ABHA creation, Aadhaar OTP

Create an ABHA from a verified Aadhaar OTP

Exchanges the OTP you just received for a real ABHA number. Send the txnId from the OTP request, the encrypted OTP value, and the consent block recording that the person agreed.

MandatoryEither of the test cases CRT_ABHA_114 or CRT_ABHA_115 is mandatory for Governement Optional for Private. Either of the test cases CRT_ABHA_209 or CRT_ABHA_210 is mandatory for Governement Optional for Private. Either of the test cases CRT_ABHA_308 or CRT_ABHA_309 is mandatory for Governement Optional for Private. Mandatory for Private. Mandatory for Private /Government (Optional for integrated program using demo auth as they have default ABHA address generated)

Certification cases CRT_ABHA_101, CRT_ABHA_102, CRT_ABHA_103, CRT_ABHA_104, CRT_ABHA_105, CRT_ABHA_106, CRT_ABHA_107, CRT_ABHA_108, CRT_ABHA_109, CRT_ABHA_112, CRT_ABHA_113, CRT_ABHA_114, CRT_ABHA_115, CRT_ABHA_201, CRT_ABHA_202, CRT_ABHA_203, CRT_ABHA_204, CRT_ABHA_205, CRT_ABHA_206, CRT_ABHA_207, CRT_ABHA_208, CRT_ABHA_209, CRT_ABHA_210, CRT_ABHA_301, CRT_ABHA_302, CRT_ABHA_303, CRT_ABHA_304, CRT_ABHA_305, CRT_ABHA_306, CRT_ABHA_307, CRT_ABHA_308, CRT_ABHA_309

POST/v3/enrollment/enrol/byAadhaar

This is the call that creates the account, so treat a success as a permanent side effect. If you retry it blindly after a timeout you may be enrolling somebody twice.

BENEFIT_NAME is sent on this call when the enrolment belongs to a benefit scheme.

The demographic authentication variant reads the user token from a different place: token at the top level, while the OTP, face and fingerprint variants take tokens.token. Check which one you get before parsing.

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Headers

REQUEST-IDstringRequired

Unique UUID v4 per request. Used for idempotency and distributed tracing. Generate a fresh UUID for every call.

TIMESTAMPstringRequired

ISO 8601 UTC timestamp of the request.

BENEFIT_NAMEstring

The benefit scheme an enrolment belongs to. Send healthid api on the enrol and search calls, and healthid on the login OTP and verify calls under Find ABHA. On the enrolment OTP request the header is present but explicitly disabled, so it is not sent there.

A login OTP request sent with healthid api rather than healthid was accepted on the sandbox on 2026-09-11, so the login calls may take either.

NHA's files spell this header four different ways and use scheme values beyond healthid. Which spelling each endpoint accepts is not confirmed against the sandbox. The Conventions page for this module lists all four.

X-tokenstring

The user scoped token returned when a person logs in or verifies an OTP. Profile calls act on one account, so they need this in addition to the gateway token. Required on the calls that read or change a specific person's account.

Send the bare token. Unlike the Authorization header this one carries no Bearer prefix, and adding one is refused as ABDM-1094 with the message X-token expired. That message names the wrong thing: a token rejected one second after it was issued has not expired, it was malformed. Check the prefix before the lifetime.

Body

authDataobjectRequired

authData.authMethodsstring[]Required

authData.otpobject

authData.otp.txnIdstringRequired

authData.otp.otpValuestring

authData.otp.mobilestringRequired

authData.otp.fingerPrintAuthPidstring

authData.otp.timeStampstring

authData.faceobject

authData.face.txnIdstringRequired

authData.face.aadhaarstringRequired

authData.irisobject

authData.iris.aadhaarstringRequired

authData.iris.PidstringRequired

authData.iris.mobilestringRequired

authData.bioobject

authData.bio.aadhaarstringRequired

authData.bio.fingerPrintAuthPidstringRequired

authData.bio.mobilestringRequired

consentobjectRequired

consent.codestringRequired

consent.versionstringRequired

Responses

200

The specification does not describe this body. Send the call with Try it to see what comes back.

400

Bad Request, invalid scope, loginHint, or encrypted field

Error codes for this module

401

Unauthorized, missing, invalid, or expired Bearer token

Everything returns 401

403

Forbidden, the token is valid but not permitted for this operation

Error codes for this module

422

Unprocessable, the request parsed but failed validation

Error codes for this module

500

Server error, retry

Error codes for this module

Create an ABHA from a verified Aadhaar OTP

curl --request POST \
  --url https://abhasbx.abdm.gov.in/abha/api/v3/enrollment/enrol/byAadhaar \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'REQUEST-ID: <REQUEST_ID>' \
  --header 'TIMESTAMP: <TIMESTAMP>' \
  --header 'BENEFIT_NAME: healthid api' \
  --header 'X-token: <X_TOKEN_FROM_LOGIN_VERIFY>' \
  --header 'Content-Type: application/json' \
  --data '{
  "authData": {
    "authMethods": [
      "otp"
    ],
    "otp": {
      "txnId": "<TXN_ID>",
      "otpValue": "<OTPVALUE>",
      "mobile": "<MOBILE>"
    }
  },
  "consent": {
    "code": "abha-enrollment",
    "version": "1.4"
  }
}'

The specification does not describe this body. Send the call with Try it to see what comes back.