Aadhaar Verification API: Real-Time OTP eKYC, Offline XML & Masking Infrastructure
Enterprise real-time Aadhaar verification API for Indian fintechs, NBFCs, and digital lenders. Supports UIDAI 2.5 OTP eKYC, Offline XML, automated 8-digit masking, and DPDP 2023 compliant ephemeral routing.
1. Deep Technical & Regulatory Analysis
The choice between UIDAI Authentication (OTP) vs Offline Verification (OKYC) is a central architectural decision for fintechs. While OTP eKYC offers real-time friction-free flows, Offline XML (OKYC) is highly robust against UIDAI SMS delivery delays.
Under Section 6 & 8 DPDP Act 2023, explicit consent must be obtained, and plain-text Aadhaar numbers must never touch disk. To comply with these stringent requirements, ASP Associates processes all payloads via ephemeral in-memory processing.
The "Aadhaar Vault" dilemma: By strictly utilizing ephemeral streaming that avoids writing any unmasked Aadhaar data to a persistent database, the multi-lakh annual cost of Aadhaar Vault certification for lenders is structurally bypassed.
2. Failure Modes & Multi-KUA Routing Architecture
UIDAI gateway latencies and downtimes can cripple onboarding flows. ASP Associates resolves this using a Multi-KUA intelligent failover routing system.
| Architecture Type | Failover Speed | Impact on Onboarding SLA |
|---|---|---|
| Single-KUA Aggregators | None (Hard Fail) | Complete drop-off when upstream KUA goes offline. |
| ASP Multi-KUA Routing | < 35ms | Zero disruption; secondary nodes immediately absorb traffic. |
Standardized REST Response
Canonical JSON response payload returning demographic info and base64 photo with 8-digit masked Aadhaar.
// Sample Request POST https://www.aspassociates.in/api/v1/verify/aadhaar/generate-otp Authorization: Bearer <YOUR_API_KEY> Content-Type: application/json { "aadhaar_number": "123456789012", "consent": true } // Sample Response { "outcome": "SUCCESS", "request_id": "req_aadhaar_8f2a4b6c", "message": "OTP sent successfully." }
// Sample Request POST https://www.aspassociates.in/api/v1/verify/aadhaar/submit-otp Authorization: Bearer <YOUR_API_KEY> Content-Type: application/json { "request_id": "req_aadhaar_8f2a4b6c", "otp": "123456", "dpdp_consent_hash": "a3f9e...b2c" } // Sample Response { "outcome": "SUCCESS", "data": { "aadhaar_number": "XXXXXXXX9012", "name": "Rahul Kumar", "dob": "1990-01-01", "gender": "M", "split_address": { "house": "123", "street": "MG Road", "pincode": "110001" }, "photo_base64": "/9j/4AAQSk..." }, "consent_verified": true, "tat_ms": 450 }
Test This In Our Live API Playground
Simulate realistic Aadhaar responses, test OTP and Offline XML flows, examine latency percentiles, and export cURL, Python, and Node.js code snippets in real-time.
Aadhaar Verification Questions
What are the UIDAI Sub-AUA / KUA licensing requirements for fintechs?
Fintechs can utilize ASP Associates' multi-KUA routing infrastructure without becoming a direct AUA/KUA themselves, provided they collect explicit consent and comply with Sub-AUA terms as laid out by UIDAI for regulated entities.
Is 8-digit masking mandatory under UIDAI circulars & Section 6 of DPDP Act 2023?
Yes. Our API automatically masks the first 8 digits of the Aadhaar number in responses (e.g., XXXXXXXX1234) to comply with both UIDAI data localization circulars and Section 6 of the DPDP Act 2023.
How should we choose between OTP and Offline XML (OKYC) selection criteria and what are the failure modes?
OTP eKYC is seamless for low-friction digital journeys, but relies on UIDAI SMS gateway uptime. Offline XML provides higher fault tolerance as it avoids live OTP dependencies and works through downloadable XML ZIP packages. We support both with intelligent fallback.
What is ephemeral in-memory processing and why don't clients need to maintain an Aadhaar Vault?
Our API processes Aadhaar requests ephemerally in-memory. Because the plain-text Aadhaar numbers never touch disk storage, the client system is not classified as storing Aadhaar data, eliminating the need for expensive Aadhaar Vault certification.
What is the target SLA and how does multi-KUA intelligent failover routing work?
The platform provides a 99.9% target SLA by orchestrating requests across multiple authenticated KUA gateways. If one KUA node drops traffic or faces UIDAI CIDR latency, requests are automatically routed to a healthy secondary node in under 35ms.