KYC OCR API

The whole folder, as fields

A customer sends four documents and somebody opens all four. This turns them into JSON your systems can act on — name, date of birth, gender, address — in the conditions documents actually arrive in: a phone photo, a rotated scan, a WhatsApp-compressed forward.

Talk to our technical team → — for integration questions, a security review or a volume estimate.

What comes back

The fields a customer record actually needs, and nothing invented to fill a gap.

name
As printed. Not normalised, not case-folded — you may need to match it against something that was also printed.
aadhaar_number
Masked. aadhaar_last4 comes separately so nothing has to parse the mask off.
date_of_birth
ISO YYYY-MM-DD, or null. Older cards carry only a year; then year_of_birth is set instead.
gender
M, F or O. Never the printed string passed through.
address
full and pincode. Deliberately not split further — see below.
checksum_valid
The Verhoeff check. false means digits were read but do not form a valid Aadhaar number — a read failure, not a number.

Three decisions worth knowing about

Warnings are named, never scored: low_contrast, single_side_only, rotated_input, partial_address, year_of_birth_only. A reviewer can act on a name in seconds. Nobody can act on a confidence of 0.71.

Reading is not believing

OCR tells you what a document says. It does not tell you whether the document is what it claims to be — a well-made forgery reads perfectly, and a checksum_valid of true only means twelve digits form a structurally valid Aadhaar number, not that they belong to the person on the card.

Aadhaar is the one Indian document where belief can be proved rather than estimated, because UIDAI signs the QR payload and a forger cannot re-sign it. Document verification is that check, and it is worth running before extraction: a failure there stops an application before you have spent anything on it.

Questions we get asked

Why does the Aadhaar number come back masked?

Because most integrations do not need it, and a full Aadhaar number in a JSON response ends up in application logs, error trackers and database backups that were never designed to hold one. The last four digits are returned separately as aadhaar_last4 so you do not have to parse the mask off.

Why is the address not split into components?

Aadhaar addresses are not consistently structured. A blind split is wrong often enough that the caller cannot tell which results to trust, and components that are wrong a fifth of the time are worse than one honest string. The address comes back as full plus pincode, with a partial_address warning when the read was not confident.

What happens on a year-only card?

date_of_birth is null and year_of_birth is set. A fabricated 01-01 that looks like a real date is worse than an absent one, so the API never synthesises it.

Does a successful read mean the document is genuine?

No. OCR tells you what a document says, not whether to believe it. Verification against the signed QR is a separate question with a separate endpoint.

Related

Talk to us about your document volume

Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.