As an FIU, create an Account Aggregator consent request, handle the consent notification, and fetch financial information from an FIP via India's ReBIT/Sahamati AA network.
domain: developer.sahamati.org.in · 11 steps · contributed by dpi-india-routes-v1
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Confirm eligibility first: FIU participation in the AA network is regulated. You must be registered/empanelled as an AA-ecosystem entity with the relevant regulator - this is not an API-key signup.
Establish mutual TLS with registered entity certificates. All FIU-AA-FIP calls in the network require it.
Create the consent request: POST /Consent to the AA to request generation of a digitally-signed consent artefact. Specify consentDetail including FI types, FIDataRange, DataLife and consent purpose.
The AA returns a consent handle immediately. The customer then selects accounts and approves inside the AA's own app - the FIU never sees the customer's account list directly.
Expose a webhook to receive POST /Consent/Notification from the AA, which reports the consent status change (ACTIVE, REJECTED or REVOKED) resulting from the customer's action.
On an ACTIVE notification, fetch the signed consent artefact from the AA (POST /Consent/fetch or GET by handle per the current spec) - you need the artefact to authorise any FI request.
Request the data: POST /FI/request with the consentId and consent artefact detail. The AA returns a sessionId used to track the pull from the relevant FIP(s).
The AA routes the request to the identified FIP(s) via the Central Registry / FIP directory. Each FIP independently validates the consent artefact before releasing data.
Await POST /FI/Notification (or poll) and then call /FI/fetch with the sessionId to retrieve the encrypted financial information once the FIP has responded.
Decrypt the FI payload using the ECDH key material exchanged in the FI request, per the spec's encryption section.
Official docs: https://developer.sahamati.org.in/sahamatinet-mvp/integration-steps/integration-with-router/router-apis-specifications/aa-api-specification | https://github.com/Sahamati/account-aggregator-standards
Known gotchas
FIU status is regulator-gated. Network membership requires registration/empanelment as an AA-ecosystem entity - no self-serve path exists.
The FIU can only act after the customer approves consent inside the AA's own app. A request the customer ignores or rejects never yields a usable artefact, and the FIU gets no visibility into why.
Consent artefacts carry their own DataLife, permitted FI types and date ranges fixed at creation. An FI request outside the consented range or after expiry is rejected by the FIP, not by the AA - so the failure surfaces late.
Do not cite or build against https://sahamati.org.in/wp-content/uploads/2025/02/2-API_Specifications_v2.0.0.pdf - that URL returns 404 on cache-busted requests. Use the developer.sahamati.org.in specification or the Sahamati account-aggregator-standards repo (specs/aa.yaml, fip.yaml, fiu.yaml) as the canonical source.
Multiple integration patterns coexist: direct FIU-AA-FIP versus Router-mediated flows under SahamatiNet. Endpoint behaviour differs between them - confirm which pattern your integration uses before fixing an endpoint list.
The FIP, not the AA, is the party that ultimately validates the consent artefact and can refuse. Build error handling for FIP-side rejection separately from AA-side errors.
Give your agent this knowledge — and 16,400+ more routes
One MCP install gives any agent live access to the full route map across 5,800+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?