> ## Documentation Index > Fetch the complete documentation index at: https://developer.sandbox.co.in/llms.txt > Use this file to discover all available pages before exploring further. # Initiate Session > The Initiate Session API returns a DigiLocker link that the user is redirected to, where they can provide consent for the requested documents. > **[Run in Postman](https://www.postman.com/in-co-sandbox/sandbox-api/request/uvvxtcp/initiate-session)** ## OpenAPI ````yaml api-reference/kyc/openapi.json POST /kyc/digilocker/sessions/init openapi: 3.1.0 info: title: in-co-sandbox-kyc description: '' version: 1.0.0 servers: - url: https://test-api.sandbox.co.in description: test - url: https://api.sandbox.co.in description: prod security: [] tags: - name: kyc - name: digilocker-sdk - name: digilocker - name: aadhaar - name: bank - name: pan - name: mca - name: entitylocker - name: entitylocker-sdk paths: /kyc/digilocker/sessions/init: post: tags: - kyc - digilocker summary: Initiate session description: >- Creates a DigiLocker session and returns `authorization_url`, the DigiLocker page to send the user to, and `session_id` to track the session. Options that do not apply to the chosen `flow` are ignored rather than rejected. operationId: initiateSession parameters: - name: Authorization in: header description: >- JWT access token. For token-generation steps, refer to the [Quickstart Guide](https://developer.sandbox.co.in/guides/get-started/quickstart). required: true example: '{{access_token}}' schema: type: string - name: x-api-key in: header description: API key used to identify and authenticate the client. required: true example: '{{api_key}}' schema: type: string - name: x-api-version in: header description: Specifies the API version for the request. required: false example: 1.0.0 schema: type: string - name: Content-Type in: header description: Media type of the request body. required: false example: application/json schema: type: string enum: - application/json requestBody: content: application/json: schema: type: object properties: '@entity': type: string enum: - in.co.sandbox.kyc.digilocker.session.request description: >- Entity type of the request. Always `in.co.sandbox.kyc.digilocker.session.request`. flow: type: string enum: - signin - signup description: >- Which DigiLocker screen the user starts on. `signin` opens the sign-in screen, for users who already have a DigiLocker account. `signup` opens account creation. redirect_url: type: string format: uri pattern: ^https:// description: >- HTTPS URL where the user will be redirected after granting or denying DigiLocker consent. Must be a valid, publicly accessible URL. doc_types: type: array minItems: 1 items: type: string minLength: 1 enum: - aadhaar - pan - driving_license description: >- List of DigiLocker document types for which user consent is being requested. purpose: type: string default: Know Your Customer description: >- Purpose of the request, shown to the user on DigiLocker's consent screen. Letters, digits, spaces and underscores only, as DigiLocker requires; anything else returns `400`. Defaults to `Know Your Customer`. pattern: ^[A-Za-z0-9_ ]+$ requestor_name: type: string description: >- Name of the business requesting the documents, shown to the user on DigiLocker's consent screen. Letters, digits, spaces and underscores only, as DigiLocker requires; anything else returns `400`. Defaults to your workspace's business name from the Sandbox console, with other characters replaced by spaces. pattern: ^[A-Za-z0-9_ ]+$ options: type: object properties: verification_method: type: array items: type: string enum: - aadhaar - pan - driving_license - email - username - mobile - other minItems: 1 description: >- Login methods DigiLocker offers on the `signup` screen. Ignored on `signin`. pinless: type: boolean description: >- Offer PIN-less (OTP-only) authentication, on sign-in and on sign-up. DigiLocker preselects PIN-less; the user can still choose a PIN. usernameless: type: boolean description: >- On `signup`, skip DigiLocker's username creation step. Ignored on `signin`. verified_mobile: type: string pattern: ^[6-9][0-9]{9}$ description: >- The user's 10-digit mobile number. On `signup`, pass a number your system has already verified, so DigiLocker skips its mobile OTP step. On `signin`, DigiLocker's sign-in screen opens on mobile login with this number pre-filled; the user still has to log in. Not pre-filled when `force_login` is true. force_login: type: boolean default: false description: >- Make the user log in to DigiLocker again, even if their browser already has a DigiLocker session. Takes precedence over the `signin` mobile pre-fill. It does not by itself make DigiLocker show the consent screen again. description: >- Controls DigiLocker's sign-in and sign-up screens. Every option is optional, and an option that does not apply to the chosen `flow` is ignored, not rejected. consent_expiry: type: integer description: >- When the consent expires, as Unix epoch milliseconds. Must be at least one hour from now, otherwise `400`. Defaults to 61 minutes from now. DigiLocker rejects a link opened with less than an hour of consent left, so allow time for the user to open it. required: - '@entity' - flow - redirect_url - doc_types examples: 200 - OK: value: '@entity': in.co.sandbox.kyc.digilocker.session.request flow: signin redirect_url: https://developer.sandbox.co.in/ doc_types: - aadhaar - pan - driving_license options: verification_method: - aadhaar pinless: true usernameless: true verified_mobile: '9687205427' summary: 200 - OK responses: '200': description: '' content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer data: type: object properties: '@entity': type: string authorization_url: type: string session_id: type: string required: - '@entity' - authorization_url - session_id transaction_id: type: string required: - code - timestamp - data - transaction_id examples: 200 - OK: summary: 200 - OK value: code: 200 timestamp: 1751975600361 data: '@entity': in.co.sandbox.kyc.digilocker.session.response authorization_url: >- https://digilocker.meripehchaan.gov.in/public/oauth2/1/authorize?response_type=code&client_id=IW55C7A3B0&state=e385432b-575c-4b6f-8928-79136dbc0d4f%7Cf1bd0342-cc1d-4051-8301-e8ee17e3a3c3%7Chttps%3A%2F%2Fdeveloper.sandbox.co.in%2F&code_verifier=ADlMHKsr~L8YIwLoIOGgwwRQoouE-m~Z9yu0KWstrsKrdAtUY2IkmOoDWZNn80_G&code_challenge=pnowXsaM5mBqNR3NfSfsaLBC2JYjoy2eRLOwKNVjFY8&code_challenge_method=S256&scope=files.issueddocs&redirect_uri=https%3A%2F%2Fdeveloper.sandbox.co.in%2F&pla=Y&dl_flow=signup&plsignup=Y&amr=driving_license%2Baadhaar%2Bpan%2Bemail%2Busername%2Bmobile%2Bother&verified_mobile=9004813042&req_doctype=PANCR%2CADHAR%2CDRVLC&consent_valid_till=1752061999 session_id: f1bd0342-cc1d-4051-8301-e8ee17e3a3c3 transaction_id: a11c4e00-fae1-4092-a55f-b4f0be92ffeb headers: {} '400': description: >- The request data is not correct. The `redirect_url` must be a full URL. The `consent_expiry` must be more than one hour in the future. content: application/json: schema: type: object properties: code: type: integer const: 400 description: The HTTP status code. timestamp: type: integer description: >- The time of the response. The unit is milliseconds from the Unix epoch. message: type: string description: The error message. transaction_id: type: string description: The unique identifier of the request. required: - code - timestamp - message - transaction_id examples: Invalid redirect_url: summary: Invalid redirect_url value: code: 400 timestamp: 1782806266274 message: Invalid redirect_url transaction_id: c2d3e4f5-1111-4a5b-8c6d-7e8f9a0b1c2d Invalid consent_expiry: summary: Invalid consent_expiry value: code: 400 timestamp: 1782806266274 message: Invalid consent_expiry transaction_id: c2d3e4f5-1111-4a5b-8c6d-7e8f9a0b1c2d headers: {} '500': description: The request failed. content: application/json: schema: type: object properties: code: type: integer const: 500 description: The HTTP status code. timestamp: type: integer description: >- The time of the response. The unit is milliseconds from the Unix epoch. message: type: string description: The error message. transaction_id: type: string description: The unique identifier of the request. required: - code - timestamp - message - transaction_id examples: Failed to initialize session: summary: Failed to initialize session value: code: 500 timestamp: 1782806266274 message: Failed to initialize session transaction_id: c2d3e4f5-3333-4a5b-8c6d-7e8f9a0b1c2d Failed to create session: summary: Failed to create session value: code: 500 timestamp: 1782806266274 message: Failed to create session transaction_id: c2d3e4f5-3333-4a5b-8c6d-7e8f9a0b1c2d Internal Server Error: summary: Internal Server Error value: code: 500 timestamp: 1782806266274 message: Internal Server Error transaction_id: c2d3e4f5-3333-4a5b-8c6d-7e8f9a0b1c2d headers: {} deprecated: false security: [] ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.