client_id(query) — Provide the client id that was created during the application registration process on Partners Portal.
response_type(query, required) — Provide the grant type requested, either token or code.
redirect_uri(query, required) — The URI to redirect the user after authorization has completed.
state(query, required) — This is your application specific data that will be passed back to your application through redirect_uri.
Code_challenge(query) — A unique random string called code verifier (code_verifier) is created by the client application for every authorization request. The code_challenge sent as this parameter is the Base64URL (with no padding) encoded SHA256 hash of the code verifier. Code block: ``` string base64_url_encode_without_padding(string arg) { string s = base64encode(arg); //Regular base64encoder with padding s = s.replace(’=’,’’); //Remove any trailing ’=’ s = s.replace(’+’, ’-’); //Replace ’+’ with ’-’ s = s.replace(’/’, ’_’); //Replace ’/’ with ’_’ return s; } ```
Code_challenge_method(query) — Specifies what method was used to encode a code_verifier to generate code_challenge parameter above. This parameter must be used with the code_challenge parameter. The only supported values for this parameter is S256.
dl_flow(query) — If this parameter is provided its value will always be signup. This parameter indicates that the user does not have a DigiLocker account and will be directed to the signup flow directly. After the account is created, the user will be directed to the authorization flow. If this parameter is not sent, the user will be redirected to the sign in flow.
Verified_mobile(query) — Verified mobile number of the user. If this parameter is passed, DigiLocker will skip the mobile OTP verification step during sign up. DigiLocker will treat the mobile number passed in this parameter as a verified mobile number by the trusted client application. This parameter will be used only if dl_flow parameter mentioned above is set to signup and will be ignored otherwise.
POST
/oauth2/1/code
Get Device Code
POST
/oauth2/1/file/upload
Upload file to locker
path(header) — The destination path of the file in DigiLocker including filename.
hmac(header) — This is used to verify the integrity of the file data. The client app calculates the hash message authentication code (HMAC) of the file content using SHA256 hashing algorithm and the client secret as the hashing key. The resulting HMAC is converted to Base64 format and sent in this parameter. Upon upload of file, DigiLocker calculates the HMAC of the file data and compares it with this HMAC..
GET
/oauth2/1/file/{uri}
Get File from URI
uri(path, required) — This is the unique identifier of the document.
GET
/oauth2/1/files/
Get List of Self Uploaded Documents
GET
/oauth2/1/files/issued
Issued Documents
GET
/oauth2/1/files/{id}
Get List of Self Uploaded Documents
id(path, required) — The id of the folder to list. To list the files of root folder of a user’s locker, do not send this parameter. This is sent as a part of the URL.
POST
/oauth2/1/pull/doctype
Get List of Documents Provided by an Issuer
POST
/oauth2/1/pull/issuers
Get List of Issuers
POST
/oauth2/1/pull/parameters
Get Search Parameters for a Document
POST
/oauth2/1/pull/pulldocument
Pull Document
POST
/oauth2/1/revoke
Revoke Token.
POST
/oauth2/1/token
Get Access Token
GET
/oauth2/1/user
Get User Details
GET
/oauth2/1/xml/{uri}
Get Certificate Data in XML Format from URI
uri(path, required)
GET
/oauth2/2/files/issued
Issued Documents
GET
/oauth2/2/xml/eaadhaar
Get e-Aadhaar Data in XML Format
POST
/signup/1/demoauthverify
Verify OTP
POST
/signup/2/demoauth
SIGN UP
POST
/statistics/1/counts
Get Statistics
22 endpoints auto-detected
Authentication
This API uses an API key, passed in the "X-2" header. No OAuth required.
curl -X POST \
"https://betaapi.digitallocker.gov.in/public/account/1/pushuri" \
-H "X-2: YOUR_API_KEY"
