PHR & ABHA Address

Verify OTP / Biometric for ABHA Address Login

Complete the ABHA Address login with OTP or biometric.

Mandatory

Certification cases VRFY_ABHA_102, VRFY_ABHA_202

POST/phr/web/login/abha/verify

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Headers

REQUEST-IDstringRequired

Unique UUID v4 per request. Used for idempotency and distributed tracing. Generate a fresh UUID for every call.

TIMESTAMPstringRequired

ISO 8601 UTC timestamp of the request.

Body

scopestring[]Required

authDataobjectRequired

authData.authMethodsstring[]Required

authData.otpobject

authData.bioobject

authData.bio.txnIdstring

authData.bio.bioTypestring

One of FMR

authData.bio.pidstring

authData.faceobject

authData.face.txnIdstring

authData.face.pidstring

authData.irisobject

authData.iris.txnIdstring

authData.iris.pidstring

Responses

200

400

Bad Request, invalid scope, loginHint, or encrypted field

Error codes for this module

401

Unauthorized, missing, invalid, or expired Bearer token

Everything returns 401

403

Forbidden, the token is valid but not permitted for this operation

Error codes for this module

500

Server error, retry

Error codes for this module

Verify OTP / Biometric for ABHA Address Login

curl --request POST \
  --url https://abhasbx.abdm.gov.in/abha/api/phr/web/login/abha/verify \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'REQUEST-ID: <REQUEST_ID>' \
  --header 'TIMESTAMP: <TIMESTAMP>' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": [
    "abha-address-login",
    "mobile-verify"
  ],
  "authData": {
    "authMethods": [
      "otp"
    ],
    "otp": {
      "txnId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "otpValue": "{{RSA_encrypted_otp}}"
    }
  }
}'

{
  "token": "<TOKEN>",
  "refreshToken": "<REFRESH_TOKEN>",
  "expiresIn": 0,
  "refreshExpiresIn": 0,
  "accounts": "<ACCOUNTS>"
}

Generated from the schema. The values are placeholders, not a captured response.