PUTVerify OTP (eKYC)

Verify the eKYC OTP sent to the agent's Aadhaar-linked mobile number to advance the one-time AePS Fingpay eKYC.

PUT/user/collection/aeps-fingpay/kyc/otp/verify

The second step of the one-time AePS Fingpay eKYC flow (Send OTP → Verify OTP → Biometric). Submits the OTP the agent received, together with the otp_ref_id and reference_tid returned by the Send OTP API, to validate the agent's identity before biometric capture.

The aadhar parameter must be encrypted with Fingpay's RSA public key (PKCS#1 v1.5 padding) and Base64-encoded — never sent as plain text. See Aadhaar Encryption (Fingpay AePS) for how to get the production key and code samples.

Tip

This endpoint is one step in a complete workflow:

AePS (Fingpay) — Cash Withdrawal — Aadhaar-enabled cash withdrawal: one-time agent activation and eKYC, daily KYC, a transaction OTP for amounts above ₹5,000, then the biometric withdrawal.

Request

Body parameters

Field	Type	Required	Description
`initiator_id`	string	required	Registered mobile number of the API user (see Platform Credentials).e.g. 9962981729
`client_ref_id`	string	optional	Unique reference ID per API call, generated by your system (10–20 characters; 10 recommended). The SDKs generate one for every non-GET call when you don't.e.g. 2026010100123456789
`user_code`	string	required	Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your userse.g. 20810200
`customer_id`	string	required	Registered mobile number of the agent/merchant undergoing eKYC.e.g. 9123456789
`aadhar`	string	required	RSA-encrypted (PKCS#1 v1.5), Base64-encoded Aadhaar number of the agent undergoing eKYC. See the Aadhaar Encryption (Fingpay AePS) guide for the key and code samples.e.g. BASE64_ENCRYPTED_AADHAAR
`otp`	string	required	OTP received on the agent's Aadhaar-registered mobile number.e.g. 123456
`otp_ref_id`	string	required	Reference ID returned by the Send OTP (eKYC) API.e.g. 2465238
`reference_tid`	string	required	Transaction reference ID returned by the Send OTP (eKYC) API.e.g. EKYKF4719702240123152147525I
`latlong`	string	required	Agent's GPS coordinates as `latitude,longitude`. Required for security and fraud prevention.e.g. 28.6139,77.2090

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference ID per API call, generated by your system (10–20 characters; 10 recommended). The SDKs generate one for every non-GET call when you don't.

example: 2026010100123456789

user_codestringRequired

Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your users

example: 20810200

customer_idstringRequired

Registered mobile number of the agent/merchant undergoing eKYC.

example: 9123456789

aadharstringRequired

RSA-encrypted (PKCS#1 v1.5), Base64-encoded Aadhaar number of the agent undergoing eKYC. See the Aadhaar Encryption (Fingpay AePS) guide for the key and code samples.

example: BASE64_ENCRYPTED_AADHAAR

otpstringRequired

OTP received on the agent's Aadhaar-registered mobile number.

example: 123456

otp_ref_idstringRequired

Reference ID returned by the Send OTP (eKYC) API.

example: 2465238

reference_tidstringRequired

Transaction reference ID returned by the Send OTP (eKYC) API.

example: EKYKF4719702240123152147525I

latlongstringRequired

Agent's GPS coordinates as `latitude,longitude`. Required for security and fraud prevention.

example: 28.6139,77.2090

These headers authenticate and sign every request. See How Auth Works for details.

Field	Type	Required	Description
`developer_key`	string	required	Static API key issued to your account after KYC.
`secret-key`	string	required	Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).
`secret-key-timestamp`	string	required	Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.
`content-type`	string	required	application/jsone.g. application/json

developer_keystringRequired

Static API key issued to your account after KYC.

secret-keystringRequired

Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).

secret-key-timestampstringRequired

Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.

content-typestringRequired

application/json

example: application/json

Response types

response_type_id	Meaning	Next step
`1604`	Validation successful	Biometric eKYC

Responses

1604Validation successfulNext:Biometric eKYC

statusnumber
Primary success indicator (0 = success).
messagestring
Human-readable response / error message.
response_status_idnumber
UI display hint only (-1/0 success, 1 failure, 2 initiated, 3 refund initiated, 4 refunded). Never branch on it — use `status` (and `tx_status` for financial APIs), or `response_type_id` where documented.
response_type_idnumber
A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.
dataobject
API-specific response payload.
- reference_tidstring
  Transaction reference ID for this eKYC verification. Carry forward to the Biometric eKYC step.
- otp_ref_idstring
  Reference ID of the OTP session. Carry forward to the Biometric eKYC step.

Next steps

NextPUTBiometric eKYCComplete one-time AePS Fingpay eKYC by submitting the agent's Aadhaar and live biometric fingerprint capture.

Request

Body parameters

Response types

Responses

Next steps

Related