-P13 | Open data licence | PENDING APPROVAL — proposed: CC BY 4.0 | Pending approval | Legal | Not yet approved |
| D-P14 | Researcher data-use licence text and version | PENDING APPROVAL — proposed: NSCC-DUL-1.0 draft | Pending approval | Legal / DPO | Not yet approved |
| D-P15 | API audit log retention | PENDING APPROVAL — proposed: at least 6 years | Pending approval | DPO | Retention schedule |
Anything marked PENDING APPROVAL is a proposal, not a confirmed NSCC decision.