curl --request POST \
--url https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"dgftUsername": "<DGFT_USERNAME>",
"dgftPassword": "<DGFT_PORTAL_PASSWORD>"
}
'import requests
url = "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials"
payload = {
"dgftUsername": "<DGFT_USERNAME>",
"dgftPassword": "<DGFT_PORTAL_PASSWORD>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({dgftUsername: '<DGFT_USERNAME>', dgftPassword: '<DGFT_PORTAL_PASSWORD>'})
};
fetch('https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'dgftUsername' => '<DGFT_USERNAME>',
'dgftPassword' => '<DGFT_PORTAL_PASSWORD>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials"
payload := strings.NewReader("{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"email": "jsmith@example.com",
"type": "customer",
"companyName": "<string>",
"iec": "<string>",
"address": "<string>",
"platformId": "<string>",
"mode": "test",
"isActive": true,
"hasDgftCredentials": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}Validate Customer
Validate and securely store an exporter’s DGFT portal credentials for a platform customer. Required before you fetch their IRMs or generate an eBRC for them.
curl --request POST \
--url https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"dgftUsername": "<DGFT_USERNAME>",
"dgftPassword": "<DGFT_PORTAL_PASSWORD>"
}
'import requests
url = "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials"
payload = {
"dgftUsername": "<DGFT_USERNAME>",
"dgftPassword": "<DGFT_PORTAL_PASSWORD>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({dgftUsername: '<DGFT_USERNAME>', dgftPassword: '<DGFT_PORTAL_PASSWORD>'})
};
fetch('https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'dgftUsername' => '<DGFT_USERNAME>',
'dgftPassword' => '<DGFT_PORTAL_PASSWORD>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials"
payload := strings.NewReader("{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.ebrc.in/api/v1/platform-customers/{id}/check-dgft-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"dgftUsername\": \"<DGFT_USERNAME>\",\n \"dgftPassword\": \"<DGFT_PORTAL_PASSWORD>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"email": "jsmith@example.com",
"type": "customer",
"companyName": "<string>",
"iec": "<string>",
"address": "<string>",
"platformId": "<string>",
"mode": "test",
"isActive": true,
"hasDgftCredentials": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}{
"code": "<string>",
"message": "<string>"
}What success changes
On a successful validation the client’sisActive becomes true immediately, the DGFT connection is stored against the client, and hasDgftCredentials becomes true. Nothing else on the client is modified.
This is the same operation the eBRC console runs when a platform user submits or rotates a client’s DGFT credentials, so a client onboarded either way reaches the same state.
Request example
curl --location 'https://api.ebrc.in/api/v1/platform-customers/ee849a90-7a28-49b4-8cb2-8e31041650a2/check-dgft-credentials' \
--header 'x-api-key: <YOUR_API_KEY>' \
--header 'Content-Type: application/json' \
--data-raw '{
"dgftUsername": "<DGFT_USERNAME>",
"dgftPassword": "<DGFT_PORTAL_PASSWORD>"
}'
Response example
Returns201 with the client in the data field. isActive and hasDgftCredentials are now both true.
{
"success": true,
"data": {
"id": "ee849a90-7a28-49b4-8cb2-8e31041650a2",
"name": "Rohan Mehta",
"email": "finance@suryatextiles.example.com",
"type": "customer",
"companyName": "Surya Textile Exports Pvt Ltd",
"iec": "AAECS1234F",
"address": "Tiruppur, Tamil Nadu",
"platformId": "1f0c9a52-3b41-4d78-9e26-7a8b5c4d3e2f",
"mode": "live",
"isActive": true,
"hasDgftCredentials": true,
"dgftApiStatus": {
"state": "ready",
"activatesAt": null,
"registration": "generated",
"sharedCredentialsLikely": false
},
"createdAt": "2026-07-22T10:15:04.874Z",
"updatedAt": "2026-07-22T10:21:33.120Z"
},
"statusCode": 201,
"timestamp": "2026-07-22T10:21:33.145Z"
}
dgftApiStatus before the first refresh. If the exporter already held DGFT API credentials, the response carries "state": "activation_pending" with an activatesAt timestamp: DGFT enables our IP on that account after 24 hours, and IRM refreshes until then answer 409 DGFT_IP_ACTIVATION_PENDING. Nothing is wrong and nothing needs re-submitting. See the 24-hour activation.Errors
400Invalid DGFT credentialswhen the DGFT portal rejects the username and password. The client stays inactive.400DGFT credentials are already set for this customerwhen you send a username different from the one already stored. Password rotation is supported, changing the username is not.400DGFT username already in usewhen that username is already linked to another of your clients in this mode.400DGFT username already aligned with another platform customerwhen the DGFT account is already connected to a different client of yours in this mode.400Validation failedwhendgftUsernameordgftPasswordis missing or empty.401No API key providedorInvalid API key. See authentication errors.404Platform customer not foundwhen no client with that id exists under your account in the mode your key selects. Adev_key cannot reach a live client.429when you exceed 4 calls per minute. See rate limits.500Error checking DGFT credentialswhen the portal check could not be completed. Retry after a short delay.
DGFT_CREDENTIALS_INVALID. Recover by calling this endpoint again with the new password. See DGFT credential error codes.
Next steps
- Fetch the customer’s IRMs once the client is active.
- Submit IRMs for generation.
- Download eBRC PDF shows credential recovery end to end.
Authorizations
Path Parameters
The customer ID
Body
Response
Credentials validated, client is now active
Unique identifier of the platform customer. This is the platformCustomerId used in every later call.
customer The exporter's registered legal name. Required by the eBRC console, optional on this API.
Importer Exporter Code: exactly 10 alphanumeric characters, stored uppercase. Required by the eBRC console, optional on this API.
10^[A-Za-z0-9]{10}$Free text. Not collected by the eBRC console, so console-onboarded clients have none.
Platform account that owns this client
Fixed at creation from the API key prefix and never editable. Returned by create, update and validate; omitted by the list and get endpoints.
test, live Always false at creation. Becomes true only when DGFT credentials are verified by POST /platform-customers/{id}/check-dgft-credentials.
Derived: true once DGFT credentials are on file. Branch on this; the raw DGFT credential fields are not part of the response contract and the password is never returned on any surface.
Not returned by GET /platform-customers (list).