Network & Protocol
The shared UHI protocol — the context block, the ACK pattern, request signatures, and the Gateway endpoints.
Every UHI service uses the same protocol envelope. This page describes the parts that all services share. Read this page before you read a service page.
The asynchronous pattern
UHI API calls are asynchronous. A request never returns business data in the HTTP response.
- The sender posts a request, for example
search. - The receiver returns an HTTP 200 ACK at once. The ACK confirms receipt only.
- The receiver processes the request.
- The receiver posts the result to the callback endpoint of the sender, for example
on_search. The Gateway delivers callbacks to theconsumer_uriof the EUA.
{
"message": {
"ack": {
"status": "ACK"
}
},
"error": {}
}A receiver that rejects a request returns a NACK with an error object:
| Field | Type | Mandatory | Description |
|---|---|---|---|
type | string | Yes | The error type |
code | string | Yes | The UHI error code |
path | string | No | The JSON path to the field that caused the error |
message | string | No | A human-readable error description |
The context block
Every UHI API call carries a context block. The block routes and correlates the message.
| Field | Type | Mandatory | Description | Example |
|---|---|---|---|---|
domain | string | Yes | The service domain code | nic2004:85111 |
country | string | Yes | The ISO 3166-1 country code. Always IND | IND |
city | string | Yes | The city STD code with the std: prefix | std:011 |
action | string | Yes | The API action name. It must match the endpoint | search |
core_version | string | Yes | The UHI core protocol version. Currently 0.7.1 | 0.7.1 |
consumer_id | string | Yes | The unique ID of the EUA on the network | eua-nha |
consumer_uri | string (URI) | Yes | The HTTPS callback URL of the EUA. It must share the domain of consumer_id | https://uhieuasandbox.abdm.gov.in/api/v1/euaService |
provider_id | string | Conditional | The unique ID of the HSPA. Required in all P2P calls. Not required in search | hspa-nha |
provider_uri | string (URI) | Conditional | The base URL of the HSPA. Required in all P2P calls. Taken from the on_search context | https://hspasbx.abdm.gov.in/api/v1 |
transaction_id | string (UUID) | Yes | The ID that links all calls in 1 transaction | e9a19230-f951-11ec-b135-53aea776f66b |
message_id | string (UUID) | Yes | A new UUID for each request and callback cycle | d29a41e0-a412-4b21-9c1f-0b3a54b18a1c |
timestamp | string (ISO 8601) | Yes | The time of request generation, RFC 3339 format | 2026-06-18T06:52:13.969464Z |
key | string | No | The encryption public key of the sender | — |
ttl | string (ISO 8601) | No | The duration for which the message is valid | PT30S |
Keep the transaction_id constant
The transaction_id must stay identical across all API calls in 1 transaction lifecycle. A mismatch prevents response correlation. The message_id changes with each call.
Authentication and signatures
You must sign every UHI API call. The network uses 2 cryptographic components:
| Component | Detail |
|---|---|
| Hash algorithm | BLAKE-512, applied to the request body to compute the digest |
| Signature algorithm | Ed25519 |
Authorization header | The signature envelope from the sender. See the format below |
X-Gateway-Authorization header | The same format. The Gateway adds it to each forwarded request. The keyId has the gateway-nha prefix |
Authorization: {"headers":"(created) (expires) digest","algorithm":"ed25519","keyId":"<subscriber-id>|<key-id>|ed25519","created":"<epoch>","expires":"<epoch>","signature":"<base64-sig>"}Follow these steps to prepare your keys:
Generate the key pair
Clone the NHA header generator utility. Run Generator.java with Option 1. The utility creates an Ed25519 key pair and the request headers.
Register the public key
Submit only the public key to the NHA in the onboarding form. Keep the private key secret.
Verify counterparties
Before each signed P2P call, look up the public key of the counterparty. Use the network registry lookup endpoint.
Gateway endpoints
The NHA develops and operates the UHI Gateway. You do not build these endpoints. You call them, or you receive calls from them.
| Endpoint | Caller | Purpose |
|---|---|---|
POST /api/v1/uhi/search | EUA | The EUA sends a search. The Gateway broadcasts it to all registered HSPAs in the domain |
POST /api/v1/uhi/on_search | HSPA | The HSPA sends its catalog. The Gateway forwards it to the consumer_uri of the EUA |
POST /api/v1/uhi/on_confirm_audit | HSPA | The HSPA sends an exact copy of each on_confirm payload for the audit log |
POST /api/v1/uhi/on_update_audit | HSPA | The HSPA sends an exact copy of each on_update payload for the audit log |
POST /api/v1/uhi/on_cancel_audit | HSPA | The HSPA sends an exact copy of each on_cancel payload for the audit log |
POST /api/v1/uhi/on_status_audit | HSPA | The HSPA sends an exact copy of each on_status payload for the audit log |
POST /api/v1/networkregistry/lookup | EUA or HSPA | Look up the public key and the details of a subscriber |
Network registry lookup
/api/v1/networkregistry/lookupLook up the registered public key of a network participant before you verify or generate an Authorization header. The type field accepts EUA, HSPA, or gateway.
curl -X POST "https://uhigatewaysandbox.abdm.gov.in/api/v1/networkregistry/lookup" \
-H "Content-Type: application/json" \
-d '{
"subscriber_id": "nha.eua",
"type": "EUA",
"domain": "nic2004:85111",
"country": "IND",
"city": "std:08752",
"pub_key_id": "nha.eua.k1"
}'Sandbox environment
| Parameter | Value |
|---|---|
| Gateway base URI | https://uhigatewaysandbox.abdm.gov.in |
| Reference EUA (consumer URI) | http://uhieuasandbox.abdm.gov.in/api/v1/euaService |
| Reference HSPA (provider URI) | https://hspasbx.abdm.gov.in/api/v1/hspa |
| Gateway Swagger | uhigatewaysandbox.abdm.gov.in/swagger-ui |
Communication models
UHI uses 2 communication models. Each service page states which model applies to each call.
| Model | Route | Use |
|---|---|---|
| Broadcast | EUA → Gateway → all HSPAs | Discovery (search / on_search) |
| Point-to-Point (P2P) | EUA ↔ HSPA, direct | Booking, fulfilment, and post-fulfilment calls |
P2P calls do not pass through the Gateway
For P2P calls, the EUA calls the provider_uri of the HSPA directly. The EUA gets the provider_uri from the on_search response. Both sides still sign each request and verify each signature.
Sources
- UHI Physical Consultation v2.0 — Onboarding Document (June 2026)
- UHI PM-JAY HEM Onboarding v1.4
