Fintech APIs & Platform for KYC, Verification & Transactions in India | Eko Platform Services
Eko Platform Services Logo
Open in ChatGPTOpen in ClaudeView as Markdown
Get Postman CollectionDownload OpenAPI

PUTBiometric eKYC

Complete one-time AePS Fingpay eKYC by submitting the agent's Aadhaar and live biometric fingerprint capture.

PUT/user/collection/aeps-fingpay/kyc/biometric

The final step in the one-time AePS Fingpay eKYC flow, called after OTP verification. Submits the agent's Aadhaar and live biometric PID data to UIDAI for identity verification. On success the agent's eKYC is marked complete and they can start performing AePS transactions (subject to completing daily 2FA each day).

Warning

You need to encrypt the Aadhaar number before passing it as a parameter. The same RSA-encrypted Aadhaar + PID XML format is used by all AePS transaction APIs.

Aadhaar encryption

  1. Decode the public key using Base64 (the public keys for UAT and production are different).
  2. Compute the RSA-encrypted signature using the decoded key and the Aadhaar message.
  3. Base64-encode the encrypted signature before sending it on the API.

Public key for Aadhaar encryption (UAT)

text
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaFyrzeDhMaFLx+LZUNOOO14Pj9aPfr+1WOanDgDHxo9NekENYcWUftM9Y17ul2pXr3bqw0GCh4uxNoTQ5cTH4buI42LI8ibMaf7Kppq9MzdzI9/7pOffgdSn+P8J64CJAk3VrVswVgfy8lABt7fL8R6XReI9x8ewwKHhCRTwBgQIDAQAB
java
public static String calculateRSA(String salt) throws InvalidKeyException, Exception {
	Cipher encryptCipher = Cipher.getInstance("RSA");
	encryptCipher.init(Cipher.ENCRYPT_MODE, getPublicKey());
	byte[] secretMessageBytes = salt.getBytes("UTF-8");
	byte[] encryptedMessageBytes = encryptCipher.doFinal(secretMessageBytes);
	return Base64.encodeBase64String(encryptedMessageBytes);
}


public static PublicKey getPublicKey() throws Exception {
	String rawPublicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXa63O/UXt5S0Vi8DM/PWF4yugx2OcTVbc...";
	byte[] keyBytes = Base64.decodeBase64(rawPublicKey);
	X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
	KeyFactory kf = KeyFactory.getInstance("RSA");
	return kf.generatePublic(spec);
}

E-KYC steps

For Fingpay AePS, it is mandatory to use e-KYC OTP request, e-KYC OTP verification and biometric before any AePS transaction. Make sure you complete these APIs in order:

StepAPIPurpose
1Send OTP (eKYC)OTP to the agent's Aadhaar-linked mobile
2Verify OTP (eKYC)Validate the OTP and start the eKYC session
3Biometric eKYCSubmit Aadhaar + live fingerprint PID (this API)
Note

eKYC is a one-time setup per agent. It is distinct from the daily authentication (2FA) required once per calendar day before transacting.

Fingerprint capture (fType)

Note

New to RDService? The Aadhaar Biometric Authentication guide covers the full capture flow — driver discovery, PidOptions, error codes — for Web and Android, and includes an in-browser device tester.

Warning

Per NPCI's FIR-FMR single-PID-block guidance, capture fingerprints with fType = 2 (not 0). A subset of banks that have not yet completed FMR+FIR compliance still require fType = 0 — check the current bank list before going live. The same PID format applies to all AePS transaction APIs.

PID wadh value

Warning

If you generate the PID block with your own code (rather than taking the RD service default), you must set this wadh alongside the other attributes such as fCount and fType:

text
wadh=E0jzJ/P8UopUHAieZn8CKqS4WPMi5ZSYXgfnlfkWjrc=

A missing or wrong wadh surfaces later as Daily KYC failing with "Authentication Failed. Invalid Biometric data."

Tip
This endpoint is one step in a complete workflow:

Request

Body parameters

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference ID per API call, generated by your system (max 20 characters).

example: 2026010100123456789

user_codestringRequired

Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your users

example: 20810200

aadharstringRequired

RSA-encrypted, Base64-encoded Aadhaar number of the agent.

example: BASE64_ENCRYPTED_AADHAAR

customer_idstringRequired

Registered mobile number of the agent/merchant undergoing eKYC.

example: 9123456789

latlongstringRequired

Agent's GPS coordinates as `latitude,longitude`. Required for security and fraud prevention.

example: 28.6139,77.2090

piddatastringRequired

PID XML string from the UIDAI-certified biometric device (fType=2, Data type='X', mc in DeviceInfo).

example: <?xml version='1.0'?><PidData><Data type='X'>...</Data><DeviceInfo mc='...' /></PidData>

bank_codestringRequired

Eko bank code of the agent's bank. Resolve it using the [Get List of Banks](./get-banks) API.

example: HDFC

otp_ref_idstringRequired

Reference ID returned by the preceding OTP step, linking this biometric capture to the verified OTP session.

example: 2465238

reference_tidstringRequired

Transaction reference ID returned by the preceding OTP step.

example: EKYKF4719702240123152147525I

Response types

response_type_idMeaningNext step
1605eKYC successful — agent may now complete Daily KYCDaily KYC

Responses

1605eKYC successful — agent may now complete Daily KYCNext:Daily KYC

  • statusnumber

    Primary success indicator (0 = success).

  • messagestring

    Human-readable response / error message.

  • response_status_idnumber

    Granular status id; see the shared error-codes table.

  • response_type_idnumber

    A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.

  • dataobject

    API-specific response payload.

    • user_codestring

      User code of the agent whose eKYC is now complete.

Next steps

Related