ABHA verification, mobile OTP

Choose which ABHA to sign in to

Used when one mobile number carries several ABHA accounts, which is common in a family. Send the txnId from the verify call and the ABHA number the person picked.

Mandatory

Certification cases PROF_ABHA_605, VRFY_ABHA_301, VRFY_ABHA_302, VRFY_ABHA_303, VRFY_ABHA_304, VRFY_ABHA_305

POST/v3/profile/login/verify/user

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Headers

REQUEST-IDstringRequired

Unique UUID v4 per request. Used for idempotency and distributed tracing. Generate a fresh UUID for every call.

TIMESTAMPstringRequired

ISO 8601 UTC timestamp of the request.

T-tokenstringRequired

The transaction token that carries state between the two halves of a login. Required for account selection. See the shared TToken parameter for the general description.

Body

ABHANumberstringRequired

txnIdstringRequired

Responses

200

The user token and refresh token, with their expiries.

400

Bad Request, invalid scope, loginHint, or encrypted field

Error codes for this module

401

Unauthorized, missing, invalid, or expired Bearer token

Everything returns 401

403

Forbidden, the token is valid but not permitted for this operation

Error codes for this module

500

Server error, retry

Error codes for this module

Choose which ABHA to sign in to

curl --request POST \
  --url https://abhasbx.abdm.gov.in/abha/api/v3/profile/login/verify/user \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'REQUEST-ID: <REQUEST_ID>' \
  --header 'TIMESTAMP: <TIMESTAMP>' \
  --header 'T-token: <T_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "ABHANumber": "<ABHA_NUMBER>",
  "txnId": "<TXN_ID>"
}'

{
  "token": "<TOKEN>",
  "expiresIn": 0,
  "refreshToken": "<REFRESH_TOKEN>",
  "refreshExpiresIn": 0
}

Generated from the schema. The values are placeholders, not a captured response.