Health Data Received from HIP

​

Large pushes

1. For each entry in data.entries, check content.
2. If content is empty, fetch the entry with the Fetch data push entry API, passing data.transaction_id and the entry’s content_ref.
3. Decrypt content with key_information and your private key, whether it came inline or from the API, and verify checksum.

​

Request

• Eka-Webhook-Signature: <Eka Webhook Signature> Refer: Webhook Signature
• Content-Type: application/json

{
    "service": "abdm",
    "event": "abha.hiu_data_push",
    "event_time": 1749822309,
    "transaction_id": "<webhook transaction id>",
    "timestamp": 1749825214,
    "business_id": "<partner business id>",
    "client_id": "<partner client id>",
    "data": {
        "abha_address": "shyam@abdm",
        "abha_number": "",
        "hip_id": "<partner hip id>",
        "oid": "<eka user id>",
        "partner_patient_id": "<partner patient id>",
        "consent_id": "<string>",
        "transaction_id": "<string>",
        "entries": [
            {
                "care_context_id": "<string>",
                "checksum": "<string>",
                "content": "<string>",
                "media": "application/fhir+json",
                "content_ref": "<uuid>"
            }
        ],
        "key_information": {
            "crypto_alg": "<string>",
            "curve": "<string>",
            "dh_public_key": {
                "expiry": "<string>",
                "key_value": "<string>",
                "parameters": "<string>"
            },
            "nonce": "<string>"
        }
    }
}

​

Field Descriptions

• data: Contains additional details related to the event.
  • consent_id: Consent id for the data transfer
  • transaction_id: Transaction id for the data flow. Use this one, not the top-level transaction_id, when calling the Fetch data push entry API.
  • entries: List of care contexts with encrypted fhir data
    • care_context_id The care context this entry belongs to.
    • checksum Checksum of the plain-text FHIR data, to verify after decryption.
    • content The encrypted FHIR data. Empty when the entry did not fit in the webhook; see Large pushes.
    • media Media type of the decrypted data, application/fhir+json.
    • content_ref Reference to fetch this entry with the Fetch data push entry API. Always present. Valid for 15 minutes after the webhook is sent.
  • key_information : Contains the cryptographic key material and related parameters required for secure ECDH-based key exchange between HIU and HIP.
    • crypto_alg The cryptographic algorithm used for key exchange (e.g., “ECDH”).
    • curve The elliptic curve used in ECDH key generation (e.g., “Curve25519”, “P-256”).
    • dh_public_key Object containing the HIU’s public key and related metadata:
      • expiry The expiration timestamp (in ISO 8601 format) indicating how long the public key is valid.
      • parameters Additional parameters related to the ECDH key (optional or curve-specific).
      • key_value The base64-encoded public key value generated by the HIU.
    • nonce A 32-byte random nonce (Base64-encoded) generated by the HIU, used to ensure uniqueness in the session key derivation.