e-Sign — NeSL

What does this API do?

The NeSL e-Sign API enables lenders to execute loan contracts digitally using Aadhaar-based e-signatures. It integrates with National E-Governance Services Ltd (NeSL) to support the following activities:

• Submitting debtor details, loan information, and document data to NeSL for execution
• Triggering e-sign links to signatories (debtors, guarantors, co-obligants) via mobile and email in a configurable sequence
• Redirecting signatories to C-DAC for Aadhaar-based digital signing
• Embedding digital signatures on the loan agreement and returning the final signed document
• Supporting two execution flows, configured per Client ID: (a) returning the execution link in the API response to the submitter, or (b) sending the signed link directly to the borrower with success status in the API response

Supporting APIs include: Link API (retrieve e-sign link at a later point), Retrigger API (resend the e-sign link to signatories), Status API (check document execution status), and Document API (pull the executed document if the callback fails).

Who can use it?

• Lenders (banks and financial institutions) onboarded on the ULI Platform who have subscribed to the NeSL service
• Technical teams integrating loan origination or loan management systems with the ULI Platform

Prerequisites

Complete all common platform prerequisites as described in Getting Started with ULI Platform APIs. Then ensure the following NeSL-specific items are in place:

• NeSL Service Subscription: Subscribe to the NeSL service in the Platform Dev Portal (separately for Sandbox and Production). Steps are in the latest SOP for Lender Onboarding, Section 10.
• NeSL Credentials: Obtain the following from NeSL during registration:
  • Self-signed certificate and its password (used for payload encryption and digital signature generation)
  • Client ID (x-sp-client-id)
  • API Key (x-sp-api-key)
  • Basic Auth credentials — username and password (x-sp-authorization)
• Callback URL: Register an HTTPS POST callback URL with NeSL. After successful Aadhaar validation by each signatory, NeSL will POST the signed document and transaction details to this URL.
• Payload Encryption: Implement AES/CBC/PKCS5Padding + RSA/ECB/PKCS1Padding encryption before calling the esign-estamp API. Refer to Section 4.1.8 (encryption) and Section 4.1.9 (decryption for execution link response) of the API specification.
• Digital Signature (digisign): Implement SHA256withRSA signing using your PKCS#12 private certificate for Status and Document API calls. Refer to Section 4.5.7.

API endpoints

URL path follows the convention: /{service name}/{ver}/{lang}

Headers

Request body

All requests use JSON format. The data.payload field in the initiation API carries the encrypted loan metadata. The payload must be encrypted using AES/CBC/PKCS5Padding (session key) + RSA/ECB/PKCS1Padding (session key encryption with NeSL's public certificate). The outer envelope structure is:

{
  "meta": {
    "ver": "1.3",
    "ts": "<ISO-8601 timestamp>",
    "txncode": "<unique transaction code>"
  },
  "data": {
    "payload": "<encryptedSessionKey>:<base64EncodedEncryptedPayload>"
  },
  "hmac": "<SHA-256 hash of the value of key 'data'>"
}

Key fields in the unencrypted loan metadata (esign only — estampFlag: "N"):

Link, Retrigger, Status, and Document APIs use a simpler payload:

{
  "meta": { "ver": "1.3", "ts": "<timestamp>", "txncode": "<code>" },
  "data": {
    "transId": "<transaction ID from esign-estamp call>",
    "loanno": "<loan number>",    // conditional
    "snctnno": "<sanction number>" // conditional
    // Status and Document APIs also require:
    // "digisign": "<SHA256withRSA signature of the unencrypted JSON object>"
  },
  "hmac": "<SHA-256 hash of data>"
}

Response fields

All API responses share a common envelope:

Initiation API — additional response fields (link-to-borrower flow):

Initiation API — additional response fields (submitter execution link flow):

The data.REQUEST field contains an encrypted JSON payload. Decrypt it using the same session key used during request encryption (AES/CBC with IV = first 16 chars of session key). The decrypted response contains per-signatory e-sign links:

Link API — additional response fields:

Status and Document APIs return encrypted data in data.cipherText and data.sessionId. Decrypt using RSA (private key) to recover the session key, then AES-decrypt the cipherText. Refer to Section 4.5.8 of the API specification.

Callback notification fields (sent by NeSL to the lender's registered resp-url after each signatory completes Aadhaar validation):

The lender's callback endpoint must return:

{ "txnID": "<txnID>", "status": "Received successfully", "statusCode": "001" }

Callback status codes: 001 = success; 002 = txnID not found; 003 = invalid Base64 value.

Note: The fields returned in the callback are dynamic and depend on the eSign validation rule configuration mapped to the lender's NeSL Client ID. Validation rules can combine Name (min 75% match), Year of Birth (100%), Gender (100%), and last 4 digits of Aadhaar (100%).

Error codes

For additional Platform-level error codes, refer to the latest Platform Error Code document available in the Platform API Spec folder.

Who to contact?

If you encounter an issue, email the Platform Support Center at support@rbihub.in with the following details:

• Subject: e-Sign API Error — NeSL
• Service Name: esign estamp
• Environment: Sandbox / Production
• Service Provider: NeSL
• Request Headers
• Request Payload
• Error Code
• Error Message
• Attachment: Screenshot or log of the error
• Prerequisites Status: IP Whitelisting, URL Whitelisting, Service Subscription, Token Generation