> ## Documentation Index > Fetch the complete documentation index at: https://casparser.in/docs/llms.txt > Use this file to discover all available pages before exploring further. # Start DigiLocker session > Start a DigiLocker session to fetch the investor's government-issued documents (Aadhaar, PAN, etc.) with their consent. **How it works:** 1. Call this endpoint — you get back an `authorization_url` and a `session_id`. The `session_id` is the single identifier you use for everything else. 2. Redirect the investor to `authorization_url` to log in to DigiLocker and grant consent. 3. After consent, the investor is redirected back to your `redirect_url` with query parameters appended (see the table below). 4. Use the `session_id` (path parameter) on the `POST /v1/kyc/digilocker/result/{session_id}` endpoint to read the consented data — identity, documents, and parsed document content. **Redirect parameters appended to your `redirect_url`:** | Outcome | Appended query parameters | | --- | --- | | Consent granted | `?success=true&id={session_id}&state={state}&documents=pan+driving_licence&has_verified_data=1` | | Partial consent (e.g. PAN only) | `?success=true&id={session_id}&state={state}&documents=pan` | | Consent denied / failed | `?success=false&id={session_id}&state={state}&error={error}` | `documents` lists the documents the investor agreed to share; `has_verified_data=1` appears only when verified identity is available. **Credits:** Free. Billing happens when documents/identity are returned. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/kyc/digilocker/session openapi: 3.1.0 info: title: CAS Parser - Track Portfolios from CDSL, NSDL, CAMS, KFintech description: >- API for parsing and analyzing CAS (Consolidated Account Statement) PDF files from NSDL, CDSL, and CAMS/KFintech, with a unified response format version: 4.0.0 contact: name: Sameer Kumar email: sameer@casparser.in servers: - url: https://api.casparser.in description: Production server - url: https://portfolio-parser.api.casparser.in description: Legacy production server (still supported) - url: http://localhost:5000 description: Local development server security: [] tags: - name: CAS Parser description: Endpoints for parsing CAS PDF files from different sources. - name: CAS Generator description: Endpoints for generating new CAS documents via email mailback (KFintech). - name: CAS Fetch description: | Endpoints for fetching CAS documents with instant download. Currently supports CDSL via OTP authentication. - name: Email Import description: > Endpoints for importing CAS files directly from user email inboxes. **Supported Providers:** Gmail (more coming soon) **How it works:** 1. Call `POST /v4/inbox/connect` to get an OAuth URL 2. Redirect user to the OAuth URL for consent 3. User is redirected back to your `redirect_uri` with an encrypted `inbox_token` 4. Use the token to list/fetch CAS files from their inbox (`/v4/inbox/cas`) 5. Files are uploaded to temporary cloud storage (URLs expire in 24 hours) **Security:** - Read-only access (we cannot send emails) - Tokens are encrypted with server-side secret - User can revoke access anytime via `/v4/inbox/disconnect` - name: Inbound Email description: > Create dedicated inbound email addresses for investors to forward their CAS statements. **Use Case:** Your app wants to collect CAS statements from users without requiring OAuth or file upload. **How it works:** 1. Call `POST /v4/inbound-email` to create a unique inbound email address 2. Display this email to your user: "Forward your CAS statement to ie_xxx@import.casparser.in" 3. When user forwards a CAS email, we verify sender authenticity (SPF/DKIM) and call your webhook 4. Your webhook receives email metadata + attachment download URLs **Sender Validation:** - Only emails from verified CAS authorities are processed: - CDSL: `eCAS@cdslstatement.com` - NSDL: `NSDL-CAS@nsdl.co.in` - CAMS: `donotreply@camsonline.com` - KFintech: `samfS@kfintech.com` - Emails failing SPF/DKIM/DMARC are rejected - Forwarded emails must contain the original sender in headers **Billing:** 0.2 credits per successfully processed valid email - name: Contract Note Parser description: >- Endpoints for parsing Contract Note PDF files from various SEBI brokers like Zerodha, Groww, Upstox, ICICI etc. - name: Authorization description: | Endpoints for checking API quota and credits usage. These endpoints help you monitor your API usage and remaining quota. - name: Portfolio Connect description: > Endpoints for managing access tokens for the Portfolio Connect SDK. Use these to generate short-lived `at_` prefixed tokens that can be safely passed to frontend applications. Access tokens can be used in place of API keys on all v4 endpoints. - name: Agent Auth description: > Endpoints for coding agents to obtain API keys via a browser-based approval flow. **How it works:** 1. Agent generates a random token locally (e.g. `openssl rand -hex 32`). No API call needed. 2. Agent asks the user to open `https://app.casparser.in/agent-auth?token=&client_name=` 3. User signs in via the browser and clicks Approve. 4. Agent polls `GET /v1/agent-auth/token/{token}` every 5 seconds until the key is delivered. **Security:** - Token must be 16-128 characters (recommended: 64 hex chars / 256 bits) - Approved keys are delivered once (one-shot) and then deleted - Tokens expire after 10 minutes if not approved - name: KYC description: > Endpoints for verifying KYC (Know Your Customer) status of Indian investors. **Data source:** CVL KRA public inquiry portal (cvlkra.com), which aggregates records from all five SEBI-registered KRAs: CVL, NDML, CAMS, Karvy, and KFin. **Status normalization:** Raw CVL portal strings are normalized into clean enums. See the `kyc_status` property on `KycPanStatusResponse` for the full list. **Credits:** 0.5 per successful lookup. Failed lookups are not billed. paths: /v1/kyc/digilocker/session: post: tags: - KYC summary: Start DigiLocker session description: > Start a DigiLocker session to fetch the investor's government-issued documents (Aadhaar, PAN, etc.) with their consent. **How it works:** 1. Call this endpoint — you get back an `authorization_url` and a `session_id`. The `session_id` is the single identifier you use for everything else. 2. Redirect the investor to `authorization_url` to log in to DigiLocker and grant consent. 3. After consent, the investor is redirected back to your `redirect_url` with query parameters appended (see the table below). 4. Use the `session_id` (path parameter) on the `POST /v1/kyc/digilocker/result/{session_id}` endpoint to read the consented data — identity, documents, and parsed document content. **Redirect parameters appended to your `redirect_url`:** | Outcome | Appended query parameters | | --- | --- | | Consent granted | `?success=true&id={session_id}&state={state}&documents=pan+driving_licence&has_verified_data=1` | | Partial consent (e.g. PAN only) | `?success=true&id={session_id}&state={state}&documents=pan` | | Consent denied / failed | `?success=false&id={session_id}&state={state}&error={error}` | `documents` lists the documents the investor agreed to share; `has_verified_data=1` appears only when verified identity is available. **Credits:** Free. Billing happens when documents/identity are returned. operationId: startDigilockerSession requestBody: required: true content: application/json: schema: type: object required: - consent - consent_purpose - redirect_url properties: consent: type: boolean description: > Explicit end-user consent. Must be `true` to proceed (regulatory requirement under DPDP / RBI). Captured for audit. example: true consent_purpose: type: string minLength: 20 description: | Specific purpose for which consent is taken (min 20 chars). Stored in the session and returned as a consent receipt. example: KYC for loan account opening redirect_url: type: string format: uri description: >- Where to redirect the user after consent. Must be a valid http/https URL. example: https://yourapp.com/digilocker/callback state: type: string description: Opaque value echoed back to your redirect_url unchanged. example: investor_42 documents: type: array items: type: string enum: - aadhaar - pan - driving_licence - email - mobile description: Identities to verify and return in the response. example: - aadhaar - pan user_flow: type: string enum: - signin - signup description: >- Use "signin" for users with an existing DigiLocker account, "signup" for account-on-the-fly. example: signin prefill_mobile: type: string description: >- Pre-verified mobile to skip the signup OTP step (only applies with user_flow=signup). example: '9999999999' responses: '200': description: Session started; redirect the user to authorization_url content: application/json: schema: type: object properties: status: type: string example: success session_id: type: string description: > The single identifier for this verification. Use it as the path parameter in `POST /v1/kyc/digilocker/result/{session_id}` to retrieve identity + documents. example: 3f9a2c1e8b7d4e6fa1c2d3e4f5a6b7c8 authorization_url: type: string description: DigiLocker consent URL to redirect the investor to. expires_in: type: integer description: Seconds the authorization_url is valid for. example: 600 '400': description: | Validation error. `code` indicates which: `consent_required` (consent not true), `consent_purpose_required` (missing/too short), or `redirect_url_invalid`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: consent_required: value: status: failed msg: 'Explicit user consent is required. Pass consent: true.' code: consent_required consent_purpose_required: value: status: failed msg: >- A specific consent_purpose is required (min 20 characters). code: consent_purpose_required redirect_url_invalid: value: status: failed msg: >- Invalid or missing redirect_url. Must be a valid http/https URL. code: redirect_url_invalid '401': $ref: '#/components/responses/Unauthorized' '503': description: DigiLocker is temporarily unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - ApiKeyAuth: [] - AccessTokenAuth: [] components: schemas: ErrorResponse: type: object required: - status - msg properties: status: type: string description: The status of the error. enum: - failed example: failed msg: type: string description: A descriptive message explaining the error. example: Invalid PDF file or password. AuthErrorResponse: type: object required: - status - msg properties: status: type: string description: The status of the error. enum: - failed example: failed msg: type: string description: A descriptive message explaining the error. example: 'Authentication failed: API key is missing.' responses: Unauthorized: description: Unauthorized. This can happen if the `x-api-key` header is missing. content: application/json: schema: $ref: '#/components/schemas/AuthErrorResponse' example: status: failed msg: >- Authentication failed: API key is missing. Please provide a valid API key in the x-api-key header. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: | Your API key for authentication. Use `sandbox-with-json-responses` as Sandbox key. ````