Send a JPG, PNG or PDF. Get the same document back with the first eight digits of the Aadhaar number blacked out and the last four left readable. Built for KYC and document pipelines at banks, NBFCs, housing finance companies and fintechs.
Synchronous and stateless — no job IDs, no polling, no webhook to configure, no SDK to install.
One multipart request carrying a JPG, PNG or PDF of the Aadhaar card.
Server-side OCR scans every orientation, and each candidate is checked against the Aadhaar checksum.
The masked document is the response body, with a header telling you how many regions were covered.
The masked file is returned directly in the response body, so there is nothing to poll and no second call to fetch a result.
curl -X POST \ https://api.maskaadhaar.com/api/v1/mask-aadhaar \ -H "X-API-Key: $MASKAADHAAR_KEY" \ -F "file=@aadhaar.jpg" \ --output aadhaar_masked.jpg
Full reference with Python and Node.js examples, error codes and rate limits is in the API documentation.
Every response reports what actually happened, so your pipeline can branch on it rather than assuming.
| Header | Meaning |
|---|---|
X-Masked-Count | Regions redacted. Zero means nothing was found — treat that as a failure. |
X-Quota-Used | Documents consumed this month |
X-Quota-Remaining | Documents left this month |
If the number cannot be read — glare on a laminated card, a fold through the digits — the original document is returned with a count of zero rather than the request failing outright. That keeps a customer's onboarding from breaking on a shaky photograph, but it means a 200 status is not by itself proof of masking.
Masking is easy to get almost right. These are the specific cases that separate a working implementation from one that quietly leaks.
UIDAI printouts carry both sides of the card on one page, often with one card rotated ninety degrees. Every orientation is scanned rather than stopping at the first number found — the shortcut that leaves a rotated card fully readable while still reporting success.
Aadhaar numbers carry a Verhoeff check digit. Validating it means the sixteen-digit Virtual ID printed below the number, dates of birth and enrolment numbers are not mistaken for Aadhaar numbers and are left readable.
Field officers submit phone photographs at angles, under tube lights, of folded printouts. Detection tolerates skew and glare, and where digits are physically unreadable the mask is extrapolated from the readable side of the card.
Requests are served from AWS ap-south-1. For an Indian lender answering a data-residency question, processing stays in-country.
Documents are processed in memory and streamed back in the response. No copy is written to a database or object store. The OCR engine writes a short-lived temporary file during processing, removed when the request completes — so the accurate claim is not persisted, rather than never touches disk.
Only a SHA-256 hash of your API key is stored, so a breach of our database yields no working credentials. Keys are revocable immediately, and each request is rate limited per key rather than per IP.
The same interface, for Permanent Account Numbers. ABCDE1234F becomes ABxxxxxxxF, keeping the first two and last character visible for reference.
curl -X POST https://api.maskaadhaar.com/api/v1/mask-pan \ -H "X-API-Key: $MASKAADHAAR_KEY" \ -F "file=@pan.jpg" \ --output pan_masked.jpg
The browser-based Aadhaar tool runs the same detection logic entirely on your own machine, with no upload at all. It is the fastest way to see how masking behaves on your own difficult documents — a folded printout, a two-sided scan, a photograph with glare — before writing any integration code.
When you are ready, the API documentation has the endpoint reference and examples, and the integration guide covers the parts that cause incidents in production.
Quota is consumed when a document is successfully processed and returned. A rejected request costs nothing:
| Outcome | Counts against quota? |
|---|---|
401 invalid or missing API key | No |
413 file larger than your plan allows | No |
422 unsupported file type | No |
429 rate limited or quota exhausted | No |
500 processing failed on our side | No |
200 document processed and returned | Yes |
One case deserves stating plainly rather than hiding in the small print: if the document is
processed but no number could be read — heavy glare, a fold through the digits — it
returns 200 with X-Masked-Count: 0, and that does count,
because the OCR work was done. It is rare on legible documents. Check the header and route those
to review rather than storing them as masked.
Every request is also recorded with its status code and processing time, so a disputed month can be reconciled line by line.
Tell us your expected monthly document volume and peak throughput. We will size a plan, issue a key and give your team a test quota to validate output against your own documents before any commitment.
JPG, JPEG, PNG and PDF. Multi-page PDFs are scanned page by page. The masked document is returned in the input format by default; pass output_format as pdf or jpg to override.
Candidate numbers are validated against the Verhoeff checksum that Aadhaar uses. A sixteen-digit VID contains five overlapping twelve-digit windows and almost all of them fail the checksum, so the VID, date of birth and enrolment number stay readable. If a masking tool blacks those out, it is pattern-matching without validating.
No. Documents are processed in memory and streamed back in the response, with no copy written to a database or object store. The OCR engine writes a short-lived temporary file to local disk during processing which is removed when the request completes. Processing runs in AWS Mumbai (ap-south-1).
Read the X-Masked-Count response header. If the Aadhaar number could not be read, the original document is returned unchanged with a count of zero and a 200 status — so a successful status code alone is not proof of masking. Route those documents to manual review.
Yes, including the common layout where one card is rotated ninety degrees relative to the other. Every orientation is scanned rather than stopping at the first number found, which is the failure mode that leaves a rotated card unmasked.
Masking is CPU-bound OCR work, so sustained throughput depends on provisioned capacity rather than a fixed ceiling. Tell us your peak requests per minute and we will size for it and confirm during the technical evaluation.
We provision a test quota with every evaluation so your team can validate output quality against your own documents before committing. The browser tools are free and unlimited to try, with no account required.