Skip to main content
Sandbox payloads for the Stateless Dukcapil Full endpoint.
When your account is in sandbox mode, these payloads return the outcomes shown below. Any other valid payload is answered as a no-match — HTTP 200 with isValid set to false. Values are case-sensitive. transactionId and createdAt are generated per request, and metadata is echoed back from your request. See Sandbox introduction for the full matching rules.
selfieImage is required but ignored for matching — send any valid base64 image or image upload. The scenario is chosen by nik, name and dateOfBirth, so you can test with a real selfie from your capture flow.
Send only the keys shown in each request. Matching is exact on the key set, so adding an optional field such as gender or address to a documented payload turns it into a no-match.
A face match passes at a selfieImagePercentage of 70 or higher.

Verified

Request
Response — HTTP 200
Request
Response — HTTP 200
Optional fields are checked against the Dukcapil record but are not echoed in the response. Send them exactly as shown — this payload only matches with both placeOfBirth and gender present.

Rejected

A rejection is a completed verification, not an error: success is true and HTTP status is 200. In live mode a rejection is billed.
Request
Response — HTTP 200
Identity matched, but the face score is below 70.
Request
Response — HTTP 200
Request
Response — HTTP 200
Request
Response — HTTP 200
This NIK matches no documented scenario, so it takes the no-match fallback. No face comparison took place, so selfieImagePercentage is null.

Validation failures

All validation failures return HTTP 400 with code set to VALIDATION_FAILED and the same message; only errors differs. Validation runs before any fixture matching, so these behave identically in sandbox and live. transactionId is null and no transaction row is written.
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
trustFlowId and trustValidationId are prohibited on stateless endpoints. Sending either is a validation failure, not a silently ignored field.

Source unavailable

Request
Response — HTTP 500
There is no data key at all. Branch on code, not on the presence of data. In live mode this failure is not billed.

Account-level responses

A missing or invalid Authorization header returns HTTP 401, and an account without the dukcapil_full plan returns HTTP 403 — both enforced in sandbox exactly as in live. See Sandbox introduction for their envelopes.