Hypothecation Fetch and Termination — MoRTH

What does this API do?

The MoRTH Vehicle Hypothecation service (provider code 156) provides two operations for lenders managing vehicle loans:

• Hypothecation Fetch (vehicle-hypothecation-details) — Retrieves the current and historical hypothecation (lien) status for a vehicle, including financer name, HP start/end dates, and active status.
• Hypothecation Termination (vehicle-hypothecation-termination) — Submits a request to MORTH to terminate an active hypothecation entry for a vehicle upon loan closure.

Both APIs use a hybrid encryption scheme (AES-256-GCM for payload, RSA-2048-OAEP for key protection) for request and response data. The encrypted payload is base64-encoded and passed in the data field.

Who can use it?

Lenders and financial institutions onboarded to the ULI Platform who have subscribed to the MoRTH Hypothecation service in the Developer Portal.

What are the prerequisites?

Complete all common platform prerequisites as described in Getting Started with ULI Platform APIs.

In addition, the following are specific to this service:

• Payload encryption: Request data must be encrypted using the hybrid AES-256-GCM + RSA-2048-OAEP scheme described in the API specification (Section 8). The ULI Platform's public key (shared during onboarding) is used to protect the AES session key. The encrypted JSON is base64-encoded and submitted as the data field.
• Lender ID: A lender_ID (8-character string prefixed S) is assigned by RBIH and must be included in each request payload.
• Ensure the MoRTH service is subscribed separately for Sandbox and Production in the Dev Portal.

What are the API endpoints?

What headers must be sent?

The following headers apply to both endpoints:

What does the request body look like?

Both endpoints accept a JSON body with an encrypted data field and an HMAC:

{
  "hmac": "SHA-256 hash of the encrypted data value",
  "data": "base64(JSON{ sessionKey: base64(RSA(AES_KEY)), sessionId: base64(RSA(IV)), payload: base64(AES-GCM(DATA)) })"
}

The plain-text JSON payload (before encryption) differs by endpoint:

vehicle-hypothecation-details payload fields

vehicle-hypothecation-termination payload fields

What does the response contain?

The response body contains an encrypted data field. After decryption (using the same hybrid scheme with the lender's private key), the plain-text JSON contains the following fields.

vehicle-hypothecation-details decrypted response

vehicle-hypothecation-termination decrypted response

Common response envelope fields

On failure, the data array contains error_code and error_message. Error codes follow the pattern E-MORT-P-XXX (platform error) or E-MORT-D-XXX (provider/MORTH error).

What are the error codes?

Error codes are structured as:

• E-MORT-P-XXX — Error originating from the ULI Platform layer
• E-MORT-D-XXX — Error originating from the MORTH provider

Example: E-MORT-P-001 — Missing mandatory header parameter. Refer to the Latest Platform Error Code document on the Dev Portal for the complete list.

Who do I contact for support?

Write to support@rbihub.in with the following details:

• Subject: MoRTH Hypothecation API Error
• Service Name: Vehicle Hypothecation (MoRTH)
• Environment: Sandbox / Production
• Service Provider code: 156 (MoRTH)
• Request Payload (headers and body)
• Error Code and Error Message received
• Screenshot or log of the error
• Prerequisites status: IP Whitelisting, URL Whitelisting, Service Subscription, Token Generation