Login using health id

[Zeniya]

I have created the health id using sandbox but now I am trying to login via heath APIs but I don’t have redirect_uri configured so is there a way to login? What should be the value of the authorization and X-HIP-ID which is passed in the api
/v2/auth/authPassword

[Dhawal]

Hi @Zeniya,
redirect URL is only when you are doing OIDC based integration.

You can call below APIs to login:

1. /v1/auth/init --> Intiate authentication with given HealthID and authentication method (AADHAAR_OTP, MOBILE_OTP, PASSWORD)
2. /v1/auth/confirmWithAadhaarOtp --> Login with Aadhaar OTP. (OTP is recieved already by calling #1 with AADHAAR_OTP authentication method.
3. /v1/auth/confirmWithMobileOTP --> Login with Mobile OTP. (OTP is recieved already by calling #1 with MOBILE_OTP authentication method.
4. /v1/auth/confirmWithPassword --> Login with Password.

You can call any of the #2,#3,#4 based authentication method in #1 request.

Thanks

[Zeniya]

@Dhawal
Thanks for the update but yesterday I tried to authenticate using the api mentioned in step 2, 3.
I’m getting otp on mobile but when I am passing it in API “/v2/auth/confirmWithAadhaarOtp” getting the error as below:
{
“code”:“HIS-400”,
“message”:“Request is invalid. Please enter the correct data.”,
“details”:[
{
“message”:“The OTP that you have entered is incorrect. Please try again.”,
“code”:“HIS-1013”,
“attribute”:{
“key”:“otp”,
“value”:“271101”
}
}
]
}
Error when calling the API “v2/auth/confirmWithMobileOTP”:
{
“code”:“HIS-500”,
“message”:“An unexpected error has occured. Please try again in sometime.”,
“details”:null
}
The sessions API gives access token and refresh token but it works only with refresh token not access token though I tried using the freshly generated access token.
Can you please help or let me know where I’m going wrong

[Dhawal]

Hi @Zeniya,

1. You need to send encrypted OTP (encrypt it with public key returned using /v1/cert API)
2. Same txn cannot be used in #2 and #3. So you need to call APIs in combination (1,2 or 1,3 or 1,4 only).
3. Refresh token should not be used to access any APIs. Only AccessToken must be used. Please note that accessToken gets expired in 5 min so you need to ensure that you generate accessToken before each call to avoid unneccessory 401 errors during integration.

Thanks

[Zeniya]

The api to convert code to token is not working getting error as below:
{
“code”: “HIS-500”,
“message”: “An unexpected error has occured. Please try again in sometime.”,
“details”: null
}

[suraj]

Hi @Zeniya,

For authentication we need to call only

1. /v1/auth/init --> Intiate authentication with given HealthID and authentication method (AADHAAR_OTP, MOBILE_OTP, PASSWORD)
2. /v1/auth/confirmWithAadhaarOtp --> Login with Aadhaar OTP. (OTP is recieved already by calling #1 with AADHAAR_OTP authentication method.
3. /v1/auth/confirmWithMobileOTP --> Login with Mobile OTP. (OTP is recieved already by calling #1 with MOBILE_OTP authentication method.
4. /v1/auth/confirmWithPassword --> Login with Password.

Don’t call v2 version

Thank
suraj singh

[Dhawal]

@Zeniya,
Please go thru this for detailed explanation:

HealthID Knowledge 101 - Solving Authentication issues with HealthID APIs

Hi All, We have seen a lot of issues where integrators face unauthorized errors while trying to access HealthID APIs. Here is a quick guide to ensure that you have smooth integration to HealthID APIs: All HealthID APIs are secured by JWT token issued by https://dev.ndhm.gov.in in sandbox. You can generate a new accessToken by calling https://dev.ndhm.gov.in/gateway/v0.5/sessions API. Please note that an accessToken has 5 minutes of expiry time (irresptive of usage/idle time). So ensure tha…

Thanks

[Zeniya]

What is the expiry time of user access token?
How to register via redirect_uri flow?

[Dhawal]

Hi @Zeniya,
Default user session expiry is 30 min.

For resiteration using OIDC you can check details here:
https://devforum.ndhm.gov.in/t/healthid-knowledge-102-oidc-with-healthid/2056/4

Thanks

[manjoorkapoor]

Hi @Dhawal
Getting error while calling https://healthidsbx.ndhm.gov.in/api/v2/account/change/mobile/update/authentication
I have encrypted the OTP also
my request JSON is

{ "authMethod": "MOBILE_OTP", "oldPassword": "", "otp": "V9GEF1ehqTzEQNZEzlsva5PEgv5QVDF+CWxB3bLLeDXhO+5rPd7zDGarFYKm3TrUFFyQwizcBgzQ2DQmyffpLUUM+GflpEFIpbJd1npbixA1L9G6xFU/6KmS0Cz/BjY9IP6BhZ5P97W+UwNl7N972T9EL/Fv9/LzajmrZucWZHKGlwDCGN1RhCXKr5lM1zSACfSHJ9IPXj17L/euHwEUy4vchbSeRtxgEz3l8jAOPfBWd5UzZQN/pMrpPECq4BDdptr922Y+zk5FHaSQi2hiS7Kg39gzfMYBz6Ilwp6LEjcI3po+l8YJ71VWUw4EGD6vG39c5Hh5tTECvwzvOywO/79+3MDk+x1ULqsEdqwDacfhnRBKd5yKKuh6JVy+XqKfw7Y4EoMjw7CrJithL3WMw651YAVP3jSR5XjBtq48afECkcMGx64YnodCy/gzSO9D+Pxsf4aGWacVEF3IODjnc5Le/vCDz9R3mMQ+DLMCPmbz2ZfNO3tAhCyIRwWW1Slp/tfXd5WQrCI/ph3zZP+vmPyW6++IzsSffhpcHq0b+XSFs14HdiJWYAm3wKLT8D/8bYqUeTN4AYNPbAhHzdeSoA/eF3oHdFuVa3PNNFo+5BbaiAVh/hO/83H+8nDyBT0bYwk7wmThr0j8vtjlk4vliNHKRQM8sxPLBjPgANJoQ3w=", "txnId": "7eba5f7a-1948-497a-a074-29b5848ae514" }

I am getting the result as

{
“code”: “HIS-400”,
“message”: “Request is invalid. Please enter the correct data.”,
“details”: [
{
“message”: “Input OTP/PASSWORD must be encrypted form.”,
“code”: “HIS-1047”,
“attribute”: {
“key”: “otp”,
“value”: “V9GEF1ehqTzEQNZEzlsva5PEgv5QVDF+CWxB3bLLeDXhO+5rPd7zDGarFYKm3TrUFFyQwizcBgzQ2DQmyffpLUUM+GflpEFIpbJd1npbixA1L9G6xFU/6KmS0Cz/BjY9IP6BhZ5P97W+UwNl7N972T9EL/Fv9/LzajmrZucWZHKGlwDCGN1RhCXKr5lM1zSACfSHJ9IPXj17L/euHwEUy4vchbSeRtxgEz3l8jAOPfBWd5UzZQN/pMrpPECq4BDdptr922Y+zk5FHaSQi2hiS7Kg39gzfMYBz6Ilwp6LEjcI3po+l8YJ71VWUw4EGD6vG39c5Hh5tTECvwzvOywO/79+3MDk+x1ULqsEdqwDacfhnRBKd5yKKuh6JVy+XqKfw7Y4EoMjw7CrJithL3WMw651YAVP3jSR5XjBtq48afECkcMGx64YnodCy/gzSO9D+Pxsf4aGWacVEF3IODjnc5Le/vCDz9R3mMQ+DLMCPmbz2ZfNO3tAhCyIRwWW1Slp/tfXd5WQrCI/ph3zZP+vmPyW6++IzsSffhpcHq0b+XSFs14HdiJWYAm3wKLT8D/8bYqUeTN4AYNPbAhHzdeSoA/eF3oHdFuVa3PNNFo+5BbaiAVh/hO/83H+8nDyBT0bYwk7wmThr0j8vtjlk4vliNHKRQM8sxPLBjPgANJoQ3w=”
}
}
]
}ResponseCode: 400

I have encrypted using RSA the with public key provided in /v1/auth/cert api.

Is there any other algorithm for encryption or decryption? Can you provide the same>