API Integration Guide

PAN Mitra e-KYC PAN APIs

Technical documentation for API partners and developers integrating instant PAN applications through e-KYC and e-Sign.

API Base https://api.instantpanmitra.com Version Updated 2026

Introduction

This document describes the PAN Mitra e-KYC PAN APIs, which allow partners to submit PAN applications (new PAN and changes/corrections) through the e-KYC and e-Sign channels, and to track their status.

Integration Flow

Get Authorization — Call the Get Authorization API with the applicant's details to receive an authorization token (Section 2).
Redirect to PAN Application Portal — Redirect the applicant's browser to the PAN application portal URL with the authorization token (Section 3).
Receive the Application Response — After the application is completed, encrypted data is sent to your redirect_url using the GET method. Decrypt it using AES-256-CBC (Section 4, Section 8, Section 9).
Callback — Receive a POST request on your callback URL whenever the transaction status is updated (Section 7).
Check Status — Query the Transaction Status and PAN Status APIs at any time (Section 5, Section 6).

API Summary

Method	Endpoint	Purpose
POST	`https://api.instantpanmitra.com/api/nsdl/get_authorization`	Generate the authorization token for a PAN application
GET	`https://sso-nsdl-ekyc-app.pages.dev/sso_nsdl_ekyc_redirect`	Redirect the applicant to the PAN application portal (client browser)
GET	`{redirect_url}?encrypted_data=...`	Encrypted PAN application response sent to the partner
POST	`/api/nsdl/txn_status`	Fetch transaction status
POST	`/api/nsdl/pan_status`	Fetch PAN status using the acknowledgement number
POST	`{partner callback URL}`	Callback sent to the partner on status update

Conventions

All request and response bodies use JSON with Content-Type: application/json.
In parameter tables, Y in the Mandatory column marks a mandatory parameter.
Values shown in {{double braces}} are placeholders to be replaced with actual values.

1Authentication

The partner sends HTTP requests with an Authorization header that contains the word Basic, followed by a space and a Base64-encoded string username:password. For example, to authorise as clientID / clientSecret, the client would send:

HTTP Header

Username == {{clientID}}
Password == {{clientSecret}}

Authorization: Basic VEVTVDAxOlBhc3N3b3JkQDEyMw==

Note: The clientID and clientSecret are issued by PAN Mitra. Keep them confidential and never expose them in client-side (browser or mobile app) code.

2Get Authorization API

POSThttps://api.instantpanmitra.com/api/nsdl/get_authorization

Request Headers

Parameter	Mandatory	Description	Sample Values
`Content-Type`	Y	–	`application/json`
`Authorization`	Y	–	`Basic TWpSRWhQOEZ5Z2J2NUhUNFl0ekhPQnRmVUhXallBRGI6dyw4SSYpUnk2a0QlYDRY`

Request Body (JSON)

Request Body

{
  "application_mode":"EKYC",
  "application_type":"49A",
  "category":"P",
  "branch_code":" user Mobile ",
  "name":"JOHN ALEX",
  "gender":"M",
  "mobile":"9999999999",
  "email":"[email protected]",
  "is_physical_pan_required":"Y",
  "consent":"Y",
  "redirect_url":"yourdomain.com",
  "p_order_id":"P1234567890"
}

Request Parameters

Parameter	Mandatory	Description	Sample Values
`application_mode`	Y	PAN application mode: EKYC = Instant PAN application through the e-KYC method ESIGN = Scan-based PAN application	String `"EKYC"` `"ESIGN"`
`application_type`	Y	PAN application form type: 49A = PAN – Indian Citizen (Form 49A) CR = Changes / Correction / Reprint PAN application	String `"49A"` `"CR"`
`category`	Y	Category of the applicant: P = Individual	String `"P"`
`branch_code`	–	Unique code of each agent	String `"NSDL9632456111"`
`name`	Y	Name of the PAN applicant	`"JOHN ALEX"`
`gender`	Y	Gender of the PAN applicant	String `"M"` `"F"` `"T"`
`mobile`	Y	Mobile number of the PAN applicant, to which the confirmation SMS will be sent	10-digit valid Indian mobile number `"9999888800"`
`email`	Y	Email address of the PAN applicant, to which the acknowledgement receipt and e-PAN will be sent	Valid email address `"[email protected]"`
`is_physical_pan_required`	Y	Y = Both physical PAN and e-PAN N = e-PAN only	String `"Y"` `"N"`
`consent`	Y	The PAN applicant must accept the following consent: “I have no objection in authenticating myself and fully understand that information provided by me shall be used for authenticating my identity through Aadhaar Authentication System for the purpose stated above and no other purpose.”	String `"Y"`
`redirect_url`	Y	The partner's own URL, to which the PAN application response will be sent using the GET method	String `"https://www.yourdomain.com/pan_response"`
`p_order_id`	Y	Unique random order ID generated by the partner system	Alphanumeric Min. length = 10 Max. length = 35

Response (JSON)

Response

{
  "status":"SUCCESS",
  "message":"Transaction Successful",
  "data":{
    "order_id":"T75415039062500HJVQV",
    "p_order_id":"P1234567899",
    "authorization":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiMjkwMyIsImFwcGxpY2F0aW9uX3R5cGUiOiI0OUEiLCJjYXRlZ29yeSI6IlAiLCJuYW1lIjoiSk9ITiBBTEVYIiwiZG9iIjoiIiwiZ2VuZGVyIjoiTSIsIm1vYmlsZSI6Ijk5OTk5OTk5OTkiLCJlbWFpbCI6ImpvaG5hbGV4QGdtYWlsLmNvbSIsImlzX3BoeXNpY2FsX3Bhbl9yZXF1aXJlZCI6IlkiLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3d3dy5pbnN0YW50cGFubWl0cmEuY29tL2FwaS9uc2RsX3Jlc3BvbnNlL000WngxM1J3Z0wiLCJvcmRlcl9pZCI6Ik5TREw2Mzg2NzE4NzUwMDAwMEdWVUpQIiwicF9vcmRlcl9pZCI6IlQ3NTQxNTAzOTA2MjUwMEhKVlFWIiwiaWF0IjoxNjU0MjM1Mjg3LCJleHAiOjE2NTQzMjE2ODd9.3TGK3qWrTJpwlZVw3UfwOTrOr98va9Sn8wDuUj9ShTg"
  }
}

Response Parameters

Parameter	Description	Sample Values
`status`	Status of the request	`"SUCCESS"` `"ERROR"` `"FAILED"`
`order_id`	Unique order ID generated by our (PAN Mitra) system	–
`p_order_id`	Unique random order ID generated by the partner system	–
`authorization`	Authorization token to be passed in the redirect URL (Section 3)	–

3Redirect to PAN Application Portal

After a successful Get Authorization call, redirect the applicant's browser to the PAN application portal using the URL below.

GET (Client Browser)https://sso-nsdl-ekyc-app.pages.dev/sso_nsdl_ekyc_redirect

Redirect URL

https://sso-nsdl-ekyc-app.pages.dev/sso_nsdl_ekyc_redirect?is_incomplete={{true/false}}&type={{application_type}}&authorization={{authorization}}

Query Parameters

Parameter	Description
`type` (application_type)	49A = PAN – Indian Citizen (Form 49A) CR = Changes or Correction in existing PAN Data / Reprint of PAN Card (No changes in existing PAN Data)
`is_incomplete`	true = For an incomplete PAN application
`authorization`	The `authorization` value received in the Get Authorization API response (Section 2)

4PAN Application Response

We will send encrypted data using the GET method to the partner's redirect URL, which was provided at the time of authorization generation. Partners need to decrypt the encrypted data using the AES-256-CBC algorithm. A sample PHP decryption script is provided in Section 8.

GET (Client Browser)https://www.yourdomain.com/pan_response

Sample Request URL

Redirect URL with encrypted_data

https://www.yourdomain.com/pan_response?encrypted_data=U2FsdGVkX18XZq6Jkuy6xvNl4K+h2c0GbunyENq3XNnRAIiYDYUgqMGQDUAKOxz2GN6QCr23adbabLsywnNWCo3tSeCJexKRglWYVbpXX/w/xeWDEW1Mv/vePiorW5knauYv1WJBcCZSKu+QlTHxD8X+70U1rTI4Q4P/OCrY4pU5k3B+WGeJ/0Y7NVXwT4fTzYQMqAaHkSsIodUrR6bLwFbu087ffrBpTwx28G1PZQ3uxvibrruPtUdmcztAWye2GKaemDCS6Brt6ivkByR7zJtS54BZ5BC1WDS2LErPlXMbbVH1Rorf/1QTGGRJCg3TDP68pCjRLtBua09HqoRWYLlWZHMvLTOFFm0VFQ6LWMI=

Sample JSON After Decrypting the Encrypted Data

Decrypted Data

{
  "status":"SUCCESS",
  "message":"Transaction Successful",
  "data":{
    "order_id":"T21801757812500OTBDB",
    "p_order_id":"P65942382812500FKJUH",
    "ack_no":"990019703030190",
    "error_message":"null",
    "date":"2022-06-03 11:45:22"
  }
}

Response Parameters

Parameter	Description	Sample Values
`status`	Status of the transaction	`"SUCCESS"` `"ERROR"` `"FAILED"` `"REFUND"`
`order_id`	Unique order ID generated by our (PAN Mitra) system	–
`p_order_id`	Unique random order ID generated by the partner system	–
`ack_no`	Acknowledgement number of the PAN application	–
`error_message`	Error message if the transaction failed	–

5Transaction Status API

POST/api/nsdl/txn_status

Request Headers

Parameter	Mandatory	Description	Sample Values
`Content-Type`	Y	–	`application/json`
`Authorization`	Y	–	`Basic TWpSRWhQOEZ5Z2J2NUhUNFl0ekhPQnRmVUhXallBRGI6dyw4SSYpUnk2a0QlYDRY`

Request Body (JSON)

Request Body

{
  "order_id":"T45312500000000OQJTO"
}

Request Parameters

Parameter	Mandatory	Description	Sample Values
`order_id`	Y	Partner system order ID or our (PAN Mitra) system order ID	–

Response (JSON)

Response

{
  "status":"SUCCESS",
  "message":"Transaction Details Fetched Successfully",
  "data":{
    "txn_status":"SUCCESS",
    "txn_description":"Transaction Successful",
    "order_id":"T45312500000000OQJTO",
    "p_order_id":"P22154452554",
    "err_msg":"",
    "ack_no":"990019703030595",
    "order_amount":107,
    "txn_type":"DR",
    "opening_bal":123,
    "txn_amount":101,
    "closing_bal":22,
    "timestamp":"2022-06-03 10:59:15"
  }
}

Response Parameters

Parameter	Description	Sample Values
`status`	Status of the request	`"SUCCESS"` `"ERROR"`
`txn_status`	Status of the PAN application	`"SUCCESS"` `"FAILED"` `"REFUND"` `"ERROR"`
`ack_no`	Acknowledgement number of the PAN application	`"990019703030595"`
`err_msg`	Reason for transaction failure	–

6PAN Status API

POST/api/nsdl/pan_status

Request Headers

Parameter	Mandatory	Description	Sample Values
`Content-Type`	Y	–	`application/json`
`Authorization`	Y	–	`Basic TWpSRWhQOEZ5Z2J2NUhUNFl0ekhPQnRmVUhXallBRGI6dyw4SSYpUnk2a0QlYDRY`

Request Body (JSON)

Request Body

{
  "ack_no":" 990019703030595"
}

Request Parameters

Parameter	Mandatory	Description	Sample Values
`ack_no`	Y	Acknowledgement number of the PAN application	–

Response (JSON)

Response

{
  "status":"SUCCESS",
  "message":"SUCCESS",
  "data":{
    "pan_status":"Application is processed and PAN generated",
    "pan":"BL****613B"
  }
}

Response Parameters

Parameter	Description	Sample Values
`status`	Status of the request	`"SUCCESS"` `"ERROR"`
`pan_status`	Status of the PAN application	–
`pan`	PAN allotted by the Income Tax Department (shown masked)	–

7Callback Response

Partners need to provide a callback URL on their system. We will send a request with the following parameters once the transaction status is updated at the service provider's end.

POSThttps://www.yourdomain.com/response

Request Method: POST · Sample URL: https://www.yourdomain.com/response

Sample Request Data (JSON)

Callback Payload

{
  "status":"SUCCESS",
  "message":"Transaction Successful",
  "data":{
    "order_id":"NSDL14379882812500EFNFG",
    "p_order_id":" P1234567899",
    "ack_no":"990019703030190",
    "error_message":"null"
  }
}

Parameters

Parameter	Description	Sample Values
`status`	Status of the transaction	`"SUCCESS"` `"ERROR"` `"FAILED"` `"REFUND"`
`order_id`	Unique order ID generated by our (PAN Mitra) system	–
`p_order_id`	Unique random order ID generated by the partner system	–
`ack_no`	Acknowledgement number of the PAN application	–
`error_message`	Error message if the transaction failed	–

8PHP Script for Decryption (AES-256-CBC)

We will provide the encryption key, which must be passed as the passphrase at the time of decryption.

decrypt.php

<?php

function decrypt($encrypted, $passphrase)
{
    $encrypted = base64_decode($encrypted);
    $salted    = substr($encrypted, 0, 8) == 'Salted__';

    if (!$salted) {
        return null;
    }

    $salt      = substr($encrypted, 8, 8);
    $encrypted = substr($encrypted, 16);

    $salted = $dx = '';
    while (strlen($salted) < 48) {
        $dx = md5($dx . $passphrase . $salt, true);
        $salted .= $dx;
    }

    $key = substr($salted, 0, 32);
    $iv  = substr($salted, 32, 16);

    return openssl_decrypt($encrypted, 'aes-256-cbc', $key, true, $iv);
}

?>

9Node.js Sample Code for Decryption

Node.js partners can use the aes-everywhere package with the encryption key provided by us.

decrypt.js

var AES256 = require('aes-everywhere');
// or
// import AES256 from 'aes-everywhere';

// encryption
var encrypted = AES256.encrypt('TEXT', 'PASSWORD')
console.log(encrypted);

// decryption
console.log(AES256.decrypt(encrypted, 'PASSWORD'));

10Postman Examples

The following screenshots show a sample Get Authorization request and response in Postman.

Postman - request body and response — Figure 1 — Get Authorization API: request body and successful response

Postman - Basic Auth configuration — Figure 2 — Get Authorization API: Basic Auth configuration

11Service Modes & Delivery Timelines

PAN applications can be submitted in two modes, selected using the application_mode parameter of the Get Authorization API (Section 2).

e-KYC Mode

application_mode = "EKYC"

New e-PAN delivery: 1–3 days
Correction e-PAN delivery: 5–15 working days
Authentication: Aadhaar OTP or biometric
PAN photo: Taken automatically from Aadhaar
Signature: Remains blank — the applicant signs manually after receiving the physical PAN card
Date of Birth proof: Separate government-issued DOB proof required (other than Aadhaar)

e-Sign Mode

application_mode = "ESIGN"

New e-PAN delivery: 1–2 days
Correction e-PAN delivery: 15–20 working days
Authentication: Aadhaar OTP or biometric
Document upload: Applicant photo, signature and Aadhaar can be uploaded
PAN photo & signature: Printed as per the uploaded files
Date of Birth proof: Separate government-issued DOB proof required (other than Aadhaar)

Quick Comparison

Feature	e-KYC Mode	e-Sign Mode
New e-PAN delivery	1–3 days	1–2 days
Correction e-PAN delivery	5–15 working days	15–20 working days
Authentication	Aadhaar OTP or biometric	Aadhaar OTP or biometric
PAN photo	Taken automatically from Aadhaar	As per uploaded photo
Signature on PAN	Blank — signed manually after receiving the physical PAN	As per uploaded signature
Separate DOB proof (other than Aadhaar)	Required	Required

₹

Automatic Refund Facility

Failed or incomplete PAN applications are eligible for an automatic refund within 4–6 hours, subject to the transaction status. Refunds are reported with the status REFUND in the Transaction Status API (Section 5) and the Callback (Section 7).

Delivery timelines are indicative and depend on processing by the PAN service provider and the Income Tax Department.