PHR calls carry the gateway session token, and their body fields are required
The P1 and P2 references showed 21
PHR application calls with no Authorization header and no required body fields. Every one
of them takes the access token from the gateway session call, and every field the request
body shows is required. Get profile, QR code and PHR card also take X-AUTH-TOKEN beside
X-token. If your app sends those calls without the token, add it.
The PHR public key is not the ABHA service's key
A PHR application encrypts the Aadhaar number,
mobile number, OTP and password with the key from
GET /abha/api/v3/phr/app/login/public/certificate, the first call in
P1.
Encryption had sent every reader to the M1 certificate.
Encrypt every PHR call with the PHR key.
Consent request init and context notify take an id only
On consent request init
the hiu block requires id alone; the reference had required name too, and the request
example still sent it. On
link context notify
the notification.hip block requires id alone; the reference had required name and
type. Neither extra field is needed.