API Security for UPI, PSPs and Payment Companies: 6 Essential Rules | Osto<\/title>\n<meta name=\"description\" content=\"API security for UPI, PSPs, and payment companies explained: NPCI rate limits, call governance, two-factor auth, encryption, and CERT-In audit requirements.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">API security for UPI, PSPs, and payment companies is no longer a one-time checkbox. Between the NPCI API guidelines and the RBI authentication rules, it is now a continuous, audited discipline. This guide breaks down what you must implement, and by when.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>API security for UPI and payment companies is now driven by the NPCI UPI API Security Guidelines and the RBI authentication rules. The core requirements are rate limiting on every UPI API, separating customer-initiated from system-initiated calls, two-factor authentication with a dynamic factor from April 2026, end-to-end encryption, input and output validation, and annual CERT-In empanelled audits. Non-compliance can mean throttling, penalties, or suspension from the UPI network.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why API security changed<\/a><\/li>\n <li><a href=\"#controls\">The six core controls<\/a><\/li>\n <li><a href=\"#calls\">Governing API call behaviour<\/a><\/li>\n <li><a href=\"#auth\">The two-factor mandate<\/a><\/li>\n <li><a href=\"#audit\">Audit and evidence<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why API security for UPI changed<\/h2>\n <p>As UPI grew to more than fifteen billion transactions a month, its APIs came under real strain from bots, automated scripts, and poorly configured background jobs. In response, the <a href=\"https:\/\/www.npci.org.in\/\" target=\"_blank\" rel=\"noopener\">National Payments Corporation of India<\/a> issued the UPI API Security Guidelines, and the RBI tightened authentication for all digital payments. Together they turned API security for UPI, PSPs, and payment companies from a one-time review into a continuous, governed function that runs across the whole software lifecycle: inventory, design, deployment, monitoring, and audit. For any PSP bank, acquiring bank, or UPI app provider, this is now a live obligation with hard deadlines.<\/p>\n\n <h2 class=\"sec\" id=\"controls\">The six core controls<\/h2>\n <p>The rules are detailed, but strong API security comes down to a recognisable set of controls that every PSP and payment company needs to have working and evidenced.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The controls<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the guidelines actually require<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">API security for the UPI ecosystem, and for PSPs and payment companies generally, is now governed by the NPCI UPI API Security Guidelines and the RBI authentication rules. Six controls carry most of the weight in practice.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core API security controls for UPI, PSPs, and payment companies\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core API security controls<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 18a8 8 0 1 1 16 0\"\/><path d=\"M12 18l4-5\"\/><circle cx=\"12\" cy=\"18\" r=\"1.4\" fill=\"currentColor\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Rate limiting<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cap TPS on every core UPI API<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3v6a3 3 0 0 0 3 3h6M18 21v-6a3 3 0 0 0-3-3H9\"\/><path d=\"M15 6l3-3-3-3M9 18l-3 3 3 3\" transform=\"scale(0)\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Call classification<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Separate customer vs<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">system-initiated<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Two-factor auth<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">One dynamic factor from April<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">2026<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">AES, TLS, and PKI end to end<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Validation and docs<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Input\/output checks, documented<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In audit<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Annual empanelled audit and<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">attestations<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means enforcing rate limits and a transactions-per-second cap on every core API, classifying each call as customer-initiated or system-initiated and treating them differently, implementing two-factor authentication with at least one dynamic factor, encrypting data end to end with AES, TLS, and PKI, validating all input and output while keeping APIs documented, and passing an annual CERT-In empanelled audit with quarterly self-attestations. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> across your APIs is usually the fastest way to prove these controls hold.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Security moved into the whole lifecycle<\/div>The biggest shift is that API security for UPI is no longer a pre-launch checkbox. It is a continuous function, inventory, design, deployment, monitoring, and audit, that a PSP or payment company must run and evidence all year round.<\/div>\n\n <h2 class=\"sec\" id=\"calls\">Governing API call behaviour<\/h2>\n <p>At the centre of the NPCI guidelines is a simple principle with strict mechanics: not all API calls are equal. Getting this classification right is the core of the discipline in day-to-day operations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Call governance<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Customer calls first, system calls throttled<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The heart of the NPCI guidelines is telling the two kinds of API calls apart. Customer-initiated requests are protected, while system-initiated calls must be queued and rate-limited so they cannot flood the network.<\/div>\n <svg viewBox=\"0 0 800 278\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Customer-initiated versus system-initiated UPI API calls\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Customer-initiated vs system-initiated calls<\/text>\n <rect x=\"16\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"92\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Customer-initiated<\/text>\n <line x1=\"46\" y1=\"104\" x2=\"358\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <g transform=\"translate(46,112) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"126\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Prioritised during peak load<\/text><g transform=\"translate(46,150) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"164\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Balance check: 50 per day<\/text><g transform=\"translate(46,188) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"202\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Status: 3 checks per txn<\/text><g transform=\"translate(46,226) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"240\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Real user actions<\/text>\n <rect x=\"412\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"442\" y=\"92\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">System-initiated<\/text>\n <line x1=\"442\" y1=\"104\" x2=\"754\" y2=\"104\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <g transform=\"translate(442,112) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"126\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Must be queued and throttled<\/text><g transform=\"translate(442,150) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"164\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">No unbounded background calls<\/text><g transform=\"translate(442,188) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"202\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">List APIs in non-peak hours only<\/text><g transform=\"translate(442,226) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"240\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Bots and automation capped<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Customer-initiated calls, real actions a user takes, are prioritised, especially during peak load, but even they carry limits, such as balance-enquiry APIs restricted to a set number per customer per day and a capped number of status checks per transaction. System-initiated calls, background and automated requests, must be queued and rate-limited so they cannot overload the network, and certain list APIs are confined to non-peak hours. PSPs had to submit a formal undertaking confirming that every system-initiated API is queued and rate-limited. This behavioural governance is what keeps UPI stable at scale.<\/p>\n\n <h2 class=\"sec\" id=\"auth\">The two-factor authentication mandate<\/h2>\n <p>A second major change reshapes how payment flows are built. Under the RBI authentication rules, from April 2026 every domestic digital payment, including UPI, must use two authentication factors from different categories, with at least one dynamic factor unique to the transaction.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Authentication<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Two factors, one of them dynamic<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">From April 2026, every domestic digital payment, including UPI, needs two authentication factors from different categories, with at least one dynamic. This reshapes how PSPs and payment companies build their API flows.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The two-factor authentication mandate for UPI payments\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Two-factor authentication from April 2026<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <circle cx=\"66\" cy=\"104\" r=\"18\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/><g transform=\"translate(57.00,95.00) scale(0.75)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"8\" cy=\"12\" r=\"3.5\"\/><path d=\"M11.5 12H20l-2 2M17 12v2.5\"\/><\/g>\n <text x=\"96\" y=\"102\" fill=\"#1c267a\" font-size=\"13.5\" font-weight=\"800\">Static factor<\/text>\n <text x=\"96\" y=\"120\" fill=\"#5b6178\" font-size=\"11.5\">Knowledge or possession<\/text>\n <line x1=\"54\" y1=\"140\" x2=\"356\" y2=\"140\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"54\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">A UPI PIN, a registered device,<\/text>\n <text x=\"54\" y=\"184\" fill=\"#4a5170\" font-size=\"12\">or a token. Not enough alone.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <circle cx=\"456\" cy=\"104\" r=\"18\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(447.00,95.00) scale(0.75)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g>\n <text x=\"486\" y=\"102\" fill=\"#0a6558\" font-size=\"13.5\" font-weight=\"800\">Dynamic factor<\/text>\n <text x=\"486\" y=\"120\" fill=\"#5b6178\" font-size=\"11.5\">Required, at least one<\/text>\n <line x1=\"444\" y1=\"140\" x2=\"746\" y2=\"140\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"444\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">A one-time password or biometric,<\/text>\n <text x=\"444\" y=\"184\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">tied uniquely to the transaction.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>In practice a static factor like a UPI PIN or a registered device is no longer sufficient on its own, it must be paired with a dynamic factor such as a one-time password or a biometric. SMS one-time passwords are still allowed, but not as the only factor, and small-value contactless payments are exempted. For PSPs and payment companies, this means building secure two-factor flows into the API layer itself, part of a complete approach rather than a bolt-on.<\/p>\n\n <h2 class=\"sec\" id=\"audit\">Audit and evidence<\/h2>\n <p>The guidelines close the loop with mandatory assurance. Annual CERT-In empanelled audits of API systems are required, and PSPs file quarterly self-attestations detailing their controls, incidents, and remediation. Because the difference between a scan and a real assessment matters here, it is worth understanding how a scan differs from a penetration test, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why an automated scan alone will not satisfy an audit of your UPI APIs. Strong evidence, findings tracked to closure and confirmed by retest, is what turns compliance from a claim into something you can prove.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Non-compliance has teeth<\/div>These are not advisory guidelines. Failing to meet the API security requirements can lead to throttling of your APIs, financial penalties, or suspension from the UPI network. For a payment company, that is an existential risk, not a line item.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to API security for UPI<\/h2>\n <p>Meeting all of this, rate-limit and call-governance posture, two-factor flows, encryption, ongoing API testing, and audit-ready evidence, is a heavy lift for a lean PSP or payment company without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean payment teams. It runs VAPT across your APIs and apps, checks for the OWASP and business-logic flaws that hit payment APIs, supports encryption and monitoring, and keeps organised, audit-ready evidence, mapped across the NPCI and RBI expectations, DPDP, and 200+ frameworks on one platform. Meeting this bar, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Get API security for UPI right, and audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean payment teams. Test your APIs, harden authentication and encryption, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is API security for UPI?<\/summary><p>It is the set of controls the NPCI and RBI require for UPI APIs: rate limiting, separating customer-initiated from system-initiated calls, two-factor authentication, encryption, input and output validation, and annual CERT-In empanelled audits. It applies to PSP banks, acquiring banks, and UPI app providers.<\/p><\/details>\n <details><summary>Who must comply with the NPCI UPI API guidelines?<\/summary><p>All Payment Service Provider banks, acquiring banks, third-party app providers, and UPI app providers. PSPs were required to submit an undertaking confirming that every system-initiated API is queued and rate-limited.<\/p><\/details>\n <details><summary>What are the UPI API rate limits?<\/summary><p>NPCI caps transactions per second and limits high-frequency APIs, for example balance-enquiry calls restricted per customer per day and a limited number of status checks per transaction, with certain list APIs confined to non-peak hours. System-initiated calls must be queued and throttled.<\/p><\/details>\n <details><summary>What is the two-factor authentication rule for UPI?<\/summary><p>From April 2026, every domestic digital payment including UPI must use two authentication factors from different categories, with at least one dynamic factor unique to the transaction. A UPI PIN alone is not sufficient, and SMS one-time passwords cannot be the only factor.<\/p><\/details>\n <details><summary>Is a CERT-In audit required for UPI APIs?<\/summary><p>Yes. Annual CERT-In empanelled audits of API systems are mandatory, alongside quarterly self-attestations of controls, incidents, and remediation. Reports and evidence must be kept current.<\/p><\/details>\n <details><summary>What happens if a PSP does not comply?<\/summary><p>Non-compliance can result in throttling of APIs, financial penalties, or suspension from the UPI network. Because these guidelines are enforceable rather than advisory, API security for UPI is a business-critical obligation for any payment company.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>API Security for UPI, PSPs and Payment Companies: 6 Essential Rules | Osto API security for UPI, PSPs, and payment\u2026<\/p>\n","protected":false},"author":8,"featured_media":1250,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[472,643,473],"class_list":["post-1249","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-api-security-for-upi","tag-npci-api-guidelines","tag-upi-api-security"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1249"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249\/revisions"}],"predecessor-version":[{"id":1251,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249\/revisions\/1251"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1250"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1249,"date":"2026-09-14T11:47:18","date_gmt":"2026-09-14T11:47:18","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1249"},"modified":"2026-09-14T11:47:18","modified_gmt":"2026-09-14T11:47:18","slug":"api-security-for-upi","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/api-security-for-upi\/","title":{"rendered":"API Security for UPI, PSPs and Payment Companies: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nAPI Security for UPI, PSPs and Payment Companies: 6 Essential Rules | Osto<\/title>\n<meta name=\"description\" content=\"API security for UPI, PSPs, and payment companies explained: NPCI rate limits, call governance, two-factor auth, encryption, and CERT-In audit requirements.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">API security for UPI, PSPs, and payment companies is no longer a one-time checkbox. Between the NPCI API guidelines and the RBI authentication rules, it is now a continuous, audited discipline. This guide breaks down what you must implement, and by when.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>API security for UPI and payment companies is now driven by the NPCI UPI API Security Guidelines and the RBI authentication rules. The core requirements are rate limiting on every UPI API, separating customer-initiated from system-initiated calls, two-factor authentication with a dynamic factor from April 2026, end-to-end encryption, input and output validation, and annual CERT-In empanelled audits. Non-compliance can mean throttling, penalties, or suspension from the UPI network.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why API security changed<\/a><\/li>\n <li><a href=\"#controls\">The six core controls<\/a><\/li>\n <li><a href=\"#calls\">Governing API call behaviour<\/a><\/li>\n <li><a href=\"#auth\">The two-factor mandate<\/a><\/li>\n <li><a href=\"#audit\">Audit and evidence<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why API security for UPI changed<\/h2>\n <p>As UPI grew to more than fifteen billion transactions a month, its APIs came under real strain from bots, automated scripts, and poorly configured background jobs. In response, the <a href=\"https:\/\/www.npci.org.in\/\" target=\"_blank\" rel=\"noopener\">National Payments Corporation of India<\/a> issued the UPI API Security Guidelines, and the RBI tightened authentication for all digital payments. Together they turned API security for UPI, PSPs, and payment companies from a one-time review into a continuous, governed function that runs across the whole software lifecycle: inventory, design, deployment, monitoring, and audit. For any PSP bank, acquiring bank, or UPI app provider, this is now a live obligation with hard deadlines.<\/p>\n\n <h2 class=\"sec\" id=\"controls\">The six core controls<\/h2>\n <p>The rules are detailed, but strong API security comes down to a recognisable set of controls that every PSP and payment company needs to have working and evidenced.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The controls<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the guidelines actually require<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">API security for the UPI ecosystem, and for PSPs and payment companies generally, is now governed by the NPCI UPI API Security Guidelines and the RBI authentication rules. Six controls carry most of the weight in practice.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core API security controls for UPI, PSPs, and payment companies\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core API security controls<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 18a8 8 0 1 1 16 0\"\/><path d=\"M12 18l4-5\"\/><circle cx=\"12\" cy=\"18\" r=\"1.4\" fill=\"currentColor\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Rate limiting<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cap TPS on every core UPI API<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3v6a3 3 0 0 0 3 3h6M18 21v-6a3 3 0 0 0-3-3H9\"\/><path d=\"M15 6l3-3-3-3M9 18l-3 3 3 3\" transform=\"scale(0)\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Call classification<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Separate customer vs<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">system-initiated<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Two-factor auth<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">One dynamic factor from April<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">2026<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">AES, TLS, and PKI end to end<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Validation and docs<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Input\/output checks, documented<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CERT-In audit<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Annual empanelled audit and<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">attestations<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means enforcing rate limits and a transactions-per-second cap on every core API, classifying each call as customer-initiated or system-initiated and treating them differently, implementing two-factor authentication with at least one dynamic factor, encrypting data end to end with AES, TLS, and PKI, validating all input and output while keeping APIs documented, and passing an annual CERT-In empanelled audit with quarterly self-attestations. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> across your APIs is usually the fastest way to prove these controls hold.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Security moved into the whole lifecycle<\/div>The biggest shift is that API security for UPI is no longer a pre-launch checkbox. It is a continuous function, inventory, design, deployment, monitoring, and audit, that a PSP or payment company must run and evidence all year round.<\/div>\n\n <h2 class=\"sec\" id=\"calls\">Governing API call behaviour<\/h2>\n <p>At the centre of the NPCI guidelines is a simple principle with strict mechanics: not all API calls are equal. Getting this classification right is the core of the discipline in day-to-day operations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Call governance<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Customer calls first, system calls throttled<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The heart of the NPCI guidelines is telling the two kinds of API calls apart. Customer-initiated requests are protected, while system-initiated calls must be queued and rate-limited so they cannot flood the network.<\/div>\n <svg viewBox=\"0 0 800 278\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Customer-initiated versus system-initiated UPI API calls\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Customer-initiated vs system-initiated calls<\/text>\n <rect x=\"16\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"92\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Customer-initiated<\/text>\n <line x1=\"46\" y1=\"104\" x2=\"358\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <g transform=\"translate(46,112) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"126\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Prioritised during peak load<\/text><g transform=\"translate(46,150) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"164\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Balance check: 50 per day<\/text><g transform=\"translate(46,188) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"202\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Status: 3 checks per txn<\/text><g transform=\"translate(46,226) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"240\" fill=\"#20463f\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Real user actions<\/text>\n <rect x=\"412\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"442\" y=\"92\" fill=\"#1c267a\" font-size=\"14.5\" font-weight=\"800\">System-initiated<\/text>\n <line x1=\"442\" y1=\"104\" x2=\"754\" y2=\"104\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <g transform=\"translate(442,112) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"126\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Must be queued and throttled<\/text><g transform=\"translate(442,150) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"164\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">No unbounded background calls<\/text><g transform=\"translate(442,188) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"202\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">List APIs in non-peak hours only<\/text><g transform=\"translate(442,226) scale(0.708)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"472\" y=\"240\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Bots and automation capped<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Customer-initiated calls, real actions a user takes, are prioritised, especially during peak load, but even they carry limits, such as balance-enquiry APIs restricted to a set number per customer per day and a capped number of status checks per transaction. System-initiated calls, background and automated requests, must be queued and rate-limited so they cannot overload the network, and certain list APIs are confined to non-peak hours. PSPs had to submit a formal undertaking confirming that every system-initiated API is queued and rate-limited. This behavioural governance is what keeps UPI stable at scale.<\/p>\n\n <h2 class=\"sec\" id=\"auth\">The two-factor authentication mandate<\/h2>\n <p>A second major change reshapes how payment flows are built. Under the RBI authentication rules, from April 2026 every domestic digital payment, including UPI, must use two authentication factors from different categories, with at least one dynamic factor unique to the transaction.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Authentication<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Two factors, one of them dynamic<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">From April 2026, every domestic digital payment, including UPI, needs two authentication factors from different categories, with at least one dynamic. This reshapes how PSPs and payment companies build their API flows.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The two-factor authentication mandate for UPI payments\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Two-factor authentication from April 2026<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <circle cx=\"66\" cy=\"104\" r=\"18\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.4\"\/><g transform=\"translate(57.00,95.00) scale(0.75)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"8\" cy=\"12\" r=\"3.5\"\/><path d=\"M11.5 12H20l-2 2M17 12v2.5\"\/><\/g>\n <text x=\"96\" y=\"102\" fill=\"#1c267a\" font-size=\"13.5\" font-weight=\"800\">Static factor<\/text>\n <text x=\"96\" y=\"120\" fill=\"#5b6178\" font-size=\"11.5\">Knowledge or possession<\/text>\n <line x1=\"54\" y1=\"140\" x2=\"356\" y2=\"140\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"54\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">A UPI PIN, a registered device,<\/text>\n <text x=\"54\" y=\"184\" fill=\"#4a5170\" font-size=\"12\">or a token. Not enough alone.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <circle cx=\"456\" cy=\"104\" r=\"18\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(447.00,95.00) scale(0.75)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g>\n <text x=\"486\" y=\"102\" fill=\"#0a6558\" font-size=\"13.5\" font-weight=\"800\">Dynamic factor<\/text>\n <text x=\"486\" y=\"120\" fill=\"#5b6178\" font-size=\"11.5\">Required, at least one<\/text>\n <line x1=\"444\" y1=\"140\" x2=\"746\" y2=\"140\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"444\" y=\"164\" fill=\"#4a5170\" font-size=\"12\">A one-time password or biometric,<\/text>\n <text x=\"444\" y=\"184\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">tied uniquely to the transaction.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>In practice a static factor like a UPI PIN or a registered device is no longer sufficient on its own, it must be paired with a dynamic factor such as a one-time password or a biometric. SMS one-time passwords are still allowed, but not as the only factor, and small-value contactless payments are exempted. For PSPs and payment companies, this means building secure two-factor flows into the API layer itself, part of a complete approach rather than a bolt-on.<\/p>\n\n <h2 class=\"sec\" id=\"audit\">Audit and evidence<\/h2>\n <p>The guidelines close the loop with mandatory assurance. Annual CERT-In empanelled audits of API systems are required, and PSPs file quarterly self-attestations detailing their controls, incidents, and remediation. Because the difference between a scan and a real assessment matters here, it is worth understanding how a scan differs from a penetration test, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why an automated scan alone will not satisfy an audit of your UPI APIs. Strong evidence, findings tracked to closure and confirmed by retest, is what turns compliance from a claim into something you can prove.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Non-compliance has teeth<\/div>These are not advisory guidelines. Failing to meet the API security requirements can lead to throttling of your APIs, financial penalties, or suspension from the UPI network. For a payment company, that is an existential risk, not a line item.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to API security for UPI<\/h2>\n <p>Meeting all of this, rate-limit and call-governance posture, two-factor flows, encryption, ongoing API testing, and audit-ready evidence, is a heavy lift for a lean PSP or payment company without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean payment teams. It runs VAPT across your APIs and apps, checks for the OWASP and business-logic flaws that hit payment APIs, supports encryption and monitoring, and keeps organised, audit-ready evidence, mapped across the NPCI and RBI expectations, DPDP, and 200+ frameworks on one platform. Meeting this bar, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Get API security for UPI right, and audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean payment teams. Test your APIs, harden authentication and encryption, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is API security for UPI?<\/summary><p>It is the set of controls the NPCI and RBI require for UPI APIs: rate limiting, separating customer-initiated from system-initiated calls, two-factor authentication, encryption, input and output validation, and annual CERT-In empanelled audits. It applies to PSP banks, acquiring banks, and UPI app providers.<\/p><\/details>\n <details><summary>Who must comply with the NPCI UPI API guidelines?<\/summary><p>All Payment Service Provider banks, acquiring banks, third-party app providers, and UPI app providers. PSPs were required to submit an undertaking confirming that every system-initiated API is queued and rate-limited.<\/p><\/details>\n <details><summary>What are the UPI API rate limits?<\/summary><p>NPCI caps transactions per second and limits high-frequency APIs, for example balance-enquiry calls restricted per customer per day and a limited number of status checks per transaction, with certain list APIs confined to non-peak hours. System-initiated calls must be queued and throttled.<\/p><\/details>\n <details><summary>What is the two-factor authentication rule for UPI?<\/summary><p>From April 2026, every domestic digital payment including UPI must use two authentication factors from different categories, with at least one dynamic factor unique to the transaction. A UPI PIN alone is not sufficient, and SMS one-time passwords cannot be the only factor.<\/p><\/details>\n <details><summary>Is a CERT-In audit required for UPI APIs?<\/summary><p>Yes. Annual CERT-In empanelled audits of API systems are mandatory, alongside quarterly self-attestations of controls, incidents, and remediation. Reports and evidence must be kept current.<\/p><\/details>\n <details><summary>What happens if a PSP does not comply?<\/summary><p>Non-compliance can result in throttling of APIs, financial penalties, or suspension from the UPI network. Because these guidelines are enforceable rather than advisory, API security for UPI is a business-critical obligation for any payment company.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>API Security for UPI, PSPs and Payment Companies: 6 Essential Rules | Osto API security for UPI, PSPs, and payment\u2026<\/p>\n","protected":false},"author":8,"featured_media":1250,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[472,643,473],"class_list":["post-1249","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-api-security-for-upi","tag-npci-api-guidelines","tag-upi-api-security"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1249"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249\/revisions"}],"predecessor-version":[{"id":1251,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1249\/revisions\/1251"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1250"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}