Skip to main content

Submit the biometric auth verify

Completes the authentication started by Biometric auth init with the captured PID block, and returns the beneficiary's user token, valid thirty minutes.

POST/hcx/abha/biometric/auth/verify

Business purpose

The user token this call returns is the proof of presence PMJAY asks for. It rides on the eligibility check, the pre-authorisation and the claim. Without it a request must carry the plan's consent questionnaire instead, or it is refused: PAYR-1256 at the pre-authorisation, PAYR-1363 at the claim.

When to use

Call it right after the capture, with the txnId from init and the PID block from the device.

Preconditions

  • A txnId from Biometric auth init for the same method.
  • The PID block from the capture device.
  • The same headers as init.

Postconditions

Returns a user token valid for thirty minutes and a refresh token valid for fifteen days. The user token goes on the eligibility check, the pre-authorisation and the claim.

Common mistakes

  • Putting the PID block under the wrong key for the method.
  • Storing the token against the session instead of the case.
  • Using a refreshed token where a cyclic visit needs a new capture.

Best practices

  • Store the user token and its expiry against the case.
  • Store the refresh token, and refresh automatically for the duration of the transaction cycle.
  • Keep nothing from the ABHA profile beyond what the encounter needs.

Related scenario

Right after the fingerprint capture, the desk posts the txnId from init and the device's PID block in fingerPrintAuthPid, with authMethods ["bio"]. The answer carries a thirty-minute token and a fifteen-day refresh token. The token goes on the header of the eligibility check and the pre-authorisation, and both tokens are stored against the case.

Specification

Chapter Biometric authentication of the NHCX integration specification.

Headers

processstringRequired

No source puts process or payerid on faceauth/init or capture/pid.

payeridstringRequired

payerid is the insurer's own participant code. Every insurer has one, even when it works through a TPA.

Body

scopestring[]
authDataobject
authData.authMethodsstring[]
authData.bioobject
authData.bio.txnIdstring
authData.bio.fingerPrintAuthPidstring
authModestring

Responses

200

On success it returns authResult success, a user token with expiresIn 1800 seconds, a refreshToken with refreshExpiresIn 1296000 seconds, fifteen days, and the ABHA accounts matched.

txnIdstring
authResultstring
messagestring
tokenstring
refreshTokenstring
expiresIninteger
refreshExpiresIninteger
accountsobject[]
accounts.ABHANumberstring
accounts.namestring
accounts.statusstring