From the ABDM sandbox to production: certification, security audit and the exit process

01The route in one view

1. Register the software on the sandbox and receive a client id and secret.
2. Integrate and self-test every milestone you will claim, against the live sandbox rather than a mock.
3. Start the exit from the form in your sandbox account.
4. Functional and non-functional testing by an NHA-empanelled agency, which issues a report.
5. Security testing by a CERT-In or STQC empanelled auditor, which issues a Safe-to-Host certificate once findings are closed.
6. Submission of both, with the completed forms, to NHA’s committee.
7. Production credentials, and a listing among certified integrators.

Steps 4 and 5 are paid, to the agency and the auditor. NHA charges nothing. The order is not negotiable: the agency tests the deployment the auditor will certify, and the committee wants both reports.

02Self-testing before you book

The agency runs NHA’s sheets; you should have run them first. Nothing done against a mock counts, because a mock speaks ABDM’s shapes and not its rules. For each milestone, drive the flow end to end on the sandbox with callback verification on:

• M1: create an ABHA from Aadhaar and from a mobile, verify an existing one, read the profile and the card, and record it on the patient.
• M2: link a care context HIP-initiated and user-initiated, receive a consent artefact, answer a health-information request with a bundle that contains only what the artefact covers, and refuse after revocation.
• M3: raise a consent request, handle grant and denial, fetch the artefact, request and decrypt the records, and stop showing them after expiry.
• Registries: search and register a facility in HFR, link its services to the bridge, and look up and register a professional in HPR.

Keep the evidence: request ids, callback payloads and screenshots, dated. The agency will ask for some of it, and it is what you will need if a case fails.

03Functional testing by the agency

Since August 2022 functional testing has been paid-for testing by one of the agencies NHA has empanelled. The agency takes your deployment, a test account and a demonstration, and works through the test-case sheet for each milestone you claimed. Many cases have a user-interface half: the consent text shown to a citizen, the OTP resend timer, how records are presented to a clinician. They are tested in the product a facility uses, not only at the API.

A failed case is fixed and re-tested. Cases you cannot show, because a route is disabled in the sandbox, are declared rather than failed. The report the agency issues is what goes to the committee.

04The security audit

A CERT-In or STQC empanelled auditor tests the application and its hosting and issues a Safe-to-Host certificate once the findings are closed. Implementers call it the WASA, for web application security audit, and describe a vulnerability-closure certificate; those names come from implementer write-ups rather than NHA, whose own reference is its Secure Application Development document.

Three findings appear on nearly every first scan: a content-security policy the scanner considers weak, cookie flags, and information disclosure in error pages. Decide your position on each before the audit and write it down for the auditor, with the control that mitigates it. Field-level encryption of Aadhaar numbers, OTPs and tokens, verification of consent-artefact signatures, and an append-only audit trail are the controls an auditor looks for in an ABDM application specifically.

05Committee and credentials

The functional testing report, the Safe-to-Host certificate and the completed forms go to NHA’s internal committee. On approval you receive production client credentials, register your production bridge URL, and appear in NHA’s list of integrated software, which is what a hospital checks when it links its facility to yours in HFR.

Production is not the sandbox with a different host. Registry hosts differ, credentials are issued per onboarding, and the consent manager id changes. Keep every base URL and identifier in configuration, per environment, and confirm each one against your onboarding pack before the first live call.

06What to declare up front

• Routes the sandbox did not let you exercise, such as ABHA creation from a driving licence when it is switched off, or standing subscriptions where the subscription service refuses your HIU.
• Milestones you are not claiming. Claiming M3 you have not built costs a failed sheet and a re-test.
• Where the citizen-facing screens live, since the agency tests them.
• Which facility in the sandbox is yours, registered in HFR and linked to your bridge, so the agency’s callbacks reach you.

07What a hospital inherits

Certification attaches to the software. A hospital that uses certified software does not repeat any of this; it registers its facility in HFR, links it to that software, and is on ABDM. That is the economic case for a shared connector: the agency testing, the audit and the production onboarding are done once, and every hospital on it inherits the result, including the next time NHA changes the sheets. The sandbox page covers how to start, and the cost guide what the routes cost.