diff --git a/data-api/open-api-specification.yml b/data-api/open-api-specification.yml
index 9e83200..c58dd46 100644
--- a/data-api/open-api-specification.yml
+++ b/data-api/open-api-specification.yml
@@ -1259,9 +1259,8 @@ paths:
           in: 'query'
           required: true
           schema:
-            type: 'integer'
-            format: 'int64'
-          example: '123456789'
+            type: 'string'
+            example: '123456789'
         - name: 'provider-id'
           in: 'query'
           required: true
diff --git a/data-service/src/main/java/uk/gov/laa/ccms/data/controller/NotificationsController.java b/data-service/src/main/java/uk/gov/laa/ccms/data/controller/NotificationsController.java
index 35f45b9..862f7c8 100644
--- a/data-service/src/main/java/uk/gov/laa/ccms/data/controller/NotificationsController.java
+++ b/data-service/src/main/java/uk/gov/laa/ccms/data/controller/NotificationsController.java
@@ -44,8 +44,10 @@ public class NotificationsController implements NotificationsApi {
    *         or a {@code ResponseEntity} with HTTP status 404 if the notification is not found.
    */
   @Override
-  public ResponseEntity<Notification> getNotification(Long notificationId, Long userId, Long providerId) {
-    return notificationService.getNotification(notificationId, userId, providerId).map(ResponseEntity::ok)
+  public ResponseEntity<Notification> getNotification(Long notificationId, String userId,
+      Long providerId) {
+    return notificationService.getNotification(notificationId, userId, providerId)
+        .map(ResponseEntity::ok)
         .orElse(ResponseEntity.notFound().build());
   }
 
diff --git a/data-service/src/main/java/uk/gov/laa/ccms/data/repository/NotificationRepository.java b/data-service/src/main/java/uk/gov/laa/ccms/data/repository/NotificationRepository.java
index 6b682cc..2391c2b 100644
--- a/data-service/src/main/java/uk/gov/laa/ccms/data/repository/NotificationRepository.java
+++ b/data-service/src/main/java/uk/gov/laa/ccms/data/repository/NotificationRepository.java
@@ -16,5 +16,5 @@
  */
 @Repository
 public interface NotificationRepository extends ReadOnlyRepository<NotificationInfo, Long> {
-  Optional<NotificationInfo> findByNotificationIdAndUserId(Long notificationId, Long userId);
+  Optional<NotificationInfo> findByNotificationIdAndUserId(Long notificationId, String userId);
 }
diff --git a/data-service/src/main/java/uk/gov/laa/ccms/data/service/NotificationService.java b/data-service/src/main/java/uk/gov/laa/ccms/data/service/NotificationService.java
index eb1b1f6..5f4bd93 100644
--- a/data-service/src/main/java/uk/gov/laa/ccms/data/service/NotificationService.java
+++ b/data-service/src/main/java/uk/gov/laa/ccms/data/service/NotificationService.java
@@ -114,9 +114,10 @@ public Optional<Notifications> getNotifications(final long providerId,
    *     returning a forbidden status
    */
   public Optional<Notification> getNotification(final long notificationId,
-      final long userId,
+      final String userId,
       final long providerFirmId) {
-    Optional<NotificationInfo> byId = notificationRepository.findByNotificationIdAndUserId(notificationId, userId);
+    Optional<NotificationInfo> byId = notificationRepository
+        .findByNotificationIdAndUserId(notificationId, userId);
 
     // Return empty if not found
     if (byId.isEmpty()) {
diff --git a/data-service/src/test/java/uk/gov/laa/ccms/data/controller/NotificationsControllerTest.java b/data-service/src/test/java/uk/gov/laa/ccms/data/controller/NotificationsControllerTest.java
index 7b0ef26..87496cf 100644
--- a/data-service/src/test/java/uk/gov/laa/ccms/data/controller/NotificationsControllerTest.java
+++ b/data-service/src/test/java/uk/gov/laa/ccms/data/controller/NotificationsControllerTest.java
@@ -126,10 +126,10 @@ void getNotifications_badRequest() throws Exception {
   void getNotification_returnsData() throws Exception {
     //Given
     Notification expected = new Notification().notificationId("123").providerFirmId("1");
-    when(notificationService.getNotification(123L, 1L)).thenReturn(Optional.of(expected));
+    when(notificationService.getNotification(123L, "2", 1L)).thenReturn(Optional.of(expected));
     // Then
     String jsonContent = objectMapper.writeValueAsString(expected);
-    this.mockMvc.perform(get("/notifications/123?provider-id=1"))
+    this.mockMvc.perform(get("/notifications/123?user-id=2&provider-id=1"))
         .andDo(print())
         .andExpect(status().isOk())
         .andExpect(content().json(jsonContent));
@@ -139,10 +139,10 @@ void getNotification_returnsData() throws Exception {
   @DisplayName("getNotification: Forbidden data")
   void getNotification_forbidden() throws Exception {
     //Given
-    when(notificationService.getNotification(123L, 1L))
+    when(notificationService.getNotification(123L, "2",1L))
         .thenThrow(new ResponseStatusException(FORBIDDEN, "Access Denied"));
     // Then
-    this.mockMvc.perform(get("/notifications/123?provider-id=1"))
+    this.mockMvc.perform(get("/notifications/123?user-id=2&provider-id=1"))
         .andDo(print())
         .andExpect(status().isForbidden());
   }
@@ -153,17 +153,27 @@ void getNotification_forbidden() throws Exception {
   void getNotification_notFound() throws Exception {
     //Given
     // Then
-    this.mockMvc.perform(get("/notifications/123?provider-id=1"))
+    this.mockMvc.perform(get("/notifications/123?user-id=2&provider-id=1"))
         .andDo(print())
         .andExpect(status().isNotFound());
   }
 
   @Test
-  @DisplayName("getNotification: Bad request")
+  @DisplayName("getNotification: Bad request missing provider ID")
   void getNotification_badRequest() throws Exception {
     //Given
     // Then
-    this.mockMvc.perform(get("/notifications/abc"))
+    this.mockMvc.perform(get("/notifications/abc?user-id=123"))
+        .andDo(print())
+        .andExpect(status().isBadRequest());
+  }
+
+  @Test
+  @DisplayName("getNotification: Bad request missing user ID")
+  void getNotification_badRequestMissingUser() throws Exception {
+    //Given
+    // Then
+    this.mockMvc.perform(get("/notifications/abc?provider-id=123"))
         .andDo(print())
         .andExpect(status().isBadRequest());
   }
diff --git a/data-service/src/test/java/uk/gov/laa/ccms/data/service/NotificationServiceTest.java b/data-service/src/test/java/uk/gov/laa/ccms/data/service/NotificationServiceTest.java
index 5fec2cf..711d13b 100644
--- a/data-service/src/test/java/uk/gov/laa/ccms/data/service/NotificationServiceTest.java
+++ b/data-service/src/test/java/uk/gov/laa/ccms/data/service/NotificationServiceTest.java
@@ -166,17 +166,18 @@ class GetNotificationTests{
     void shouldReturnNotification(){
       // Given
       long notificationId = 1L;
+      String userId = "123456";
       NotificationInfo notificationInfo = NotificationInfo.builder().providerFirmId(1L).build();
       Notification expected = new Notification().notificationId("1").providerFirmId("1");
-      when(notificationRepository.findById(notificationId))
+      when(notificationRepository.findByNotificationIdAndUserId(notificationId, userId))
           .thenReturn(Optional.of(notificationInfo));
       when(notificationMapper.mapToNotification(notificationInfo)).thenReturn(expected);
       // When
-      Optional<Notification> result = notificationService.getNotification(notificationId, 1L);
+      Optional<Notification> result = notificationService.getNotification(notificationId, userId, 1L);
       // Then
       assertTrue(result.isPresent());
       assertEquals(expected, result.get());
-      verify(notificationRepository, times(1)).findById(notificationId);
+      verify(notificationRepository, times(1)).findByNotificationIdAndUserId(notificationId, userId);
       verify(notificationMapper, times(1)).mapToNotification(notificationInfo);
     }
 
@@ -185,11 +186,12 @@ void shouldReturnNotification(){
     void shouldReturnEmpty(){
       // Given
       long notificationId = 1L;
+      String userId = "123456";
       // When
-      Optional<Notification> result = notificationService.getNotification(notificationId, 1L);
+      Optional<Notification> result = notificationService.getNotification(notificationId, userId, 1L);
       // Then
       assertTrue(result.isEmpty());
-      verify(notificationRepository, times(1)).findById(notificationId);
+      verify(notificationRepository, times(1)).findByNotificationIdAndUserId(notificationId, userId);
       verify(notificationMapper, times(0)).mapToNotification(any());
     }
 
@@ -198,12 +200,13 @@ void shouldReturnEmpty(){
     void shouldThrowException() {
       // Given
       long notificationId = 1L;
+      String userId = "123456";
       NotificationInfo notificationInfo = NotificationInfo.builder().providerFirmId(1L).build();
-      when(notificationRepository.findById(notificationId))
+      when(notificationRepository.findByNotificationIdAndUserId(notificationId, userId))
           .thenReturn(Optional.of(notificationInfo));
       // When / Then
       assertThrows(ResponseStatusException.class,
-          () -> notificationService.getNotification(notificationId, 500));
+          () -> notificationService.getNotification(notificationId, userId, 500));
     }
   }
 }
\ No newline at end of file