v21

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-042830148.8 KB

KYC

Start DigiLocker session

Start a DigiLocker session to fetch the investor's government-issued documents (Aadhaar, PAN, etc.) with their consent.

How it works:

Call this endpoint — you get back an authorization_url and a session_id. The session_id is the single identifier you use for everything else.
Redirect the investor to authorization_url to log in to DigiLocker and grant consent.
After consent, the investor is redirected back to your redirect_url with query parameters appended (see the table below).
Use the session_id (path parameter) on the POST /v1/kyc/digilocker/result/{session_id} endpoint to read the consented data — identity, documents, and parsed document content.

Redirect parameters appended to your redirect_url:

Outcome	Appended query parameters
Consent granted	?success=true&id={session_id}&state={state}&documents=pan+driving_licence&has_verified_data=1
Partial consent (e.g. PAN only)	?success=true&id={session_id}&state={state}&documents=pan
Consent denied / failed	?success=false&id={session_id}&state={state}&error={error}

documents lists the documents the investor agreed to share; has_verified_data=1 appears only when verified identity is available.

Credits: Free. Billing happens when documents/identity are returned.

post/v1/kyc/digilocker/session

Request body

consentboolean required

Explicit end-user consent. Must be true to proceed (regulatory requirement under DPDP / RBI). Captured for audit.

consent_purposestring required

Specific purpose for which consent is taken (min 20 chars). Stored in the session and returned as a consent receipt.

documentsstring[]

Identities to verify and return in the response.

prefill_mobilestring

Pre-verified mobile to skip the signup OTP step (only applies with user_flow=signup).

redirect_urlstring uri required

Where to redirect the user after consent. Must be a valid http/https URL.

statestring

Opaque value echoed back to your redirect_url unchanged.

user_flow'signin' | 'signup'

Use "signin" for users with an existing DigiLocker account, "signup" for account-on-the-fly.

Example request

{
  "consent": true,
  "consent_purpose": "KYC for loan account opening",
  "documents": [
    "aadhaar",
    "pan"
  ],
  "prefill_mobile": "9999999999",
  "redirect_url": "https://yourapp.com/digilocker/callback",
  "state": "investor_42",
  "user_flow": "signin"
}

Response

Session started; redirect the user to authorization_url

authorization_urlstring

DigiLocker consent URL to redirect the investor to.

expires_ininteger

Seconds the authorization_url is valid for.

session_idstring

The single identifier for this verification. Use it as the path parameter in POST /v1/kyc/digilocker/result/{session_id} to retrieve identity + documents.

statusstring

Example response

{
  "expires_in": 600,
  "session_id": "3f9a2c1e8b7d4e6fa1c2d3e4f5a6b7c8",
  "status": "success"
}