Two ways to call it
One check at a time. Call the endpoint for the identifier you hold - a CIN, a GSTIN, a PAN, a bank account, a driving licence, a mobile number, a passport file number - and read the answer. No check waits on another, so take the checks you need and leave the rest. Or one orchestrated call. Send what you hold about a business and every check comes back together, run at the same time, in a single answer. See the orchestrated flow. Both answer in the same envelope and both are versioned the same way, so moving between them is a change of endpoint and nothing else.What you can verify
Each carries its request, its response and the reasons it can answer with in the API reference.
DigiLocker
DigiLocker is a flow of two steps: create a consent link, send the person to it, and once they have consented, read their documents with therequest_id the link came with.
Each returns
details alone: what it read, as DigiLocker holds it, with no reasons.
EPFO passbook
The EPFO passbook is read in three steps, the last two with therequest_id the first answered with:
send an OTP to the mobile number on the member’s EPF account, submit the OTP the member received, and
read their passbook.
Sending the OTP answers in the envelope every check shares. It answers
uan-not-registered-for-mobile
when the EPFO holds no account under the mobile number, and then no OTP is sent. Submitting the OTP and
reading the passbook return details alone, with no reasons. Only you can submit an OTP for, or read a passbook through, a request you sent.
Quickstart
Conventions
One envelope for every check. Every check answers with thereasons behind a refusal and the
details the source held. An empty reasons means the check passed, so reasons carries the verdict
rather than the status code: a call the source answered returns 200 whatever it concluded, including
when the answer is “no such registration”.
Per-endpoint versioning. The version sits in the path, such as /gst/v1/gst-info.1. A new version
of one endpoint does not move another. See versioning.
The source is named in the path. The number a path ends in is the source that answers that
check, and it ends the permission your key carries for it too. Where two sources answer the same
check, each is its own endpoint and both answer in the same shape, so moving between them is a
change of that last part and nothing else.
Returned names are not compared. Where a source returns a name, it is returned as the source
spelled it, and no check compares it against an expected name. PAN verification compares details you
send instead: on its own or in the orchestrated call, it answers whether the name and date of birth
you claim are the ones the income-tax registry holds. Driving licence verification answers the same
for the date of birth, and the issue date where you send one. Passport verification answers the same
for the name you claim, against the one the passport registry holds.
Identifiers are read in any case. A GSTIN, PAN, CIN, IFSC or other registry identifier is matched
once surrounding spaces are dropped and its letters capitalised, so abcpe1234f is read as
ABCPE1234F. The pattern each field shows is that capitalised form, and it is the form a response
carries the identifier back in.