Subscriptions

Set up PHR subscriptions, handle notification events, and configure HIE-CM consent auto-approve.

A PHR app can subscribe to changes for an ABHA address. HIE-CM notifies the app when linked care context entries change. The app must ask the patient before it sets up a subscription.

Create a subscription when the app creates an ABHA address. Create one again when the patient logs in with a new ABHA address.

Verify subscription payloads

The source references the subscription Swagger. The examples below use its visible schema fields. Confirm exact headers and query values in the sandbox Swagger.

What the patient must see

Tab	Status	Meaning
Requests	Requested	The patient has not acted on the request.
Requests	Denied	The patient denied the request.
Requests	Expired	The patient did not act before expiry.
Approved	Granted	The patient approved the request.
Approved	Revoked	The patient revoked the request after grant.

Let the patient approve, deny, edit, disable, enable, and revoke where the API allows it. Send mobile notifications for new events. Firebase is one possible mobile channel.

Notification events

The PHR app receives these event types:

Event	App action
New care context	Notify the patient and start record fetch if consent allows it.
Modified care context	Notify the patient and update the record view.
New consent request	Show it in the Consents tab.
New subscription request	Show it in the Subscriptions tab.

Create a subscription request

Initiate subscription

curl -X POST "https://dev.abdm.gov.in/api/hiecm/subscription-requests/v3/init" \
  -H "Content-Type: application/json" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>" \
  -d '{
    "subscription": {
      "purpose": {
        "text": "Self Requested",
        "code": "PATRQT",
        "refUri": "www.abdm.gov.in"
      },
      "patient": {
        "id": "john.doe@sbx"
      },
      "hiu": {
        "id": "PHR_APP_ID",
        "name": "Example PHR App",
        "type": "PHR"
      },
      "hips": [
        {
          "id": "HIP_1",
          "name": "Example Hospital",
          "type": "HIP"
        }
      ],
      "categories": ["LINK", "DATA"],
      "period": {
        "from": "2026-08-11T00:00:00.000Z",
        "to": "2126-08-11T00:00:00.000Z"
      }
    }
  }'

Response (202)

{
  "status": "ACCEPTED"
}

Approve or deny a subscription

Approve only after the patient reviews the source, HI types, purpose, and period.

Approve subscription request

curl -X POST "https://dev.abdm.gov.in/api/hiecm/subscription-requests/v3/<request-id>/approve" \
  -H "Content-Type: application/json" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>" \
  -d '{
    "isApplicableForAllHIPs": false,
    "includedSources": [
      {
        "hiTypes": ["DiagnosticReport", "Prescription"],
        "purpose": {
          "text": "Self Requested",
          "code": "PATRQT",
          "refUri": "www.abdm.gov.in"
        },
        "hip": {
          "id": "HIP_1",
          "name": "Example Hospital",
          "type": "HIP"
        },
        "categories": ["LINK", "DATA"],
        "period": {
          "from": "2026-08-11T00:00:00.000Z",
          "to": "2126-08-11T00:00:00.000Z"
        }
      }
    ],
    "excludedSources": []
  }'

Response (202)

{
  "status": "ACCEPTED"
}

Deny subscription request

curl -X POST "https://dev.abdm.gov.in/api/hiecm/subscription-requests/v3/<request-id>/deny" \
  -H "Content-Type: application/json" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>" \
  -d '{
    "reason": "Patient denied the subscription request"
  }'

Response (202)

{
  "status": "ACCEPTED"
}

Fetch subscription requests

curl -X GET "https://dev.abdm.gov.in/api/hiecm/subscription-requests/v3/requests" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>"

Response

{
  "requests": [
    {
      "id": "sub-req-123",
      "status": "REQUESTED",
      "purpose": "Self Requested",
      "from": "2026-08-11T00:00:00.000Z",
      "to": "2126-08-11T00:00:00.000Z"
    }
  ]
}

Use HIE-CM consent auto-approve when the patient allows automatic record retrieval. The PHR app must store the returned auto-approval ID.

When a new care context arrives, create a consent request. HIE-CM immediately grants it if the policy matches. Then fetch the health record and save it in the PHR app.

Create auto-approval policy

curl -X POST "https://dev.abdm.gov.in/api/hiecm/consent/v3/auto/approve" \
  -H "Content-Type: application/json" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>" \
  -d '{
    "isApplicableForAllHIPs": false,
    "hiu": {
      "id": "PHR_APP_ID",
      "name": "Example PHR App",
      "type": "PHR"
    },
    "includedSources": [
      {
        "hiTypes": ["DiagnosticReport", "Prescription"],
        "purpose": {
          "text": "Self Requested",
          "code": "PATRQT",
          "refUri": "www.abdm.gov.in"
        },
        "hip": {
          "id": "HIP_1",
          "name": "Example Hospital",
          "type": "HIP"
        },
        "period": {
          "from": "2026-08-11T00:00:00.000Z",
          "to": "2027-08-11T00:00:00.000Z"
        }
      }
    ],
    "excludedSources": []
  }'

Response

{
  "autoApprovalId": "auto-approval-123",
  "status": "GRANTED"
}

Disable auto-approval policy

curl -X POST "https://dev.abdm.gov.in/api/hiecm/consent/v3/auto/approve/<auto-approval-id>/disable" \
  -H "REQUEST-ID: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
  -H "X-CM-ID: sbx" \
  -H "Authorization: Bearer <hiecm-access-token>"

Response

{
  "status": "DISABLED"
}

Certification checks

Check	Requirement
Requests tab	Show requested, denied, and expired requests.
Approved tab	Show granted and revoked requests.
Edit	Let the patient edit active request scope where allowed.
Disable	Let the patient disable an auto-approval policy.
Notifications	Show care context, consent, and subscription events.

Sources

ABDM PHR app documentation (DOCX→MD, 2026-08)

PreviousScan & Share Next Records & Consents

Subscriptions

What the patient must see

Notification events

Create a subscription request

Approve or deny a subscription

Fetch subscription requests

Auto-approve consent requests

Certification checks