Milestone 4 — NHPR (HPR & HFR)

Register health professionals and facilities in the National Healthcare Providers Registry — setup, the two-token model, encryption, and links to the full API flows.

Milestone 4 integrates your product with the National Healthcare Providers Registry (NHPR) — the trusted registry of verified health professionals (HPR) and health facilities (HFR). After M4 you can create HPR IDs for doctors, nurses and pharmacists, register their qualifications, and onboard facilities — all from inside your own software.

flowchart LR
  A["Create / find an<br/>HPR ID"] --> B["Log in →<br/>HPR user token"]
  B --> C["Register the<br/>professional"]
  B --> D["Onboard the<br/>facility (HFR)"]
  C --> E["NHPR<br/>verified registry"]
  D --> E
  D --> F["facilityId = your HIP ID<br/>(link bridges)"]

This guide is split into three flows

M4 is large. This page covers the shared setup — prerequisites, base URL, the two-token model, and encryption. Each registry flow lives on its own page:

HPR ID & Authentication

Create an HPR ID from Aadhaar, find an existing one, and log in to obtain the HPR user token every write needs.

Professional Registration

Facility Registry (HFR)

Search & de-duplicate, run the four-stage facility onboarding wizard, link bridges, and verify facility contacts.

Prerequisites

M1–M3 first

NHA opens Milestone 4 only to integrators who have completed Milestones 1–3. Your sandbox client-id must additionally be assigned the HPID, HPR and HFR roles by the NHA team before these APIs will authorize.

Sandbox client credentials with HPID + HPR + HFR roles (request via the NHPR team — see Certification).
The NHPR sandbox portal for manual/first-time steps: hspsbx.abdm.gov.in (production: nhpr.abdm.gov.in).
A UIDAI test Aadhaar (sandbox) whose linked mobile you control, to complete Aadhaar OTP flows.

Base URL & API references

Every M4 (HSP/NHPR) API is served from the HSP sandbox host:

https://apihspsbx.abdm.gov.in/v4/int

Spec	Swagger group	Covers
HPID	HPR ID	Aadhaar registration, login/auth, account, search
HPR	Professional registry	Professional register/fetch/update, documents, masters
HFR	Facility registry	Facility onboarding, search, LGD/master data, bridges

Browse them interactively at the HSP Swagger UI.

Community docs — verify against Swagger

This is community-maintained documentation built from the official NHPR PDFs (dated 2026) and cross-checked against the live HSP Swagger. Where the PDF and Swagger disagree, the flow shown here follows the PDF and a callout flags the difference — always confirm the exact contract against the Swagger group above before you ship.

The two-token model

Almost every M4 problem is a token problem. There are two different tokens, and they are not interchangeable:

Token	What it is	How you get it	Sent as
System / gateway token	Your application's service token	HIE-CM gateway session (below)	`Authorization: Bearer <token>` on every call
HPR user token	The end user's (professional / facility manager) HPR login session	HPR auth — password, mobile OTP, or Aadhaar OTP (see HPR ID & Auth)	`x-hprid-auth` header, or `hprToken` / `hpr_token` in the body — depends on the endpoint

Bearer + a space

ABDM requires the literal token type prefix. The header value is Bearer, then a space, then the access token: Authorization: Bearer eyJhbGc.... A missing space is the most common 401.

Get the system token

The system token is a standard v3 gateway session. Request it from the HIE-CM gateway and reuse the accessToken on all HSP calls:

POST/api/hiecm/gateway/v3/sessions

Returns the accessToken used as Authorization: Bearer <accessToken> on every HSP/NHPR API. See Authentication for the full gateway session contract.

cURL

curl -X POST "https://dev.abdm.gov.in/api/hiecm/gateway/v3/sessions" \
-H "Content-Type: application/json" \
-H "REQUEST-ID: $(uuidgen)" \
-H "TIMESTAMP: $(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
-H "X-CM-ID: sbx" \
-d '{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "grantType": "client_credentials"
}'

Response

{
"accessToken": "eyJhbGciOiJSUzUxMiJ9...",
"expiresIn": 1200,
"refreshExpiresIn": 0,
"tokenType": "bearer"
}

Request headers

Unlike the HIE-CM gateway, the HSP APIs do not require REQUEST-ID / TIMESTAMP / X-CM-ID. They use:

Header	Value	When
`Authorization`	`Bearer <system token>`	Every request
`Content-Type`	`application/json`	Every request with a body
`x-hprid-auth`	The end user's HPR login token	HFR `basic-information` & `submit-facility` (required); some HPR writes

Professional register/update and the email/mobile verification APIs instead carry the user token in the body as hprToken / hpr_token.

Data encryption

Sensitive fields are RSA-encrypted before they go into any request body — Aadhaar number, OTP, mobile number, email, and password.

Fetch the public certificate

GET/api/v1/auth/cert

Returns the PEM public key. Cache it and reuse it for the session.

cURL

curl "https://apihspsbx.abdm.gov.in/v4/int/api/v1/auth/cert" \
-H "Authorization: Bearer $SYSTEM_TOKEN"

Response

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6avEoNMbZDtjs7RHc1Si
...
5QIDAQAB
-----END PUBLIC KEY-----

Encrypt the field

Encrypt with the public key using RSA/ECB/PKCS1Padding, algorithm RS512, and base64-encode the output. The base64 string is what you put in the request body.

Quick test

ABDM's guides reference the devglan RSA tool for manual encryption while testing. In code, use your platform's standard RSA primitives — see Data Encryption for Node/Python/Java examples.

Certification workflow

M4 certification is run by the NHPR team (separate from the M1–M3 HIE-CM track):

Implement the NHPR test cases

Work through the M4 test cases published in the sandbox Test Cases document — HPR ID creation, professional registration, and facility onboarding from within your application.

Functional testing with the NHPR team

Write to the NHPR integration team — abdm.texp1@nha.gov.in (HPR) and facility.abdm@nha.gov.in (HFR) — to schedule a functional demonstration of the flows in your product.

Submit a video recording of the end-to-end flows with your test results to NHA for review.

Security assessment

Provide your security certification (VAPT report) as required for production onboarding.

Role assignment

On approval, NHA assigns the HPID / HPR / HFR roles to your production client-id and you go live against nhpr.abdm.gov.in.

HPR ID & Authentication

Start here — create or find an HPR ID and log in for the user token.

HPR & HFR Registries

What the registries are and why they anchor trust in ABDM.

Authentication

v3 gateway sessions and the headers every call needs.

Data Encryption

The RSA scheme used for Aadhaar, OTP, mobile, email and password fields.

Sources

ABDM NHPR — Register Professional & Create HPR ID (v2.0, 22-06-2026)
ABDM NHPR — Fetch / Update Professional, Update Documents
ABDM NHPR — Email Verify, Mobile OTP
ABDM NHPR — Search Facility & Find HPRID by Aadhaar
ABDM HFR — Facility Onboarding Documentation (updated 08-04-2026)
HSP Swagger — https://apihspsbx.abdm.gov.in/v4/int/swagger-ui-ext/index.html (HPID, HPR, HFR OpenAPI specs)

PreviousMilestone 3 — HIU Next M4 · HPR ID & Authentication