Aadhaar Verification API: Real-Time OTP eKYC, Offline XML & Masking Infrastructure
Enterprise real-time Aadhaar verification API for Indian fintechs, NBFCs, and digital lenders. Supports UIDAI 2.5 OTP eKYC, Offline XML, automated 8-digit masking, and DPDP 2023 compliant ephemeral routing.
1. UIDAI Authentication Modalities: Latency & Failure Mode Benchmarks
Architecting an Aadhaar verification flow requires matching the correct UIDAI modality to your user onboarding funnel. Indian fintechs and NBFCs frequently suffer drop-offs by relying exclusively on OTP SMS delivery during peak telecommunication congestion. ASP Associates provides a multi-modal gateway supporting active fallback across all four primary UIDAI modalities:
| Modality | User Journey | p95 Latency | Avg Success | Regulatory Suitability |
|---|---|---|---|---|
| UIDAI 2.5 OTP eKYC | User enters Aadhaar, receives 6-digit OTP on UIDAI-registered mobile. | 480ms ā 680ms | 98.6% | Full KYC for digital personal loans, credit cards, demat & bank accounts. |
| Offline XML (OKYC) | User uploads digitally signed UIDAI XML package with 4-digit share code. | < 380ms | 99.8% | Zero SMS dependency; ideal during telecom outages or rural connectivity drops. |
| Face RD (Registered Device) | Front camera selfie matched against UIDAI central biometric database with 3D liveness. | 850ms ā 1,200ms | 96.4% | Assisted doorstep onboarding, field collection agents, senior citizen verifications. |
| Demographic Verification | Exact or fuzzy match of Name, DOB, and Gender against central registry records. | < 240ms | 99.4% | Low-ticket micro-disbursements, gig contractor verification, insurance claims. |
2. Statutory Masking & Section 16 RBI KYC Master Direction Architecture
Under Section 16 of the Reserve Bank of India (RBI) Master Direction ā Know Your Customer (KYC) Direction, 2016 (updated 2024), non-banking entities, NBFCs, and payment aggregators are strictly prohibited from retaining plain-text 12-digit Aadhaar numbers in persistent databases or file stores. The law mandates automated redaction of the first 8 digits (e.g., XXXXXXXX1234) prior to document archival.
The Ephemeral Zero-Storage Advantage: Traditional aggregator integrations transmit plain-text Aadhaar payloads and store raw transaction logs, which legally subjects the fintech to mandatory UIDAI Aadhaar Vault Certification (costing ā¹5Lāā¹15L annually in hardware security modules and compliance audits). ASP Associates operates an ephemeral, in-memory processing pipeline: payloads are decrypted in volatile RAM, authenticated against UIDAI, stamped with an immutable cryptographic receipt, redacted to 8-digit masked format, and purged from memory in under 50 milliseconds.
Cross-Service Chaining: Identity stacks routinely combine Aadhaar verification with our PAN Verification API to establish Section 139AA Income Tax linkage, our Penny Drop Bank Account API to confirm beneficiary name match against the Aadhaar demographic record, and our Driving License Verification API for transport gig onboarding.
3. The Verhoeff Checksum Algorithm & UIDAI Numbering Rules
Every 12-digit Aadhaar number is mathematically structured. The 12th digit is a checksum generated via the Verhoeff algorithm (based on the dihedral group \(D_5\) of order 10). Unlike simple Luhn (MOD 10) checks used on credit cards, the Verhoeff algorithm detects 100% of all single-digit typographical errors and 95.3% of adjacent transposition errors.
- No Leading '0' or '1': Per UIDAI numbering specifications, valid Aadhaar numbers strictly start with digits
2through9. Any number beginning with 0 or 1 is syntactically invalid. - Dihedral Group \(D_5\) Permutations: The check digit uses non-commutative multiplication tables and permutation matrices (\(p_0\) through \(p_7\)) to resist digit inversions.
- Client-Side Zero-PII Pre-validation: Verifying the Verhoeff checksum locally eliminates wasteful network roundtrips to UIDAI for mistyped numbers.
ā” Interactive Aadhaar Verhoeff Checksum & Masking Validator
Test any 12-digit Aadhaar number syntax, verify the mathematical Verhoeff checksum, and inspect the RBI-compliant 8-digit masked output (100% Client-Side Browser Math, Zero Network Calls, Zero PII).
4. Failure Modes & Multi-KUA Routing Architecture
UIDAI gateway latencies and downtimes can cripple onboarding funnels. ASP Associates resolves this using a Multi-KUA intelligent failover routing system.
| Architecture Type | Failover Speed | Impact on Onboarding SLA |
|---|---|---|
| Single-KUA Aggregators | None (Hard Fail) | Complete drop-off when upstream KUA goes offline. |
| ASP Multi-KUA Routing | < 35ms | Zero disruption; secondary nodes immediately absorb traffic. |
Production Integration Snippets
Canonical 2-step OTP eKYC request and response payloads with automated 8-digit masking.
# Step 1: Request OTP curl -X POST https://www.aspassociates.in/api/v1/verify/aadhaar/generate-otp \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "aadhaar_number": "367598346016", "consent": true }' # Step 2: Submit OTP curl -X POST https://www.aspassociates.in/api/v1/verify/aadhaar/submit-otp \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "request_id": "req_aadhaar_8f2a4b6c", "otp": "123456", "dpdp_consent_hash": "a3f9e712c98d4bf2" }'
import requests API_KEY = "YOUR_API_KEY" BASE_URL = "https://www.aspassociates.in/api/v1/verify/aadhaar" HEADERS = { "Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json" } # 1. Trigger OTP otp_res = requests.post(f"{BASE_URL}/generate-otp", json={ "aadhaar_number": "367598346016", "consent": True }, headers=HEADERS).json() req_id = otp_res["request_id"] # 2. Submit user OTP auth_res = requests.post(f"{BASE_URL}/submit-otp", json={ "request_id": req_id, "otp": "123456", "dpdp_consent_hash": "a3f9e712c98d4bf2" }, headers=HEADERS).json() data = auth_res["data"] print(f"Masked Aadhaar: {data['aadhaar_number']} | Name: {data['name']}")
const axios = require('axios'); const client = axios.create({ baseURL: 'https://www.aspassociates.in/api/v1/verify/aadhaar', headers: { 'Authorization': 'Bearer YOUR_API_KEY', 'Content-Type': 'application/json' } }); async function verifyAadhaar() { // Step 1: Generate OTP const otpRes = await client.post('/generate-otp', { aadhaar_number: '367598346016', consent: true }); // Step 2: Submit OTP const verifyRes = await client.post('/submit-otp', { request_id: otpRes.data.request_id, otp: '123456', dpdp_consent_hash: 'a3f9e712c98d4bf2' }); console.log('Verified Identity:', verifyRes.data.data.name, verifyRes.data.data.aadhaar_number); } verifyAadhaar();
{
"request_id": "req_aadhaar_8f2a4b6c",
"otp": "123456",
"dpdp_consent_hash": "a3f9e712c98d4bf2"
}
{
"outcome": "SUCCESS",
"request_id": "req_aadhaar_8f2a4b6c",
"data": {
"aadhaar_number": "XXXXXXXX6016",
"name": "RAHUL SHARMA",
"dob": "1992-06-15",
"gender": "M",
"split_address": {
"house": "Flat 402, Lotus Tower",
"street": "Outer Ring Road",
"district": "Bengaluru Urban",
"state": "Karnataka",
"pincode": "560103"
},
"photo_base64": "/9j/4AAQSkZJRgABAQEASABIAAD..."
},
"consent_verified": true,
"masked": true,
"tat_ms": 482
}
Test This In Our Live API Playground
Simulate realistic Aadhaar responses, test OTP and Offline XML flows, examine latency percentiles, and export cURL, Python, and Node.js code snippets in real-time.
Aadhaar Verification Questions
What are the UIDAI Sub-AUA / KUA licensing requirements for fintechs?
Fintechs can utilize ASP Associates' multi-KUA routing infrastructure without becoming a direct AUA/KUA themselves, provided they collect explicit consent and comply with Sub-AUA terms as laid out by UIDAI for regulated entities.
Is 8-digit masking mandatory under UIDAI circulars & Section 6 of DPDP Act 2023?
Yes. Our API automatically masks the first 8 digits of the Aadhaar number in responses (e.g., XXXXXXXX1234) to comply with both UIDAI data localization circulars and Section 6 of the DPDP Act 2023.
How should we choose between OTP and Offline XML (OKYC) selection criteria and what are the failure modes?
OTP eKYC is seamless for low-friction digital journeys, but relies on UIDAI SMS gateway uptime. Offline XML provides higher fault tolerance as it avoids live OTP dependencies and works through downloadable XML ZIP packages. We support both with intelligent fallback.
What is ephemeral in-memory processing and why don't clients need to maintain an Aadhaar Vault?
Our API processes Aadhaar requests ephemerally in-memory. Because the plain-text Aadhaar numbers never touch disk storage, the client system is not classified as storing Aadhaar data, eliminating the need for expensive Aadhaar Vault certification.
What is the target SLA and how does multi-KUA intelligent failover routing work?
The platform provides a 99.9% target SLA by orchestrating requests across multiple authenticated KUA gateways. If one KUA node drops traffic or faces UIDAI CIDR latency, requests are automatically routed to a healthy secondary node in under 35ms.