PUTBiometric eKYC

Complete one-time AePS Fingpay eKYC by submitting the agent's Aadhaar and live biometric fingerprint capture.

PUT/user/collection/aeps-fingpay/kyc/biometric

The final step in the one-time AePS Fingpay eKYC flow, called after OTP verification. Submits the agent's Aadhaar and live biometric PID data to UIDAI for identity verification. On success the agent's eKYC is marked complete and they can start performing AePS transactions (subject to completing daily 2FA each day).

Warning

Encrypt the Aadhaar number before passing it in the aadhar parameter — never send it as plain text. Encrypt it with Fingpay's RSA public key using PKCS#1 v1.5 padding, then Base64-encode the result. The same encrypted Aadhaar + PID XML format is used by all AePS transaction APIs.

The Aadhaar Encryption (Fingpay AePS) guide explains how to get the RSA public key, with step-by-step instructions and code samples in Node.js, Python, PHP, Java and C#.

E-KYC steps

For Fingpay AePS, it is mandatory to use e-KYC OTP request, e-KYC OTP verification and biometric before any AePS transaction. Make sure you complete these APIs in order:

Step	API	Purpose
1	Send OTP (eKYC)	OTP to the agent's Aadhaar-linked mobile
2	Verify OTP (eKYC)	Validate the OTP and start the eKYC session
3	Biometric eKYC	Submit Aadhaar + live fingerprint PID (this API)

Note

eKYC is a one-time setup per agent. It is distinct from the daily authentication (2FA) required once per calendar day before transacting.

Fingerprint capture (`fType`)

Note

New to RDService? The Aadhaar Biometric Authentication guide covers the full capture flow — driver discovery, PidOptions, error codes — for Web and Android, and includes an in-browser device tester.

Warning

Per NPCI's FIR-FMR single-PID-block guidance, capture fingerprints with fType = 2 (not 0). A subset of banks that have not yet completed FMR+FIR compliance still require fType = 0 — check the current bank list before going live. The same PID format applies to all AePS transaction APIs.

PID `wadh` value

Warning

If you generate the PID block with your own code (rather than taking the RD service default), you must set this wadh alongside the other attributes such as fCount and fType:

text

wadh=E0jzJ/P8UopUHAieZn8CKqS4WPMi5ZSYXgfnlfkWjrc=

A missing or wrong wadh surfaces later as Daily KYC failing with "Authentication Failed. Invalid Biometric data."

Tip

This endpoint is one step in a complete workflow:

AePS (Fingpay) — Cash Withdrawal — Aadhaar-enabled cash withdrawal: one-time agent activation and eKYC, daily KYC, a transaction OTP for amounts above ₹5,000, then the biometric withdrawal.

Request

Body parameters

Field	Type	Required	Description
`initiator_id`	string	required	Registered mobile number of the API user (see Platform Credentials).e.g. 9962981729
`client_ref_id`	string	optional	Unique reference ID per API call, generated by your system (10–20 characters; 10 recommended). The SDKs generate one for every non-GET call when you don't.e.g. 2026010100123456789
`user_code`	string	required	Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your userse.g. 20810200
`aadhar`	string	required	RSA-encrypted (PKCS#1 v1.5), Base64-encoded Aadhaar number of the agent. See the Aadhaar Encryption (Fingpay AePS) guide for the key and code samples.e.g. BASE64_ENCRYPTED_AADHAAR
`customer_id`	string	required	Registered mobile number of the agent/merchant undergoing eKYC.e.g. 9123456789
`latlong`	string	required	Agent's GPS coordinates as `latitude,longitude`. Required for security and fraud prevention.e.g. 28.6139,77.2090
`piddata`	string	required	PID XML string from the UIDAI-certified biometric device (fType=2, Data type='X', mc in DeviceInfo).e.g. <?xml version='1.0'?><PidData><Data type='X'>...</Data><DeviceInfo mc='...' /></PidData>
`bank_code`	string	required	Eko bank code of the agent's bank. Resolve it using the [Get List of Banks](./get-banks) API.e.g. HDFC
`otp_ref_id`	string	required	Reference ID returned by the preceding OTP step, linking this biometric capture to the verified OTP session.e.g. 2465238
`reference_tid`	string	required	Transaction reference ID returned by the preceding OTP step.e.g. EKYKF4719702240123152147525I

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference ID per API call, generated by your system (10–20 characters; 10 recommended). The SDKs generate one for every non-GET call when you don't.

example: 2026010100123456789

user_codestringRequired

Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your users

example: 20810200

aadharstringRequired

RSA-encrypted (PKCS#1 v1.5), Base64-encoded Aadhaar number of the agent. See the Aadhaar Encryption (Fingpay AePS) guide for the key and code samples.

example: BASE64_ENCRYPTED_AADHAAR

customer_idstringRequired

Registered mobile number of the agent/merchant undergoing eKYC.

example: 9123456789

latlongstringRequired

Agent's GPS coordinates as `latitude,longitude`. Required for security and fraud prevention.

example: 28.6139,77.2090

piddatastringRequired

PID XML string from the UIDAI-certified biometric device (fType=2, Data type='X', mc in DeviceInfo).

example: <?xml version='1.0'?><PidData><Data type='X'>...</Data><DeviceInfo mc='...' /></PidData>

bank_codestringRequired

Eko bank code of the agent's bank. Resolve it using the [Get List of Banks](./get-banks) API.

example: HDFC

otp_ref_idstringRequired

Reference ID returned by the preceding OTP step, linking this biometric capture to the verified OTP session.

example: 2465238

reference_tidstringRequired

Transaction reference ID returned by the preceding OTP step.

example: EKYKF4719702240123152147525I

These headers authenticate and sign every request. See How Auth Works for details.

Field	Type	Required	Description
`developer_key`	string	required	Static API key issued to your account after KYC.
`secret-key`	string	required	Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).
`secret-key-timestamp`	string	required	Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.
`content-type`	string	required	application/jsone.g. application/json

developer_keystringRequired

Static API key issued to your account after KYC.

secret-keystringRequired

Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).

secret-key-timestampstringRequired

Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.

content-typestringRequired

application/json

example: application/json

Response types

response_type_id	Meaning	Next step
`1605`	eKYC successful — agent may now complete Daily KYC	Daily KYC

Responses

1605eKYC successful — agent may now complete Daily KYCNext:Daily KYC

statusnumber
Primary success indicator (0 = success).
messagestring
Human-readable response / error message.
response_status_idnumber
UI display hint only (-1/0 success, 1 failure, 2 initiated, 3 refund initiated, 4 refunded). Never branch on it — use `status` (and `tx_status` for financial APIs), or `response_type_id` where documented.
response_type_idnumber
A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.
dataobject
API-specific response payload.
- user_codestring
  User code of the agent whose eKYC is now complete.

PUTBiometric eKYC

E-KYC steps

Fingerprint capture (`fType`)

PID `wadh` value

Request

Body parameters

Response types

Responses

Next steps

Related

E-KYC steps

Fingerprint capture (fType)

PID wadh value

Request

Body parameters

Response types

Responses

Next steps

Related

Fingerprint capture (`fType`)

PID `wadh` value