OCI Card

Endpoint Overview

POST /api/v1/ocr/oci-card

Description

The OCI Card OCR API provides automated optical character recognition (OCR) and data extraction capabilities for Overseas Citizen of India (OCI) cards. This endpoint processes OCI card documents and intelligently extracts key identity information, validates document authenticity through Machine Readable Zone (MRZ) verification, and returns structured data in a machine-readable format. The API supports both PDF and image file formats, making it flexible for various document processing workflows.

This API is designed for organizations that need to quickly and accurately digitize and verify OCI card information during onboarding, verification, or compliance processes.

Key Benefits

Rapid Document Processing: Extract all critical information from OCI cards in seconds with high accuracy

Multi-Format Support: Process both PDF and image files (JPG, PNG, etc.) through a single endpoint

MRZ Validation: Automatic Machine Readable Zone verification ensures document authenticity and integrity

Structured Data Output: Receive organized, validated data ready for integration with downstream systems

Compliance Ready: Extracts and formats data according to international OCI card standards

Use Cases

Financial Services

Immigration & Travel

Identity & Access Management

Accelerate customer onboarding by automating OCI card verification during KYC processes

Enable rapid identity verification for account opening and loan applications

Reduce manual document processing overhead and human error in data entry

Create auditable records of identity verification for compliance and regulatory reporting

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key and credentials.

Generate JWT Token: Use your API key to generate a JWT Bearer token.

Include in Requests: Add the token to the Authorization header as Bearer {JWT_TOKEN}.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Tokens must be regenerated periodically as per your security policy. Keep your JWT tokens secure and never expose them in client-side code or public repositories.

Request Parameters

Request Headers

Header	Required	Description
`Authorization`	Yes	Bearer token for API authentication. Format: `Bearer {JWT_TOKEN}`
`Content-Type`	Yes	Must be `multipart/form-data` when sending file uploads

Request Body

1. For File Upload

Parameter	Type	Description
file	File	The OCI card document file. Supported formats: PDF, JPG, PNG.
use_pdf	Boolean	If the file type is PDF, set this to true

2. For Base64 Input

Parameter	Type	Description
base_64	String	The OCI card document in Base64 format

3. For Image URL Input

Parameter	Type	Description
link	String	The OCI card document Link/URL

Example Request

Using cURL with image file:

Using cURL with PDF file:

Python multipart format:

Process Response

Response Parameters

Parameter	Type	Description
`data.client_id`	string	Unique identifier generated for this OCR processing request
`data.oci_number`	string	The OCI registration number extracted from the card
`data.document_type`	string	Type of document (e.g., 'V' for visa holder variant)
`data.surname`	string	Family name of the OCI cardholder
`data.given_name`	string	First and middle names of the OCI cardholder
`data.nationality`	string	ISO 3166-1 alpha-3 country code of the cardholder's nationality
`data.date_of_birth`	string	Birth date in DD/MM/YYYY format
`data.gender`	string	Gender code ('M' for Male, 'F' for Female)
`data.place_of_birth`	string	City or region where the cardholder was born
`data.date_of_issue`	string	Date when the OCI card was issued in DD/MM/YYYY format
`data.place_of_issue`	string	Location where the OCI card was issued
`data.file_number`	string	Administrative file number assigned to the cardholder
`data.mrz_line_1`	string	First line of Machine Readable Zone from the document
`data.mrz_line_2`	string	Second line of Machine Readable Zone from the document
`data.is_valid`	boolean	Indicates whether the extracted data and MRZ validation passed successfully
`status_code`	integer	HTTP status code of the response
`success`	boolean	Overall success indicator for the API request
`message`	string	Human-readable status message
`message_code`	string	Machine-readable code for the response status

Example Successful Response

{
  "data": {
    "client_id": "ocr_oci_card_FsQnoEalUEURmbwpLNyV",
    "oci_number": "A0168461",
    "document_type": "V",
    "surname": "",
    "given_name": "RAVI KRISHNAN",
    "nationality": "SGP",
    "date_of_birth": "01/01/1984",
    "gender": "M",
    "place_of_birth": "MUMBAI",
    "date_of_issue": "01/03/2022",
    "place_of_issue": "SINGAPORE",
    "file_number": "SGPS123E1N21",
    "mrz_line_1": "V<IND<<RAVI<KRISHNAN<<<<<<<<<<<<<<<<<<<<<<<<",
    "mrz_line_2": "A0168461<0SGP8401018M8312317SGPS123E1N21<<<<",
    "is_valid": true
  },
  "status_code": 200,
  "success": true,
  "message": "Success",
  "message_code": "success"
}

Possible Error Responses

Invalid File Format

Authentication Error

Missing File

{
  "data": null,
  "status_code": 400,
  "success": false,
  "message": "Invalid file format. Supported formats: PDF, JPG, PNG, TIFF",
  "message_code": "invalid_file_format"
}

The uploaded file is not in a supported format or is corrupted. Ensure the file is a valid PDF or image document.

Integration Best Practices

Security Recommendations

Secure Token Management: Store JWT tokens securely using environment variables or secure vaults. Never hardcode tokens in your application source code or commit them to version control systems.

TLS/HTTPS Only: Always use HTTPS when communicating with the API. Ensure your application validates SSL certificates to prevent man-in-the-middle attacks.

Data Minimization: Only process OCI card documents when absolutely necessary for your business requirements. Implement retention policies to delete extracted data after a defined period.

Access Control: Limit API key and JWT token access to authorized personnel only. Implement role-based access control (RBAC) for systems that interact with this API.

Audit Logging: Maintain detailed logs of all API requests including timestamps, file names, and processing outcomes for compliance and security auditing purposes.

Error Handling: Do not expose sensitive information (such as extracted personal data) in error messages visible to end users. Log detailed errors securely for internal troubleshooting.

User Experience Guidelines

File Upload Feedback: Provide real-time feedback to users during file uploads, indicating progress and any validation errors. Display clear error messages if the file format is unsupported.

Response Time Management: The API typically processes documents within 2-5 seconds. Display a progress indicator or estimated processing time to manage user expectations.

Data Validation: Implement client-side validation to check file format, size, and quality before submission to reduce unnecessary API calls and improve user experience.

Error Recovery: Guide users through corrective actions when errors occur. For example, suggest re-scanning the document if quality is poor, or using a different file format if the current one is unsupported.

Privacy Assurance: Clearly communicate to users how their OCI card data will be used, stored, and protected. Provide transparency about data retention policies and compliance measures.

Accessibility: Design your integration to be accessible to users with different abilities. Ensure file upload interfaces are keyboard navigable and screen reader compatible.

Code Samples

cURL

Python

Node.js

Related APIs

Passport OCR API: Extract and validate information from passport documents using similar OCR technology

Visa Verification API: Verify visa status and validity through automated document processing

Document Verification API: General-purpose document verification service for multiple document types

Identity Verification API: Comprehensive identity verification combining multiple document types and data sources

Compliance and Legal Considerations

Data Privacy: Ensure compliance with GDPR, CCPA, and other applicable data protection regulations when processing and storing OCI card information. Implement appropriate data minimization and retention policies.

KYC/AML Requirements: Use this API as part of comprehensive Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures. Do not rely solely on automated verification; implement manual review workflows for high-risk transactions.

Document Authenticity: While the API validates MRZ data, it does not guarantee document authenticity. Implement additional verification measures such as biometric checks or official government database verification for high-security applications.

Jurisdiction Compliance: OCI status and regulations vary by country and may change. Verify that your usage complies with Indian government regulations and the OCI scheme requirements for your jurisdiction.

Audit Trail: Maintain comprehensive audit logs of all document processing activities to satisfy regulatory requirements and support compliance audits.

User Consent: Obtain explicit user consent before processing their OCI card documents. Clearly communicate the purpose, scope, and duration of data usage.

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

{ "data": { "client_id": "ocr_oci_card_FsQnoEalUEURmbwpLNyV", "oci_number": "A0168461", "document_type": "V", "surname": "", "given_name": "RAVI KRISHNAN", "nationality": "SGP", "date_of_birth": "01/01/1984", "gender": "M", "place_of_birth": "MUMBAI", "date_of_issue": "01/03/2022", "place_of_issue": "SINGAPORE", "file_number": "SGPS123E1N21", "mrz_line_1": "V<IND<<RAVI<KRISHNAN<<<<<<<<<<<<<<<<<<<<<<<<", "mrz_line_2": "A0168461<0SGP8401018M8312317SGPS123E1N21<<<<", "is_valid": true }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

1. For File Upload#

2. For Base64 Input#

3. For Image URL Input#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses