Send a card, and find out whether its printed name, date of birth and number match the data UIDAI signed into its QR code. A mismatch is proof the document was altered — not a probability you have to set a threshold for.
Talk to our technical team → — for integration questions, accuracy benchmarks on your own documents, or a volume estimate.
Every other document check in this category returns a score. This one returns a fact.
curl -X POST https://api.maskaadhaar.com/api/v1/verify-document -H "X-API-Key: " -F "file=@aadhaar.jpg"
Full signal list and verdict semantics are in the API documentation.
{
"verdict": "fail",
"rationale": "The printed document
disagrees with the data UIDAI signed.",
"signals": [
{ "id": "qr_name_mismatch",
"severity": "high" }
]
}
The mechanism is worth understanding, because it is what separates a finding from a guess.
Every Aadhaar card issued since 2018 carries a Secure QR code. That QR is not a link or a lookup — it contains the holder's name, date of birth, gender and address, compressed, and digitally signed by UIDAI.
Someone altering a card changes the printed text. They cannot change the QR to match, because re-signing the payload requires UIDAI's private key. So the two disagree, and that disagreement is arithmetic rather than opinion.
Compare that with the usual approach. Image-forensics tamper detection — compression artefacts, error level analysis, font consistency — produces a probability. The probability needs a threshold. The threshold needs a labelled corpus of genuine and forged documents captured the way your customers capture them. Without that corpus the number is decoration, and a compliance officer asked to justify rejecting an applicant on a score of 0.83 has nothing to say.
A signature mismatch is different in kind. You can put it in front of an auditor, a regulator or the customer themselves and explain exactly what was checked and what it showed.
| Check | What it establishes |
|---|---|
| QR decoded | A Secure QR is present and its payload could be read |
| UIDAI signature | The payload is genuinely UIDAI's and has not been rewritten |
| Printed name vs signed name | The name on the card is the name UIDAI issued it to |
| Printed date of birth vs signed | The date has not been altered |
| Printed last four digits vs signed reference | Works on a masked card too, since the last four remain visible |
| Gender and pincode | Secondary fields, reported at medium severity |
| Aadhaar checksum | The printed number satisfies its own Verhoeff check digit |
Each returns a named signal with a severity. A high-severity signal fails the document; medium routes it to review. Nothing returns a score you have to interpret.
Stated here rather than discovered during your evaluation.
A Secure QR is 117–177 modules a side, and no decoder recovers the payload below roughly three pixels per module — we measured 1.8 failing and 3.0 succeeding. A WhatsApp-compressed card photo usually falls short. The response returns the measured density against the minimum, so you can ask the customer to re-photograph instead of guessing why it failed.
Provisioned per deployment. Until it is, the status is not_verified — never valid — and the verdict is capped at review however clean the cross-checks are, because a forger who replaces the entire QR produces a document that cross-checks perfectly.
Cards issued before the format arrived carry either a legacy XML QR or none at all. Those return review with the reason, not a pass. A check that cannot run is reported as not having run.
A verified card tells you the printed data matches what UIDAI signed. It does not tell you the person presenting it is its holder — that is authentication, which requires UIDAI registration as an authentication or KYC user agency. We say so rather than let the verdict imply more than it establishes.
The response says the printed name does not match the signed name. It does not return either name.
That is deliberate and it follows the same argument as the rest of this product. Handing back the demographics from the QR would make this an extraction endpoint by another route, and would put a full set of identity fields into a caller's logs and database whether or not they had any basis to hold them. What you need to act on is the disagreement, and the disagreement is what you get.
Verification is cheap and fast; the calls it protects are neither. Order matters.
One key, four endpoints, the same request shape throughout.
Verifying first is the point. A fail stops an application before you have spent
anything on it — before extraction, before storage, before whatever paid verification calls
sit further down your funnel. And a review is a queue item with a named reason a human
can act on in seconds, rather than an unexplained score they have to interpret.
The three endpoints after it are documented at Aadhaar OCR and Aadhaar masking. Where masking belongs in a pipeline, and why the archive copy matters, is covered in the KYC pipeline guide.
A tamper score is a probability derived from image forensics, and it needs a threshold calibrated against labelled forgeries in your own capture conditions. This is a cryptographic signature check: either the printed text matches what UIDAI signed or it does not. You can explain the result to an auditor.
Yes, and that is a useful property. The QR's reference identifier begins with the last four digits of the Aadhaar number — exactly the part a masked card still shows — so the last-four cross-check runs on a document that has already been redacted.
It returns review with the reason, never pass. Cards issued before the Secure QR format carry a legacy XML QR or none at all, and a check that could not run is reported as not having run rather than as a clean result.
The QR was located but captured below the density any decoder can read — under about three pixels per QR module. Upscaling cannot recover detail that was never captured. Re-photograph the card at higher resolution; in practice that means a card image around 2000 pixels wide.
No. It means the document is internally consistent with what UIDAI signed. Establishing that the presenter is the holder is authentication, which requires registration with UIDAI as an authentication or KYC user agency and is a different thing entirely.
Tell us your expected monthly volume and peak throughput and we will provision a key with a test quota, so you can benchmark accuracy on your own documents before committing.