Skip to main content
Each endpoint makes one synchronous call to a source and returns what the source answered, with no scoring or interpretation applied to it. DigiLocker is the exception: it requires a consent redirect before documents can be read.

​
What you can verify

DigiLocker

Government-issued documents, retrieved after the user grants consent.

PAN

PAN validity, with an optional check of the name and date of birth claimed for it.

Bank accounts

Account existence and the name the bank holds against it.

Usage

Calls made, credits consumed, and credits remaining.

​
Quickstart

​
Conventions

Response envelope. Every response carries code, repeating the HTTP status; timestamp, when the response was produced, in Unix milliseconds; transaction_id, identifying the call; and data, holding the result. Quote transaction_id when raising a query about a call. Per-endpoint versioning. The version sits in the path, such as /pan/v1/verify. A new version of one endpoint does not move another. See versioning. Name matching is the caller’s. Where a source returns a name, such as name_at_bank, it is returned as the source spelled it. Comparing it against an expected name, at a threshold you choose, is your responsibility.

​
Data retention

Request and response payloads are not stored. Documents are returned as the issuer’s own download links, and the response is the only copy. Each call is recorded as metadata: the endpoint, the time, whether it succeeded, and whether it was charged. That record is what usage reports and what invoices are built from. It holds nothing about the person or account the call was about.