UPI Testing
Save your workspace key — shown once.

YA8A-8V71-41J1-N2E9

Why it matters
It is the only way to reach these profiles and results from another device. The lab stores a hash of it, so nobody here can recover it for you.

BHIM

BH-009 Needs your identifiers

BHIM — Documented initiation metadata

No mode and orgid and sign set, so this is the same payload as the plain control.
Why
Profile P09 is defined by mode and orgid and sign, and neither your UPI profile nor this run supplies one — so comparing P09 against P01 would be comparing a method against itself and reading the noise as a finding. Set mode and orgid and sign on the profile first, or run P01 and know what you measured.
pa — A payment needs a payee address. Nothing can be launched without pa.
Missing orgid — values a bank, PSP or acquirer issues and the lab must never invent.
What would unblock it
Needs an orgid your PSP issued you, and — to be a genuine signed intent — a sign they generated. The lab will not create either. Until you supply them this method cannot run, because sending a made-up orgid tests nothing that exists.
Advanced details
Launch
Scheme
intent:// (Android only)
Profile
P09 — P01 + mode + orgid (+ sign when supplied)
Platform
Android
Browser
Android: Chrome or any browser that follows intent: URIs. iOS: Safari, only where the app registers a scheme.
Docs
NPCI UPI Linking Specification — BHIM is the reference implementation of the generic upi:// handling. (npci spec)
Reference
LABPDJ9R8QQRB0T
Registry
1.0.0

How an app treats a payload that declares an initiation mode and a signing organisation. Only meaningful with real values.

Expected

BHIM opens on its payment confirmation screen showing the payee and ₹2.00. How an app treats a payload that declares an initiation mode and a signing organisation. Only meaningful with real values.

Limitations

  • A browser cannot tell you whether an app is installed. "App did not open" and "app is not installed" look identical from here; AN-004 in the Android harness is what separates them.
  • Not runnable on iOS at all through this method.

Prerequisites

  • A saved UPI profile with a payee address.
  • Needs an orgid your PSP issued you, and — to be a genuine signed intent — a sign they generated. The lab will not create either. Until you supply them this method cannot run, because sending a made-up orgid tests nothing that exists.
  • On iOS: not addressable — BHIM publishes no URI scheme the lab is willing to claim. Use the Generic UPI group (GN) on iPhone.
  • On Android: BHIM installed (in.org.npci.upiapp).

Notes

  • BHIM publishes no URI scheme the lab is willing to claim, so it cannot be addressed directly from a non-Android browser.

How the lab runs it

Android: an intent:// URI naming in.org.npci.upiapp, with no browser_fallback_url so a failure to open stays visible. iOS: not implemented, because no scheme exists to implement.