HPR, the professional registry
HPR is the Healthcare Professionals Registry, the people half of NHPR alongside the HFR. Registering there issues the professional an HPID, their identity everywhere in ABDM.
Who can enrol
Three categories today, with more to be added later: doctor, nurse and pharmacist. Each professional also declares a system of medicine, from modern medicine, dentistry, Ayurveda, Unani, Siddha, Homoeopathy, Sowa-Rigpa, and yoga and naturopathy. A person can also enrol as a facility manager instead of a clinician, set by the role code:
| Role code | What the person is |
|---|---|
| 1 | Healthcare Professional |
| 2 | Facility Manager |
| 3 | Healthcare Professional and Facility Manager |
If nobody in your organisation holds role 2 or role 3, you cannot register a facility. See HFR.
The HPID
A unique 14 digit, Aadhaar authenticated identifier issued on successful registration to a healthcare professional or facility manager. It is written both ways, HPID and HPR ID. Like an ABHA, it comes in two forms:
| Form | Sample | Where it is used |
|---|---|---|
| The number | 71-2665-5777-XXXX | Sent as hpId or hprIdNumber |
| The address | name@hpr.abdm | Sent as hprId, with domainName of @hpr.abdm |
The professional chooses the readable part through a username suggestion call, the same pattern as the ABHA address suggestion in M1.
What identifies a doctor
An HPID on its own is an authenticated person; the profile behind it makes them a doctor. The register professional call groups it in five blocks:
| Block | What it holds |
|---|---|
| Personal information | Salutation and name, date of birth, gender, nationality, languages spoken, profile photo, official mobile and email |
| Communication address | Country, state, district, sub district, city and pincode, all as master data codes. Skipped if the address matches the KYC address |
| Registration | The council the professional is registered with, the registration number, the registration certificate, and whether the registration is permanent or renewable |
| Qualification | Degree or diploma obtained, college, university, year of award, and the degree certificate |
| Current work | Whether they are working, the purpose of that work, whether it is private, government or both, and the facility they work at |
Three codes decide what the professional may be. Category says doctor, nurse or pharmacist. Subcategory fixes the system of medicine. The degree code must agree with both. The tables for all three are on the HPR and HFR call list.
Subcategory codes differ between the create HPID and register professional tables. Fetch the codes from the HPRID subcategories master call rather than hard coding either table.
The SMD ID identifies doctors only. Searching for nurse colleges by SMD returns a null college and university name, and this is expected: for nurses, SMD is always null.
The registration journey
Two halves, in order. Nothing in the second works until the first produces a token.
Half one, create the HPID. Nine calls follow the gateway session token, in this order:
- Generate Aadhaar link
- Check Aadhaar authentication status
- Verify OTP and fetch user details
- Check whether an HPID already exists for this Aadhaar
- Mobile match
- Generate mobile OTP
- Verify mobile OTP
- Username suggestions
- Create HPID
The last returns the HPID and an hprToken, which the next call needs.
Half two, register the professional. Register professional writes the full profile, and it is the one HPR write call with a published path: POST https://apihspsbx.abdm.gov.in/v4/int/apis/v1/doctors/register-professional-new. Then retrieve professional document list, upload documents, update professional and fetch professional details.
Three things to know first:
- The Aadhaar link URL is valid for 5 minutes only. Call the API again once it expires.
degreeCertificateandregistrationCertificateare mandatory uploads, andproofOfWorkCertificateis mandatory when the professional is government or both.- Call
demographicAuthViaMobilefirst, and generate the mobile OTP only when it returns false.
Call by call, with the parameters, is on M4 user journey and the HPR and HFR call list.
Getting an HPR token later
The hprToken from creation does not last. Three ways to get a fresh one, all still carrying the gateway access token in the Authorization header, because the HPR token proves who the professional is, not that your client may call.
| Route | Path |
|---|---|
| By password | /v4/int/api/v1/auth/authPassword |
| By mobile OTP, send | /v4/int/api/v2/auth/loginViaMobileSendOTP |
| By mobile OTP, log in | /v4/int/api/v2/auth/login/userAuthorizedToken |
| By Aadhaar OTP, send | /v4/int/api/v1/auth/init |
| By Aadhaar OTP, verify | /v4/int/api/v1/auth/confirmWithAadhaarOtp |
The bodies are on M4 operations and fields. The mobile verify path is not yet published.
What your system has to hold
Per professional, store:
- The HPID, in both forms.
- The current HPR token, its expiry, and a way to refresh it without re-registering the person.
- The transaction id, for one flow only.
- The master data ids you sent for council, course, college, university, language, country, state and district. The registry rejects display values.
- The certificates you uploaded, with each document slot identifier.
Once, for the whole integration: client id and client secret for the gateway session call, and the public certificate from v4/int/api/v1/auth/cert. Three fields are encrypted with it, cipher RSA/ECB/PKCS1Padding: the mobile number in mobile match, the OTP in mobile login, and the email and password in create HPID. That cipher and that certificate belong to the NHPR. M1 encrypts with RSA-OAEP and SHA-1 under the ABHA certificate, so the two paths are not interchangeable.
Upload limits: 1 MB for a profile photo, 5 MB for anything else, png, jpeg, jpg or PDF only. Attachments go as a fileType and a base64 data string.
Request and response formats
This page gives the behaviour, the call order, the parameter tables and the code lists. Take the request and response shapes from the healthcare professional registry sandbox documentation alongside it.
Seven of the 17 master data calls have their path published here: see the HPR and HFR call list.
Next
- HFR, the facility half, which needs a token from this registry.
- NHPR, the parent page.
- M4 user journey, the same order as diagrams.
- the HPR and HFR call list, the parameter tables and the error codes.