What does this API do?
The DigiLocker API enables lenders to fetch verified digital documents directly from a citizen's DigiLocker account, eliminating the need for physical document submission. Organisations registered on DigiLocker can retrieve government-issued certificates — such as Aadhaar, PAN, driving licence, vehicle registration, educational marksheets, Udyam Certificate, and Passport Verification Report — in Base64-encoded XML or PDF format. The API also supports the Entity Locker flow for business document retrieval.
Who can use it?
Any lender or financial institution that has been onboarded to the ULI Platform and has subscribed to the DigiLocker service in the Platform Developer Portal.
Prerequisites
Complete all common platform prerequisites as described in Getting Started with ULI Platform APIs.
In addition, the following is specific to this API:
- DigiLocker Token: The lender must have an active DigiLocker account and generate a DigiLocker bearer access token (
x-sp-token) prior to calling this API. This is distinct from the ULI Platform JWT token. - DigiLocker Service Subscription: Subscribe to the DigiLocker service in the Platform Developer Portal (separately for Sandbox and Production). Refer to Section 10 of the SOP for Lender Onboarding for subscription steps.
What are the API endpoints?
| Environment | URL |
|---|---|
| Sandbox | https://extgw.nonprod.rbihub.io/digilocker/issued-documents/1.3/en |
| Production | https://extgw.api.rbihub.io/digilocker/issued-documents/1.3/en |
HTTP method: GET
URL path follows the convention: /{serviceName}/{ver}/{lang}
| URL Parameter | Description | Value |
|---|---|---|
| serviceName | Unique name of the service | digilocker/issued-documents |
| ver | Current version of the API | 1.3 |
| lang | Language for the response (ISO 639-1 code) | en |
What headers are required?
| Header | Description | Remarks |
|---|---|---|
Authentication | JWT token generated by the authentication server | Refer to the Authentication and Authorization API specification |
x-sp-token | Bearer access token to call DigiLocker APIs | Alphanumeric; obtained separately from DigiLocker |
scope | Document type(s) to retrieve | Case-insensitive. See supported scope values below |
client-id | Base64-encoded Client ID issued by the platform at registration | Required |
provider | Service provider code per MDDS standards | Use 110 for DigiLocker |
ts | Request timestamp in ISO-8601 format (yyyy-MM-ddTHH:mm:ssZ) | Required |
txncode | Unique alphanumeric transaction code provided by the lender | Required |
consent-id | Reference number of the consent artifact in the lender's application | Alphanumeric; 6–32 characters |
service | Flow selector: DigiLocker or EntityLocker | Optional; defaults to DigiLocker. Use DL for DigiLocker, EL for EntityLocker |
file-format | Format for the fetched document (DigiLocker flow only) | Optional; case-insensitive; defaults to XML. Also accepts PDF |
api-key | 24-character alphanumeric key issued by the platform | Optional; reserved for future use |
x-env-route | Required to route requests to the sandbox environment | Set to /sb for Sandbox only; omit for Production |
Supported scope values:
| Scope Code | Document Type |
|---|---|
ADHAR | Aadhaar Card (XML format only) |
PANCR | PAN Verification Record |
DRVLC | Driving Licence |
RVCER | Vehicle Registration |
SSCER | Class X Marksheet |
SSMGR | Class X Migration Certificate |
HSCER | Class XII Marksheet |
HSMGR | Class XII Migration Certificate |
UDCER | Udyam Certificate |
OPNCR | Entity Locker PAN Verification Record |
PSPRT | Passport Verification Report |
What is the request body?
This API uses the HTTP GET method. All inputs are passed as HTTP headers — there is no request body.
What do the response fields mean?
| Field | Description |
|---|---|
result.errcode | E000 on success; a relevant error code on failure |
result.status | success or fail |
result.info | Descriptive message, e.g. "Fetched issued documents successfully" |
data | Object keyed by scope code (e.g. ADHAR), containing the Base64-encoded XML or PDF document |
signature | Digital signature hash of the data field |
meta.txncode | Unique transaction code provided by the lender |
meta.ver | Version of the JSON response template in use |
meta.ts | Request initiation timestamp in ISO-8601 format |
hmac | SHA-256 hash of the data field for integrity verification |
publickey | Platform public key for source verification |
sig-algo | Algorithm used for signing, e.g. SHA256withECDSA |
Sample response:
{
"result": {
"errcode": "E000",
"status": "success",
"info": "Fetched issued documents successfully"
},
"data": {
"ADHAR": "<Base64 encoded XML/PDF response>"
},
"meta": {
"txncode": "Test123",
"ver": "1.3",
"ts": "2023-09-20T23:02:15+0530"
}
}What are the error codes?
For the full list of platform-wide error codes, refer to the Latest Platform Error Code document. The following are DigiLocker-specific error codes:
| Error Code | Description |
|---|---|
E510 | Invalid scope value |
E741 | Invalid token or token expired |
E829 | Invalid file format |
E851 | x-jws-signature header is missing |
E852 | client_api_key header is missing |
E853 | Authentication failed at provider |
Who do I contact for support?
If you encounter an issue, email support@rbihub.in with the following details:
- Subject: DigiLocker API Error
- Platform Service Name: DigiLocker
- Platform Environment: Sandbox or Production
- Service Provider code: 110
- Request payload (headers) sent to the platform
- Error code and error message received
- Prerequisites status: IP Whitelisting, URL Whitelisting, Service Subscription, Token Generation
- Screenshot or log of the error (as attachment)
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article