Purpose of this Guide

The National Biomedical Imaging Archive (NBIA) REST APIs allow you to access the search and download functions used in the TCIA radiology portal. 

The NBIA Search with Authentication REST APIs, described on this page, allow you to perform basic queries on and download data for image analysis from public and restricted collections. This guide explains how to authenticate yourself by requesting a token and then using that token to query and download data from restricted collections.

NBIA Search with Authentication REST API Base URL, Format, and Return Values

Access to any NBIA Search with Authentication REST API requires an authentication token. You must contact the TCIA Help Desk to receive the client_id and client_secret needed to generate a token. The TCIA Help Desk must give your user account permission to access restricted collections. 

The full API for data consists of a base URL followed by the API and query parameters, in that order. The base URL to access NBIA Search with Authentication REST APIs is https://services.cancerimagingarchive.net/nbia-api/services/v2/. 

<Token><BaseURL><Resource><QueryEndpoint>?<QueryParameters>

For example, the API call below requests all modality values for the TCGA-BRCA collection.

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getModalityValues?Collection=TCGA-BRCA"

We can break this down as follows.

See Image Download APIs and Image Metadata APIs for more information about each NBIA Search with Authentication REST API.

Secure Access to NBIA REST Services

Access to any NBIA Search with Authentication API requires a token that you must request.

The NBIA REST API supports secure access to private data in the Client Credentials authorization flow with Spring Security and OAuth2. The Client Credentials authorization flow is also known as "signed fetch" or 2-legged OAuth. The following figure illustrates the typical use case for REST API calls made on the web using 2-legged OAuth. For more information regarding the specific workflow, consult the OAuth2 Specification. 

     +---------+                                  +---------------+
     |         |                                  |               |
     |         |>--(A)- Client Authentication --->| Authorization |
     | Client  |                                  |     Server    |
     |         |<--(B)---- Access Token ---------<|               |
     |         |                                  |               |
     +---------+                                  +---------------+

Figure 1: Client Credentials Flow

This flow includes the following steps:

1. The client authenticates with the authorization server and requests an access token from the token endpoint.
2. The authorization server authenticates the client, and if valid, issues an access token.

This token can then be used on subsequent requests to authorize access to resources. The REST API server also supports token expiration and extension by refresh. The time it takes tokens to expire is currently two hours but is configurable.

To access TCIA using an NBIA Search with Authentication REST API, you must do the following:

• Request a token
• Use the token in an API call

Requesting a Token

Access to any NBIA Search with Authentication REST API requires an authentication token. You must contact the TCIA Help Desk to receive the client_id and client_secret needed to generate a token. 

A request for a token takes the following structure. Refer to the table below for the correct username and password to pass in the call.

curl -d "username=<username>&password=<password>&client_id=<theClientIDFromHelpDesk>&client_secret=<theClientSecretFromHelpDesk>&grant_type=password" -X POST -k https://services.cancerimagingarchive.net/nbia-api/oauth/token

Request a token by interacting with the application in the following way.

1. The application requests credentials. The credentials you pass are different depending on if you want to access public or restricted data (see above).

2. The application sends a request to the service using the credentials you provided as a query string for the body. 

   • grant_type=password
   • username
   • password

3. The service responds with access token details and expiration information.

   • access_token
   • expires_in
   • token_type

   The application makes a request for resources using the returned access token. All APIs listed for accessing public data also support secure access to restricted data with an additional parameter for the access token. 

How a Token is Returned/Granted/Given

A successful token request returns a standard access token in JSON format.

{"access_token":"f7889076-b3e4-4768-9419-3cd973adda76","token_type":"bearer","refresh_token":"671bb72b-f929-4ef5-a4d7-b52341a6007a","expires_in":7199}

Using the Token in an API Call

Make a note of the access token you received and pass it with the REST service call.

# Request for modality values
curl -H "Authorization:Bearer c428d42c-9eed-4f5d-8007-416d46be9b52" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getModalityValuesAndCounts?Collection=LIDC-IDRI"

A successful service request returns the value in a defined format. 

Request for Refreshing the Token

The time it takes tokens to expire is configurable but is currently two hours.

# Request for refreshing the token  

$ curl -X -v -d "refresh_token=7c2414a1-1f2f-4c9e-82a0-69fcb9fd18ed&client_id=nbiaRestAPIClient&client_secret=ItsBetweenUAndMe&grant_type=refresh_token" -X POST -k https://services.cancerimagingarchive.net/nbia-api/oauth/token
        
/nbia-api/oauth/token"

In the following result, 119 is the seconds before the token expires.

{"access_token":"bbe4aa2c-7235-41ad-9770-31619d3dbd15","token_type":"bearer","refresh_token":"671bb72b-f929-4ef5-a4d7-b52341a6007a","expires_in":119}

Example Request to Logout

# Request for logout   
      
$ curl -H "Authorization:Bearer caa278aa-e7a9-45b8-a7ec-2c83d4b03cc0" -k "https://services.cancerimagingarchive.net/nbia-api/logout"

Result

 You Have Logged Out successfully.

Image Download APIs

Use the APIs in the following table to download images from TCIA. 

Image Metadata APIs

Use the APIs in the following table to explore the metadata of objects in the TCIA database. Queries return a file in one of these data formats: CSV, HTML, XML, and JSON. JSON is the default return format if no format parameter is specified.

Return Values

This section lists and explains the return values of the APIs included in both tables above.

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getBodyPartValues"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getCollectionValues"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getContentsByName?name=TCIA_TCGA-PRAD_08-09-2016-v3"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getImage?SeriesInstanceUID=1.3.6.1.4.1.9590.100.1.2.374115997511889073021386151921807063992"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getImageWithMD5Hash?SeriesInstanceUID=1.3.6.1.4.1.14519.5.2.1.6919.4624.313514201353787659031503464798"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getManufacturerValues"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getModalityValues"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/NewPatientsInCollection?Collection=CBIS-DDSM&Date=2010/08/16"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/NewStudiesInPatientCollection?Collection=CBIS-DDSM&Date=2010/08/16"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getPatient"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getPatientByCollectionAndModality?Collection=VICTRE&Modality=MG"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getPatientStudy"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getSeries

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getSeriesMetaData?SeriesInstanceUID=1.3.6.1.4.1.9590.100.1.2.374115997511889073021386151921807063992"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getSeriesSize?SeriesInstanceUID=1.3.6.1.4.1.9590.100.1.2.374115997511889073021386151921807063992"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getSingleImage?SeriesInstanceUID=1.3.6.1.4.1.9590.100.1.2.374115997511889073021386151921807063992&SOPInstanceUID:1.3.6.1.4.1.9590.100.1.2.289923739312470966435676008311959891294"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getSOPInstanceUIDs?SeriesInstanceUID=1.3.6.1.4.1.9590.100.1.2.374115997511889073021386151921807063992"

curl -H "Authorization:Bearer cd2b2895-85d0-49c5-bd75-804f162da942" -k "https://services.cancerimagingarchive.net/nbia-api/services/v2/getUpdatedSeries?fromDate=01/01/2020"