Run a CCA-licensed eSign 3.x ASP-to-ESP XML request to obtain an Aadhaar/eKYC-based electronic signature on a document hash (India).

Documented steps

1. Complete ASP onboarding with a CCA-empanelled eSign Service Provider (ESP): submit the ESP's application form, KYC documents, and sign the ASP-ESP service agreement. This is not self-serve.
2. Obtain and register your organisation's Digital Signature Certificate (Class 2 or 3, minimum 6 months validity) with the ESP; it is used to sign every eSign request XML.
3. Compute the SHA-256 hash of the document on the ASP side. The document itself is never transmitted to the ESP - only the hash.
4. Build the request XML: root <Esign ver="3.3" ts="" txn="" aspId="" responseUrl="" redirectUrl="" signingAlgorithm="" maxWaitPeriod=""> containing <Docs><InputHash id="1" hashAlgorithm="SHA256" docInfo="..." responseSigType="pkcs7">HASH</InputHash></Docs>.
5. Set ts within +/-30 minutes of actual IST time; txn must be unique per ASP-ESP pair per day; docInfo must be 50 characters or fewer.
6. Sign the whole request XML with W3C XML-DSig using the ASP certificate and attach it as the <Signature> block.
7. HTTPS POST the XML (Content-Type: application/xml) to the ESP's signing URL. The ESP validates your XML signature and returns an acknowledgement (status=2) with a response code and txn id.
8. Redirect the user's browser to the ESP authentication page via redirectUrl carrying the Base64-encoded (txnID|responseCode) so the ESP can run PIN plus a second factor (SMS OTP by default; TOTP/FIDO2 where the ESP supports it).
9. The ESP performs eKYC authentication, generates a one-time key pair and CSR, obtains a DSC, and signs the hash. It then redirects to responseUrl or posts the signed XML server-to-server.
10. If the user's browser session ends before completion, poll the ESP's checkStatus API with the txn id rather than assuming failure.
11. Parse <EsignResp ver="3.3" status="" resCode="" error=""> - status=1 success, 0 failure, 2 pending - and read <UserX509Certificate> plus <Signatures><DocSignature>.
12. Verify the ESP's response XML signature, then attach the returned signature (raw / PKCS7 / PKCS7pdf / PKCS7complete per responseSigType) to the original document.
13. Retain the full request/response transaction log: ASPs are required to keep eSign audit logs for a minimum of 7 years.
14. Official docs: https://cca.gov.in/sites/files/pdf/esign/eSign-APIv3.3.pdf | https://cca.gov.in/sites/files/pdf/esign/CCA-ASP.pdf | https://cca.gov.in/eSignAPI.html