Skip to main content
Sandbox payloads for the Stateless NBI Clearance endpoint.
When your account is in sandbox mode, these payloads return the outcomes shown below. Any other valid payload is answered as a no-match — HTTP 200 with isValid set to false. Values are case-sensitive. transactionId and createdAt are generated per request, and metadata is echoed back from your request. See Sandbox introduction for the full matching rules.
In live mode clearanceNo is upper-cased before it is sent to the NBI source. Sandbox matching runs on the value exactly as you send it, so nbisandbox-0000001 does not match NBISANDBOX-0000001 and is answered as a no-match.

Verified

Request
Response — HTTP 200
clearanceExpiry is always returned as yyyy-mm-dd.
Request
Response — HTTP 200
middlename is only present when the clearance holder has one. Treat it as optional.

Rejected

A rejection is a completed verification, not an error: success is true and HTTP status is 200. In live mode a rejection is billed.
Request
Response — HTTP 200
The clearance exists, so the holder’s details are still returned, but it is no longer current. Do not treat the presence of lastname or clearanceNumber as a pass — branch on isValid or verificationStatus.
Request
Response — HTTP 200
Request
Response — HTTP 200
No record exists for this clearance number, so only isValid is returned.
Request
Response — HTTP 200
This clearance number matches no documented scenario, so it takes the no-match fallback — identical to the not-found rejection above apart from transactionId and metadata. Fire it once to confirm that an unknown clearance never reaches the live NBI source.

Validation failures

All validation failures return HTTP 400 with code set to VALIDATION_FAILED and the same message; only errors differs. Validation runs before any fixture matching, so these behave identically in sandbox and live. transactionId is null and no transaction row is written.
Request
Response — HTTP 400
Request
Response — HTTP 400
Request
Response — HTTP 400
trustFlowId and trustValidationId are prohibited on stateless endpoints. Sending either is a validation failure, not a silently ignored field.

Source unavailable

Request
Response — HTTP 500
There is no data key at all. The envelope treats code and data as mutually exclusive, so a coded failure drops data rather than emitting an empty object. Branch on code, not on the presence of data.

Account-level responses

Two further responses are not specific to this endpoint. A missing or invalid Authorization header returns HTTP 401, and an account without the philippines_nbi_clearance plan returns HTTP 403 — both enforced in sandbox exactly as in live. See Sandbox introduction for their envelopes.