1. Unique Student Identifier Web Services Skills Division 25 th, 26 th June and 1 st July 2014

2. Agenda USI Web Services Overview Authentication Authorisation Verify USI methods  Single Verify  Bulk Verify Create USI methods  Single Create USI  Bulk Create USI  Retrieve Bulk Upload Results DVS check Testing and production Connection tips 2

3. USI Web Service Overview There are five (5) USI Web Service methods available to training- related organisations: Verify USI  A synchronous service that accepts a single USI, first name, family name and date of birth and returns a response indicating the accuracy of the information provided. Bulk Verify USI  A synchronous service similar to Verify USI, but accepts and processes up to 500 USIs in the one transaction. 3

4. USI Web Service Overview Create USI  A synchronous service that accepts personal, contact and identity information for a student and attempts to create a USI.  Provides an immediate response, including the Student’s USI if the request was successful. Bulk Create USI  An asynchronous service that accepts requests for up to 500 USIs.  Same information as required for Create USI method.  Returns a response indicating if the request is valid.  Returns a Receipt Numberthat must be used to retrieve batch results, using the BulkUploadRetrieveResponse method Bulk Upload Retrieve Response  Returns the results of a Bulk Create USI batch, based on the Receipt Number.  Similar information for each record as Create USI 4

5. Authentication Consumers of USI Web Services are authenticated using a Device AUSkey that belongs to the organisation’s ABN: Device AUSkeys are a different type to Individual AUSkeys  Web services will not accept individual AUSkeys  The Device AUSkey must be stored on the calling device  Device AUSkeys cannot be used to access the on-line Organisation Portal  Device AUSkeys expire after 2 years and must be renewed o They are not automatically renewed For hosted service providers that support organisations from multiple ABNs, a Device AUSkey will be needed for each ABN, and the correct AUSkey must be used for each web service call. 5

6. Authentication VANguard is trusted by the USI web services to correctly authenticate consumers based on the AUSkey credential they hold The VANguard service is based on WS-* standards How the tokens work is defined in the document VANguard S007 Security Token Service TSC. This document is included in the on- boarding pack. Consumer’s application server VANguard STS server USI server 1. Request Token (pass AUSkey) 2. Return STS Token 3. Web service request (pass STS token) 6

7. Authorisation Once the consumer has been authenticated, there are a series of authorisations steps to ensure the consumer has web service access to the destination organisation: Checks that the Org code specified in the request:  Is registered in the USI Core System  Has an ABN that matches the certificate generated from the AUSkey  Has been authorised to use USI Web Services by the Registrar  Is of the correct Organisation Type to use the called method: o RTOs and VABs can Create USIs o RTOs, VABs, VRBs and TAs can Verify USIs 7

8. Authorisation It is important that Create USI events are able to be traced back to an individual user: Requests to Create USI and Bulk Create USI must include a UserReference element:  This element must contain the UserId/LoginId of the user, in the organisation’s application, that initiated the creation of the USI in that application  This will be logged, along with the identifier of the Device AUSkey, in the USI event logs. 8

9. Verify USI The Verify USI and Bulk Verify USI methods accept a USI, first name, family name and date of birth and returns a response indicating the accuracy of the information provided. Input:  USI (Check digit algorithm available with the on-boarding pack)  First Name and Family Name or  Single Name  Date of Birth Output:  USI Status o Valid, Invalid, Deactivated  For each of First Name, Family Name (or Single Name) and Date of Birth o Valid, Invalid, Deactivated 9

10. Verify USI – Equivalent Portal Page 10

11. Create USI The Create USI method accepts personal, contact and identity information for a student and attempts to create a USI. Input:  Personal details  Contact details o E-mail is preferred contact method, mobile is second preferred.  DVS check details Output:  If successfully created, new USI  If not successfully created: o Reason o If identical match, matched USI 11

12. Bulk Create USI The Create USI method accepts up to 500 sets of personal, contact and identity information for a student and attempts to create a USI for each set. Input:  Batch information  Sets of: o Personal details o Contact details o DVS check details Output:  Receipt Number o Used to retrieve batch results 12

13. Retrieve Bulk Upload Results The Retrieve Bulk Upload Results method accepts a Receipt Number and returns the results of each create USI request for that batch. If the batch is not complete, the response will be Batch Not Completed. Input:  Receipt Number Output:  Result of each create USI request o Same details as for Create USI output Notes:  Results will be available once all records in the batch have been processed  Should DVS be unavailable for a particular document type, USI will continue to poll DVS until that service is available. This could delay the results for the corresponding batch. 13

14. DVS Check The DVS/EoI check involves passing limited data to the Attorney Generals Department’s DVS service, which in turn sends a request to document issuers to verify the validity of the document. The information passed to DVS varies between document types, the state of issue and, in some cases, the date of document issue The USI system applies a comprehensive set of pre-validation prior to sending the information to DVS, providing useful messages back to the consuming system if data is incorrect  E.g. incorrect document id formats, missing information, chronologically incorrect dates etc. The rules for each of the document types are detailed in the USI Technical Services Contract 14 Note: Sample DVS data entry pages from the USI Organisation Portal are included at the end of this slide deck as examples.

15. DVS Check Of particular note:  The DVS service only replies with a Yes or No – no reason is given if the result is No  The Country codes for Visas MUST be in the set provided in the TSC  The Locality/State/Postcode combination for Contact Details mail address MUST match the current Australia Post PCODE dataset 15

16. DVS Check Override The option to override the DVS check in a create USI service call is not available to all organisations The Registrar will determine which organisations have the ability to override the DVS check The Registrar will also determine whether these organisations have the ability to override the DVS check through web services, and will apply an expiry date to this authorisation The USI web services will check this permission at the authorisation step for Create USI web service calls, and reject any transactions that specify DVS override where it has not been permitted by the Registrar 16

17. Testing and Production Two environments are provided for connection to USI Web Services: Third Party Test:  Used by USI web service providers to test their software against VANguard and USI web services.  Will use a test device AUSkey and an pre-allocated set of organisation codes. Both are provided on registration for Third Party Testing as part of the on- boarding pack Production:  Requires a valid, production device AUSkey  Will require use of a registered Organisation code, either an RTO code registered with training.gov.au or a VAB, VRB or TA code allocated by the Registrar 17

18. Connection Tips The details for connecting to VANguard STS are covered in the VANguard documentation, including sample code for.NET and Java. The details for connecting to USI are included in the Technical Services Contract. There is sample code for.NET and USI is working on an equivalent sample code for Java. From our experience with dealing with some external parties already in third party test: Use libraries wherever possible  WCF for.NET, the latest version possible..NET 3.5+ best. o Works “out-of-the-box”  For Java, there is a library called WSIT (Web Services Interoperability Technologies) authored by Microsoft and Sun and published on the Oracle website. o Works “out-of-the-box”, with particular care with certificate handling 18

19. Support Support is available to assist in connecting to the VANguard and USI web services. Contact details will be provided with the on- boarding pack As there are expected to be a large number of organisations and vendors developing connections in a short time frame, the support team is expected to receive significant numbers of calls Please read the provided documentation and sample code carefully and attempt to troubleshoot problems before calling support If you do request support, be sure to send:  Fiddler (or equivalent) trace, SSL decrypted  Call to STS and response received  Call to USI and response received 19

20. DEPARTMENT OF INDUSTRY Industry House 10 Binara Street Canberra City, ACT 2601, Australia Telephone +61 2 6213 6000 20

21. 21 Sample DVS data entry pages from the USI Organisation portal

22. 22 Selection of Document Types

23. 23 Drivers Licence (ACT)

24. 24 Medicare Card

25. 25 Passport

26. 26 Birth Certificate (NSW)