POSTAePS Cash Withdrawal

Withdraw cash from any Aadhaar-linked bank account using biometric fingerprint authentication — no card or PIN required.

POST/customer/collection/aeps-fingpay/cash-withdrawal/{customer_id}

Lets a customer withdraw cash from any Aadhaar-linked bank account using a live fingerprint scan — no card or PIN. Pass service_type = 2. The agent's biometric device produces a PID XML blob that is forwarded verbatim, and the customer's Aadhaar number is RSA-encrypted before transmission.

Prerequisites

The agent must have completed, in order:

AePS Fingpay activation
One-time eKYC (Send OTP → Verify OTP → Biometric eKYC)
Daily 2FA for the current day — this returns a reference_id that must be sent with every cash-withdrawal request.

Important

Due to NPCI compliance, every cash-withdrawal needs 2FA. Omitting the daily reference_id will reject the transaction.

Aadhaar encryption

Encrypt the Aadhaar number before sending it (the same scheme used by all AePS transaction APIs):

Base64-decode the public key.
RSA-encrypt the Aadhaar number with the decoded key.
Base64-encode the result and send that as the aadhar parameter.

Production public key:

text

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaFyrzeDhMaFLx+LZUNOOO14Pj9aPfr+1WOanDgDHxo9NekENYcWUftM9Y17ul2pXr3bqw0GCh4uxNoTQ5cTH4buI42LI8ibMaf7Kppq9MzdzI9/7pOffgdSn+P8J64CJAk3VrVswVgfy8lABt7fL8R6XReI9x8ewwKHhCRTwBgQIDAQAB

Biometric (PID) capture

The PidData XML from the RD-service device must use:

Data type="X" (XML), base64-encoded
a DeviceInfo mc value carrying the device public-key certificate signed by the Device Provider Key
fingerprint quality of at least 35 nmPoints

Warning

Per NPCI's FIR-FMR single-PID-block guidance, capture fingerprints with fType = 2 (not 0). A subset of banks that have not yet completed FMR+FIR compliance still require fType = 0 — check the current bank list before going live.

Path parameters

Field	Type	Required	Description
`customer_id`	string	required	Customer's registered mobile number.e.g. 9876543210

customer_idstringRequired

Customer's registered mobile number.

example: 9876543210

Body parameters

Field	Type	Required	Description
`initiator_id`	string	required	Registered mobile number of the API user (see Platform Credentials).e.g. 9962981729
`client_ref_id`	string	optional	Unique reference id per API call, generated by your system.e.g. REQ-20260101-001
`user_code`	string	required	Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your userse.g. 20810200
`bank_code`	string	required	Bank IIN/IFS code identifying the customer's bank. Obtain from the bank list API.e.g. 607153
`amount`	number	required	Withdrawal amount in Indian Rupees (integer). Must be greater than 0 for cash withdrawal.e.g. 1000
`aadhaar`	string	required	RSA-encrypted, Base64-encoded Aadhaar number. Encrypt the 12-digit Aadhaar using the Eko RSA public key with OPENSSL_SSLV23_PADDING, then Base64-encode the ciphertext.e.g. BASE64_ENCRYPTED_AADHAAR
`piddata`	string	required	PID data captured from the UIDAI-certified biometric device, as a raw XML string. Must use Data type='X' (XML, not Protobuf). DeviceInfo must include the 'mc' (device certificate) parameter. fType must be 2.e.g. <?xml version='1.0'?><PidData><Data type='X'>...</Data><DeviceInfo mc='...' /></PidData>
`pipe`	number	required	Routing pipe selector. Use 0 (default).e.g. 0
`notify_customer`	number	required	Send SMS notification to the customer. 1 = yes, 0 = no.e.g. 1
`latlong`	string	required	GPS coordinates of the transaction origin in 'latitude,longitude' format.e.g. 28.6139,77.2090
`source_ip`	string	required	IP address of the merchant/agent system initiating the transaction.e.g. 103.56.78.90
`reference_id`	string	required	2FA reference ID obtained from the Daily Authentication (daily eKYC) API. Required for every Cash Withdrawal transaction due to compliance 2FA mandate.e.g. DAKYC20240101001

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference id per API call, generated by your system.

example: REQ-20260101-001

user_codestringRequired

Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your users

example: 20810200

bank_codestringRequired

Bank IIN/IFS code identifying the customer's bank. Obtain from the bank list API.

example: 607153

amountnumberRequired

Withdrawal amount in Indian Rupees (integer). Must be greater than 0 for cash withdrawal.

example: 1000

aadhaarstringRequired

RSA-encrypted, Base64-encoded Aadhaar number. Encrypt the 12-digit Aadhaar using the Eko RSA public key with OPENSSL_SSLV23_PADDING, then Base64-encode the ciphertext.

example: BASE64_ENCRYPTED_AADHAAR

piddatastringRequired

PID data captured from the UIDAI-certified biometric device, as a raw XML string. Must use Data type='X' (XML, not Protobuf). DeviceInfo must include the 'mc' (device certificate) parameter. fType must be 2.

example: <?xml version='1.0'?><PidData><Data type='X'>...</Data><DeviceInfo mc='...' /></PidData>

pipenumberRequired

Routing pipe selector. Use 0 (default).

example: 0

notify_customernumberRequired

Send SMS notification to the customer. 1 = yes, 0 = no.

example: 1

latlongstringRequired

GPS coordinates of the transaction origin in 'latitude,longitude' format.

example: 28.6139,77.2090

source_ipstringRequired

IP address of the merchant/agent system initiating the transaction.

example: 103.56.78.90

reference_idstringRequired

2FA reference ID obtained from the Daily Authentication (daily eKYC) API. Required for every Cash Withdrawal transaction due to compliance 2FA mandate.

example: DAKYC20240101001

Headers

Field	Type	Required	Description
`developer_key`	string	required	Static API key issued to your account after KYC.
`secret-key`	string	required	Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).
`secret-key-timestamp`	string	required	Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.
`content-type`	string	required	application/jsone.g. application/json

developer_keystringRequired

Static API key issued to your account after KYC.

secret-keystringRequired

Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).

secret-key-timestampstringRequired

Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.

content-typestringRequired

application/json

example: application/json

Responses

statusnumber
Primary success indicator (0 = success).
messagestring
Human-readable response / error message.
response_status_idnumber
Granular status id; see the shared error-codes table.
response_type_idnumber
A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.
tx_statusstring
Transaction state: 0=Success, 1=Fail, 2=Awaited, 3=Refund Pending, 4=Refunded, 5=On Hold.
txstatus_descstring
Human-readable transaction status.
dataobject
API-specific response payload.
- tidstring
  Eko's internal transaction ID. Use for reconciliation and support queries.
- amountnumber
  Withdrawal amount processed in the transaction (INR).
- bank_namestring
  Name of the customer's bank where the debit occurred.
- bank_ref_numstring
  Bank/NPCI reference number for the transaction.
- balancestring
  Remaining balance in the customer's bank account after withdrawal, if returned by the bank.
- aadhaar_ref_numstring
  Aadhaar authentication reference number from UIDAI.
- service_typenumber
  Echo of the service_type from the request (2 for Cash Withdrawal).

Next steps

NextPOSTAePS Balance EnquiryCheck a customer's bank account balance using Aadhaar number and biometric fingerprint — no card or PIN required.