Skip to main content

ABHA verification, mobile OTP

Send a login OTP

Starts a login. loginHint selects what the person is identifying themselves with: mobile, aadhaar or abha-number. As everywhere in M1, loginId is encrypted rather than raw.

Mandatory

Certification cases PROF_ABHA_605, VRFY_ABHA_101, VRFY_ABHA_201, VRFY_ABHA_301, VRFY_ABHA_302, VRFY_ABHA_303, VRFY_ABHA_304, VRFY_ABHA_305, VRFY_ABHA_401, VRFY_ABHA_402, VRFY_ABHA_403, VRFY_ABHA_404, VRFY_ABHA_405

POST/v3/profile/login/request/otp

The shape you encrypt matters, because the service validates the plaintext after it decrypts. On abha-number that is the fourteen digits with their dashes, NN-NNNN-NNNN-NNNN, for example 91-1234-5678-9015. The bare digits are refused with 400 {"loginId": "LoginId is invalid"}, observed on the sandbox on 11 September 2026. On mobile the plaintext is ten digits with no country code, and on aadhaar twelve digits with no spaces.

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Headers

REQUEST-IDstringRequired

Unique UUID v4 per request. Used for idempotency and distributed tracing. Generate a fresh UUID for every call.

TIMESTAMPstringRequired

ISO 8601 UTC timestamp of the request.

BENEFIT_NAMEstring

The benefit scheme an enrolment belongs to. Send healthid api on the enrol and search calls, and healthid on the login OTP and verify calls under Find ABHA. On the enrolment OTP request the header is present but explicitly disabled, so it is not sent there.

A login OTP request sent with healthid api rather than healthid was accepted on the sandbox on 2026-09-11, so the login calls may take either.

NHA's files spell this header four different ways and use scheme values beyond healthid. Which spelling each endpoint accepts is not confirmed against the sandbox. The Conventions page for this module lists all four.

Body

scopestring[]Required
loginHintstringRequired

What the person is identifying themselves with.

One of mobileaadhaarabha-number

loginIdstringRequired

The identifier for that loginHint, RSA encrypted against the ABDM public certificate and base64 encoded. The plaintext shape is checked after decryption: an ABHA number is NN-NNNN-NNNN-NNNN with its dashes, a mobile number is ten digits with no country code, an Aadhaar number is twelve digits with no spaces.

otpSystemstringRequired
txnIdstring

Responses

200

The transaction id to carry into the next step, with a message.

400

Bad Request, invalid scope, loginHint, or encrypted field

Error codes for this module

401

The error returned, with its code and message.

Everything returns 401

403

Forbidden, the token is valid but not permitted for this operation

Error codes for this module

404

Resource not found

Error codes for this module

500

Server error, retry

Error codes for this module

Last updated on