> ## Documentation Index
> Fetch the complete documentation index at: https://developer.eka.care/llms.txt
> Use this file to discover all available pages before exploring further.

# Health Data Received from HIP

Webhook event is sent when an external HIP pushes encrypted health data to your HIU.

The Health Information User (HIU) can initiate a consent request through the [Consent-API](https://developer.eka.care/api-sdk/hie-cm/consents/consent-create.md) to get care context data. Once consent is validated, the Health Information Provider (HIP) sends the encrypted health data to the HIU.

### Large pushes

A webhook has a size limit, and a single HIP push can be larger than that. Every entry therefore carries a `content_ref`, and when the webhook would be too large, `content` is sent as an empty string for some entries.

**What to do when you receive this webhook:**

1. For each entry in `data.entries`, check `content`.
2. If `content` is empty, fetch the entry with the [Fetch data push entry API](https://developer.eka.care/api-sdk/hie-cm/care-contexts/data-push-entry.md), passing `data.transaction_id` and the entry's `content_ref`.
3. Decrypt `content` with `key_information` and your private key, whether it came inline or from the API, and verify `checksum`.

> [!WARNING]
>
> An entry can be fetched for **15 minutes** after the webhook is sent. After that it is deleted and the API returns `404`, so fetch entries as soon as you receive the webhook.

> [!NOTE]
>
> We recommend fetching every entry through the [Fetch data push entry API](https://developer.eka.care/api-sdk/hie-cm/care-contexts/data-push-entry.md). Inline `content` may be removed from this webhook in a future version.

### Request

**Headers:**

* `Eka-Webhook-Signature`: `<Eka Webhook Signature>`  [Refer: Webhook Signature](https://developer.eka.care/docs/webhooks/webhook-signature.md)
* `Content-Type`: `application/json`

**Body:**

```json theme={null}
{
    "service": "abdm",
    "event": "abha.hiu_data_push",
    "event_time": 1749822309,
    "transaction_id": "<webhook transaction id>",
    "timestamp": 1749825214,
    "business_id": "<partner business id>",
    "client_id": "<partner client id>",
    "data": {
        "abha_address": "shyam@abdm",
        "abha_number": "",
        "hip_id": "<partner hip id>",
        "oid": "<eka user id>",
        "partner_patient_id": "<partner patient id>",
        "consent_id": "<string>",
        "transaction_id": "<string>",
        "entries": [
            {
                "care_context_id": "<string>",
                "checksum": "<string>",
                "content": "<string>",
                "media": "application/fhir+json",
                "content_ref": "<uuid>"
            }
        ],
        "key_information": {
            "crypto_alg": "<string>",
            "curve": "<string>",
            "dh_public_key": {
                "expiry": "<string>",
                "key_value": "<string>",
                "parameters": "<string>"
            },
            "nonce": "<string>"
        }
    }
}
```

### Field Descriptions

* **`data`**: Contains additional details related to the event.
  * **`consent_id`**: Consent id for the data transfer
  * **`transaction_id`**: Transaction id for the data flow. Use this one, not the top-level `transaction_id`, when calling the [Fetch data push entry API](https://developer.eka.care/api-sdk/hie-cm/care-contexts/data-push-entry.md).
  * **`entries`**: List of care contexts with encrypted fhir data
    * `care_context_id` The care context this entry belongs to.
    * `checksum` Checksum of the plain-text FHIR data, to verify after decryption.
    * `content` The encrypted FHIR data. Empty when the entry did not fit in the webhook; see [Large pushes](#large-pushes).
    * `media` Media type of the decrypted data, `application/fhir+json`.
    * `content_ref` Reference to fetch this entry with the [Fetch data push entry API](https://developer.eka.care/api-sdk/hie-cm/care-contexts/data-push-entry.md). Always present. Valid for 15 minutes after the webhook is sent.
  * **`key_information`** : Contains the cryptographic key material and related parameters required for secure ECDH-based key exchange between HIU and HIP.
    * `crypto_alg` The cryptographic algorithm used for key exchange (e.g., "ECDH").
    * `curve` The elliptic curve used in ECDH key generation (e.g., "Curve25519", "P-256").
    * `dh_public_key` Object containing the HIP's (sender's) public key and related metadata:
      * `expiry` The expiration timestamp (in ISO 8601 format) indicating how long the public key is valid.
      * `parameters` Additional parameters related to the ECDH key (optional or curve-specific).
      * `key_value` The base64-encoded public key value generated by the HIP (the sender).
    * `nonce` A 32-byte random nonce (Base64-encoded) generated by the HIP (the sender), used to ensure uniqueness in the session key derivation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.