Authentication context class reference (ACR)

Basic assurance, not requiring the user having gone through identity verification. Presently, this represents the default identity behavior, if not otherwise specified. The user has supplied, at a minimum, self-asserted values for first name, last name, email, phone number, and date of birth (optional depending on client-specific configuration).

Requires that the user has gone through identity verification with EiMP, and supplied, at a minimum, the first name, last name, date of birth, and unique identifier. The user's HSID uuid (claim sub) will be stored in EiMP golden record with the UHG enterprise id and may be queried from the Identity User-Service API.

Requires that the user has gone through multi factor authentication (MFA). The current (Feb 2025) HSID MFA method is Phone OTP verification (either text message or call), therefore, putting urn:aikyam:aal:mfa in acr_values request parameter, the OIDC flow forces phone OTP verification even for the already-authenticated End User. This is useful when Client Application wants to force MFA to the End User before executing high-risk transaction in their application. (See Step-up AuthN & Identification (Portal High Risk Transaction) section)

Requires that the user has gone through phone-based identity confirmation (PBIC). This works the same as urn:aikyam:aal:mfa acr above, however, the differences are:

• PBIC requires identity confirmation in addition to Phone OTP verification, by comparing HSID account holder’s identity with Phone Carrier provided identity information associated with the phone, checking fraud records / usage patterns of the phone number, etc.
• HSID account holder can use a non HSID account-owned phone number to pass PBIC. While PBIC process asks PBIC for HSID account-owned phone number first, if the account holder were not able to pass PBIC with HSID account-owned phone number for some reason, they could switch to a different phone number during PBIC process.
• PBIC failure does not trigger HSID account lock or HSID session termination, and returns to the redirect_uri with OIDC authentication error response, with the error code of unmet_authentication_requirements.

Requires that the user satisfies AAL2 (Authentication Assurance Level 2). Currently (Feb 2026), HSID user can satisfy AAL2 by going through either:

• Password authentication + Phone OTP (text or call)
• Passkey authentication

Once the user satisfies AAL2 in the authenticated session, the assurance persists until the authenticated session is expired.

For the details, please see Step-up AuthN & Identification (Portal High Risk Transaction)section.

Requires that the user satisfies IAL2 (Identity Assurance Level 2). Currently (Mar 2026), HSID user can satisfy IAL2 by going through DBIC (Document Based Identity Confirmation – utilizing LexisNexis IDVerse and Flex ID, which requires government-issued photo IDs and biometrics verification).

Once the user satisfies IAL2, the assurance persists rest of their HSID account lifetime, and the account holder does not need to go through DBIC again.

For the details, please see Step-up AuthN & Identification (Portal High Risk Transaction)section.

Requires that the user satisfies DBIC (see above, urn:aikyam:ial:ial2 acr). The difference between IAL2 and IAL1 Document Verification is that:

• IAL2 performs IDVerse verification first, when it passes, then performs Flex ID verification
• IAL1 Document Verification performs IDVerse verification only

The area that IAL1 Document Verification does not cover (i.e. Flex ID covers) is the authenticity verification of the document through the document issuer’s information. For example:

• Whether the document was revoked by the issuer (loss, violation, relocation, status change, etc) before the expiration date
• Whether the owner of the document is deceased or not

Requires that the user satisfies PBIC (see above, urn:aikyam:ial:pbic acr). The differences from pbic acr are:

• The verified phone number through this identification is registered as the phone number of HSID account owner.
• The PBIC verification record persists with HSID account, and the account holder does not need to go through IAL1 Phone Verification again.
• IAL1 Phone Verification failure falls back to IAL1 Document Verification (see above).

For the details, please see Step-up AuthN & Identification (Portal High Risk Transaction)section.