The National Rail Data Portal is National Rail's data platform, through which users can subscribe to HSP, Darwin, DTD, and KnowledgeBase. The platform is also used for CIGP (Customer Information GPS Platform) and CTI (Connecting Train Identifiers); these APIs and feeds aren't currently available to open data users.

Only the Knowledgebase API and DTD are available directly through NRDP's API, the other subscriptions (including real-time KB incidents) are accessed externally, using the information included in the My Feeds tab.

New users can register using the registration form on https://opendata.nationalrail.co.uk/

Authentication

To authenticate, POST to https://opendata.nationalrail.co.uk/authenticate with form parameters "username" and "password" set accordingly - the request must be urlencoded, and not multipart.

For example, if the username was alice@example.com, and the password was hunter2%^, the request would look like this:

POST /authenticate HTTP/1.1
Host: opendata.nationalrail.co.uk
Content-Type: application/x-www-form-urlencoded
Content-Length: 51

username=alice%40example.com&password=hunter2%25%5E

Using curl:

curl 'https://opendata.nationalrail.co.uk/authenticate' \
     --data-urlencode 'username=alice@example.com' \
     --data-urlencode 'password=hunter2%^'

Successful authentication should yield a JSON object with three keys.

username is self-explanatory.
roles contains only the roles your account has, this example is missing ROLE_DTD and ROLE_HSP_USER, because the user is not subscribed to them.
token is your authentication token, which includes your username, the time the token will expire (expressed in milliseconds since the UNIX epoch), and finally the secret.

{
    "username":"alice@example.com",
    "roles":
    {
        "ROLE_DARWIN":true,
        "ROLE_KB_REAL_TIME":true,
        "ROLE_STANDARD":true,
        "ROLE_KB_API":true
    },
    "token":"alice@example.com:1702858757000:JAlA9FAzcdFAfDAZX8a1JYIsXaa4uFNDI0qaePaXRQA="
}

If the username or password are invalid:

{"error":"Invalid username/password"}

Authenticating requests

The token should be supplied in full with each request made to NRDP in the X-Auth-Token header, e.g.

curl 'https://opendata.nationalrail.co.uk/api/staticfeeds/2.0/routeing' \
     -H 'X-Auth-Token: alice@example.com:1702858757000:JAlA9FAzcdFAfDAZX8a1JYIsXaa4uFNDI0qaePaXRQA=' \
     --output routeing.zip

If the token is expired or invalid, instead of the routeing zip:

{
  "timestamp": "2023-12-18T00:56:23.284+0000",
  "status": 401,
  "error": "Unauthorized",
  "message": "Unauthorized",
  "path": "/api/staticfeeds/2.0/routeing"
}