Profile Management

Fetch an ABHA profile, get the card or QR code, update mobile or email, and complete Re-KYC.

Profile APIs require a gateway token and an ABHA user token. Send the gateway token in Authorization. Send the ABHA user token in X-token.

Get X-token from login

Complete an ABHA login flow first. Use the returned token value as X-token for profile calls.

API coverage

Operation	Status	Endpoint
Fetch profile	Mandatory	`GET /profile/account`
Get QR code	Mandatory	`GET /profile/account/qrCode`
Generate ABHA card	Mandatory	`GET /profile/account/abha-card`
Download ABHA card	Mandatory	`GET /profile/account/download-abha-card`
Update mobile	Optional	`POST /profile/account/request/otp`, `POST /profile/account/verify`
Update email	Optional	`POST /profile/account/request/otp`, `POST /profile/account/verify`
Re-KYC	Optional	`POST /profile/account/request/otp`, `POST /profile/account/verify`

Fetch the user profile

Call this endpoint after login. Use it to refresh the local ABHA profile copy.

GET/profile/account

Fetch the ABHA profile for the current X-token.

Request

curl -X GET "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>"

ABHA card and QR code

Use these endpoints to show or download the user's ABHA artefacts. The card endpoints usually return an image or document payload. Set the correct Accept header for your client.

Get the ABHA QR code

Request

curl -X GET "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/qrCode" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>"

Generate the ABHA card

Request

curl -X GET "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/abha-card" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>"

Download the ABHA card

Request

curl -X GET "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/download-abha-card" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  --output abha-card.pdf

Update mobile number

Use this optional flow when the user changes the ABHA mobile number. Encrypt the new mobile number before you send it.

Request the mobile OTP

POST/profile/account/request/otp

Request an OTP to verify a mobile update.

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/request/otp" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "mobile-verify"],
    "loginHint": "mobile",
    "loginId": "<encrypted-mobile-number>",
    "otpSystem": "abdm"
  }'

Verify the mobile OTP

POST/profile/account/verify

Verify the OTP and complete the mobile update.

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/verify" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "mobile-verify"],
    "authData": {
      "authMethods": ["otp"],
      "otp": {
        "txnId": "<txn-id>",
        "otpValue": "<encrypted-otp>"
      }
    }
  }'

Update email address

Use this optional flow when the user adds or changes an email address. Encrypt the email address before you send it.

Request the email OTP

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/request/otp" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "email-verify"],
    "loginHint": "email",
    "loginId": "<encrypted-email>",
    "otpSystem": "abdm"
  }'

Verify the email OTP

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/verify" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "email-verify"],
    "authData": {
      "authMethods": ["otp"],
      "otp": {
        "txnId": "<txn-id>",
        "otpValue": "<encrypted-otp>"
      }
    }
  }'

Re-KYC

Use Re-KYC when ABDM requires the user to refresh Aadhaar KYC. The source marks Re-KYC as optional for both integrator types.

Request the Re-KYC OTP

Send the encrypted ABHA number in loginId. The OTP goes to the Aadhaar-linked mobile number.

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/request/otp" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "re-kyc"],
    "loginHint": "abha-number",
    "loginId": "<encrypted-abha-number>",
    "otpSystem": "aadhaar"
  }'

Verify the Re-KYC OTP

Request

curl -X POST "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/verify" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>" \
  -H "Content-Type: application/json" \
  -d '{
    "scope": ["abha-profile", "re-kyc"],
    "authData": {
      "authMethods": ["otp"],
      "otp": {
        "txnId": "<txn-id>",
        "otpValue": "<encrypted-otp>"
      }
    }
  }'

Logout

Call logout when the user exits the ABHA profile session. The Postman source gives this response example.

Request

curl -X GET "https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/request/logout" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "X-token: Bearer <x-token>" \
  -H "REQUEST-ID: <uuid>" \
  -H "TIMESTAMP: <utc-iso-timestamp>"

Response (200)

{
  "message": "You have been logged out",
  "timestamp": "2025-01-31 20:03:49"
}

Sources

ABDM Proposed Simplified Milestone 1 (DOCX→MD, 2026-08)
M1 ABHA Postman collection

PreviousM1 · ABHA Login Next M1 · Benefit Programs