An NBFC loan file collects an Aadhaar, a PAN, bank statements, a cancelled cheque and salary slips — then copies of that file travel to a co-lender, an auditor, a collections agency and a securitisation buyer. This API makes the documents safe to move before any of that happens.
Talk to our technical team → — for integration questions, a security review or a volume estimate.
Not at the point of collection — that part is usually well controlled. It leaks downstream, in the four places a copy of the loan file goes after onboarding is done and nobody is watching it any more.
/mask-aadhaar covers the first eight digits and leaves the last four readable — the form UIDAI recognises, so it still works as a KYC record. /extract-aadhaar reads name, DOB, gender and the masked number as JSON for your CRM, with the checksum validated so an OCR mis-read is caught rather than filed./mask-pan and /extract-pan. PAN is the identifier most often left readable because everyone concentrates on Aadhaar./redact-pii covers the account number and IFSC. Account numbers are off by default — nine to eighteen digits describes an invoice number equally well — so you enable that type only where you know the document./redact-pii again. It is document-agnostic, so it does not need to recognise the form to find the identifiers on it./bulk/mask-aadhaar or /bulk/anonymise takes the batch in one call and returns a ZIP with a manifest giving per-document status.The smallest change that removes the risk: one call between upload and storage. Nothing else in your pipeline moves.
/extract-aadhaar returns the fields as JSON. Check checksum_valid before you trust the number./mask-aadhaar returns the redacted document. Check X-Masked-Count is non-zero.Worked client code with retries and error branching is published for Python, Node.js and Java.
Yes. One REST call per document, or one call per batch. Send the PDF or image, get the same document back with the first eight digits of the Aadhaar number covered and the last four readable. Put the call between upload and storage and the unmasked file never becomes a stored object.
Yes. PDFs are processed page by page, so a scanned packet with the Aadhaar on page four and the PAN on page seven is handled in one call. The page is rasterised before the redaction is drawn, so the number is genuinely removed rather than covered.
No, and we are not licensed to. We are not an AUA or KUA. We read what is printed on the document, check the document's own signed QR where present, and redact identifiers. Authentication against the UIDAI database needs a licensed AUA.
Yes, and it is enforced rather than promised. Plans list the endpoints they include and a key calling anything else is refused with a 403. A masking-only plan genuinely cannot reach the extraction endpoints that return the number in the clear.
Quota and per-minute throughput are set per plan rather than per tier. Tell us your monthly volume and your peak — month-end and quarter-end spikes included — and we size both.
Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.