---
title: "Confirmation request sending token, otp or other authentication details from HIP/HIU for confirmation"
method: POST
path: "/v0.5/users/auth/confirm"
tags: ["user auth", "hip facing", "hiu facing"]
---

# Confirmation request sending token, otp or other authentication details from HIP/HIU for confirmation

`POST /v0.5/users/auth/confirm`

This API is called by HIP/HIUs to confirm authentication of users. The transactionId returned by the previous callback API /users/auth/on-init must be sent. If Authentication is successful the callback API will send an "access token" for subsequent purpose specific API calls. Note only **credential.authCode** or **credential.demographic** should be sent
  1. demographic details are only required for  demographic auth as of now. 
  2. demographic details are required only in MEDIATED cases and if the **auth.mode** so demands. e.g. if **auth.mode** is DEMOGRAPHICS. Usually for demographic authentication, the name, gender and DOB must be exactly as specified in User Account.
  3. demographic.identifier is optional, however maybe required if authentication so mandates. 
  4. credential.authCode is required for other MEDIATED authentication like MOBILE_OTP, AADHAAR_OTP.

## Headers

- `Authorization` string, required
- `X-CM-ID` string, required

## Request body

- PatientAuthConfirmRequest
  - `credential` object, required — note, demographic details are only required for demographic auth at this point.
    - `authCode` string
    - `demographic` PatientDemographic — Demographic details are only required for demographic auth at this point. Demographic details must be same as registered
      - `dateOfBirth` string, required — date of birth in YYYY-MM-DD format.
      - `gender` 'M' | 'F' | 'O' | 'U', required
      - `identifier` AuthConfirmIdentifier
        - `type` 'MOBILE', required
        - `value` string, required
      - `name` string, required
  - `requestId` string, uuid, required — a nonce, unique for each HTTP request
  - `timestamp` string, date-time, required — Date time format in UTC, includes miliseconds YYYY-MM-DDThh:mm:ss.vZ
  - `transactionId` string, required

## Response `202`

Request accepted

## Other responses

- `400` — **Causes:** * transaction id is not provided or invalid * token or other auth confirmation details not provided or invalid
- `401` — **Causes:** * Unauthorized request
- `500` — **Causes:** * Downstream system(s) is down. * Unhandled exceptions.

---

[API](https://skmtc.net/ndhm/apis/ndhm-gateway.md) · [All operations](https://skmtc.net/ndhm/apis/ndhm-gateway/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ndhm/ndhm-gateway/versions/a440e2981b29/schema)