Encrypt Data

Encrypt data using ECDH key exchange.

This API encrypts plaintext health data using ECDH shared secret derivation. A shared secret is derived from the sender’s private key and the receiver’s public key. The IV and salt are computed from the XOR of sender and receiver nonces, and the data is encrypted using AES-256-GCM.

Algorithm details:

• Key Agreement: ECDH on Curve25519 (Weierstrass form)
• Key Derivation: HKDF-SHA256
• Symmetric Encryption: AES-256-GCM
• Nonce Handling: IV and salt are derived from XOR of sender and receiver nonces

The response includes the base64-encoded encrypted data and the public key material to share with the receiver.

For more details, refer to the ABDM Encryption and Decryption Guide.

POST /abdm/v1/ecdh/encrypt

cURL

cURL

curl --request POST \
  --url https://api.eka.care/abdm/v1/ecdh/encrypt \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "plain_text_data": "<string>",
  "receiver_nonce": "<string>",
  "receiver_public_key": "<string>",
  "sender_nonce": "<string>",
  "sender_private_key": "<string>",
  "sender_public_key": "<string>"
}
'

import requests

url = "https://api.eka.care/abdm/v1/ecdh/encrypt"

payload = {
    "plain_text_data": "<string>",
    "receiver_nonce": "<string>",
    "receiver_public_key": "<string>",
    "sender_nonce": "<string>",
    "sender_private_key": "<string>",
    "sender_public_key": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    plain_text_data: '<string>',
    receiver_nonce: '<string>',
    receiver_public_key: '<string>',
    sender_nonce: '<string>',
    sender_private_key: '<string>',
    sender_public_key: '<string>'
  })
};

fetch('https://api.eka.care/abdm/v1/ecdh/encrypt', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.eka.care/abdm/v1/ecdh/encrypt",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'plain_text_data' => '<string>',
    'receiver_nonce' => '<string>',
    'receiver_public_key' => '<string>',
    'sender_nonce' => '<string>',
    'sender_private_key' => '<string>',
    'sender_public_key' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.eka.care/abdm/v1/ecdh/encrypt"

	payload := strings.NewReader("{\n  \"plain_text_data\": \"<string>\",\n  \"receiver_nonce\": \"<string>\",\n  \"receiver_public_key\": \"<string>\",\n  \"sender_nonce\": \"<string>\",\n  \"sender_private_key\": \"<string>\",\n  \"sender_public_key\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.eka.care/abdm/v1/ecdh/encrypt")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"plain_text_data\": \"<string>\",\n  \"receiver_nonce\": \"<string>\",\n  \"receiver_public_key\": \"<string>\",\n  \"sender_nonce\": \"<string>\",\n  \"sender_private_key\": \"<string>\",\n  \"sender_public_key\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.eka.care/abdm/v1/ecdh/encrypt")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"plain_text_data\": \"<string>\",\n  \"receiver_nonce\": \"<string>\",\n  \"receiver_public_key\": \"<string>\",\n  \"sender_nonce\": \"<string>\",\n  \"sender_private_key\": \"<string>\",\n  \"sender_public_key\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "encrypted_data": "<string>",
  "key_to_share": "<string>"
}

{
  "code": 123,
  "error": "<string>",
  "source_error": {
    "code": "<string>",
    "message": "<string>"
  }
}

{
  "code": 123,
  "error": "<string>",
  "source_error": {
    "code": "<string>",
    "message": "<string>"
  }
}

Authorizations

Authorization · string · header · required

The API requires a Bearer token (JWT) for authentication.

Body

application/json

plain_text_data · string

Plaintext data to encrypt

receiver_nonce · string

Nonce associated with the receiver's key pair

receiver_public_key · string

Base64-encoded public key of the receiver

sender_nonce · string

Nonce associated with the sender's key pair

sender_private_key · string

Base64-encoded private key of the sender

sender_public_key · string

Base64-encoded public key of the sender

Response

200

application/json

OK

encrypted_data · string

Base64-encoded encrypted data

key_to_share · string

Public key material to share with the receiver