PhilSys Check Tier 2 sandbox

Sandbox payloads for the Stateless PhilSys Check Tier 2 endpoint.

POST /api/v3/verifications/philippines/philsys-check-passthrough

When your account is in sandbox mode, these payloads return the outcomes shown below. Any other valid payload is answered as a no-match — HTTP 200 with isValid set to false. Values are case-sensitive. transactionId and createdAt are generated per request, and metadata is echoed back from your request. See Sandbox introduction for the full matching rules. Every request needs faceLivenessSessionId plus exactly one of pcn, pcnFormData, or qrData. Sending two, or none, fails validation.

Verified

VERIFIED — Successfully verified via PCN number

Request

{
  "faceLivenessSessionId": "0f8a7c31-5d64-4e2b-9a17-3c6b8e2d4f10",
  "pcn": "3721-0948-5163-2807"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "JUAN CARLOS DELA CRUZ",
    "firstName": "JUAN",
    "middleName": "CARLOS",
    "lastName": "DELA CRUZ",
    "suffix": null,
    "gender": "Male",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1988-03-14",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines"
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

VERIFIED — Successfully verified via ePhilID QR code

Request

{
  "faceLivenessSessionId": "1b93d5e7-2a48-4c91-8f06-7d2e5a9c3b84",
  "qrData": "PH1:4085273619042758:MARIA ISABEL:SANTOS REYES:1992-07-22:F"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "MARIA ISABEL SANTOS REYES",
    "firstName": "MARIA ISABEL",
    "middleName": "SANTOS",
    "lastName": "REYES",
    "suffix": null,
    "gender": "Female",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1992-07-22",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines",
    "type": "ePhilID",
    "PCN": "4085-2736-1904-2758",
    "dateOfBirth": "1992-07-22",
    "sex": "Female",
    "image": "data:image/webp;base64,UklGRhoAAABXRUJQVlA4TA0AAAAvAAAAEAcQERGIiP4HAA=="
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

The ePhilID QR is a colon-delimited string beginning with PH1:. The 16-digit PCN it carries is returned formatted with dashes in PCN.

VERIFIED — Successfully verified via Digital ID QR code

Request

{
  "faceLivenessSessionId": "2c47f8a0-6b13-4d85-a29e-5f1c7b3d9e62",
  "qrData": "{\"iss\":\"PSA\",\"v\":\"1.0\",\"id\":\"K7M2Q9X\",\"z\":\"tHq4Zr8XmPcL2vKdN6sYwA9bE3fJgU5oR1nT7iBxCyDzSaFhVeMjQkWlOpIuGt\",\"type\":\"DigitalID\"}"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "PEDRO ANTONIO RAMOS",
    "firstName": "PEDRO",
    "middleName": "ANTONIO",
    "lastName": "RAMOS",
    "suffix": null,
    "gender": "Male",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1995-11-08",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines",
    "type": "DigitalID",
    "digitalId": "K7M2Q9X",
    "sex": "Male",
    "image": "data:image/webp;base64,UklGRhoAAABXRUJQVlA4TA0AAAAvAAAAEAcQERGIiP4HAA=="
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

The Digital ID QR is a JSON string. Its id is echoed back as digitalId and must be alphanumeric and no more than 7 characters.

VERIFIED — Successfully verified via PhilID / PVC QR code

Request

{
  "faceLivenessSessionId": "3d56a9b2-7c84-4f31-b60d-8e2a4c7f1953",
  "qrData": "{\"alg\":\"EDDSA\",\"signature\":\"mQ8xTvKr3ZpLc7NwYd2SbG5jHf9AeUoRi4tXnB6CyDzVaMhQkWlOpIuGtEsFrJ\",\"pcn\":\"5290-6174-8352-0916\"}"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "ANA LUCIA BAUTISTA",
    "firstName": "ANA LUCIA",
    "middleName": "MENDOZA",
    "lastName": "BAUTISTA",
    "suffix": null,
    "gender": "Female",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1990-09-30",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines",
    "type": "PhilID",
    "PCN": "5290-6174-8352-0916",
    "fName": "ANA LUCIA",
    "mName": "MENDOZA",
    "lName": "BAUTISTA",
    "DOB": "1990-09-30",
    "sex": "Female",
    "image": "data:image/webp;base64,UklGRhoAAABXRUJQVlA4TA0AAAAvAAAAEAcQERGIiP4HAA=="
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

This response carries each name field twice — once normalised (firstName, middleName, lastName, birthDate) and once in the PVC card’s native abbreviated keys (fName, mName, lName, DOB). Read the normalised keys.

VERIFIED — Successfully verified via personal information

Request

{
  "faceLivenessSessionId": "4e67b0c3-8d95-4a72-c51e-9f3b5d8a2064",
  "pcnFormData": {
    "firstName": "ROSA",
    "middleName": "AQUINO",
    "lastName": "VILLANUEVA",
    "suffix": "N/A",
    "birthDate": "1985-12-05"
  }
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "ROSA AQUINO VILLANUEVA",
    "firstName": "ROSA",
    "middleName": "AQUINO",
    "lastName": "VILLANUEVA",
    "suffix": null,
    "gender": "Female",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1985-12-05",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines"
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

A suffix of "N/A" is returned as null. Send "N/A" when the person has no suffix.

VERIFIED — Successfully verified with a live face liveness session

Request

{
  "faceLivenessSessionId": "<any valid UUID, including a real session id>",
  "pcn": "9999-0000-9999-0000"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": true,
    "faceUrl": "https://storage.sample.com/face_url.jpeg",
    "fullName": "JOSE MIGUEL TORRES",
    "firstName": "JOSE MIGUEL",
    "middleName": "GARCIA",
    "lastName": "TORRES",
    "suffix": null,
    "gender": "Male",
    "maritalStatus": "Single",
    "bloodType": "Unknown",
    "email": "N/A",
    "mobileNumber": "630123456789",
    "birthDate": "1993-06-18",
    "fullAddress": "PAMPANGA, PHILIPPINES, 2005",
    "addressLine1": "PUROK 123",
    "addressLine2": null,
    "barangay": "San Diego",
    "municipality": "Lubao",
    "province": "Pampanga",
    "country": "Philippines",
    "postalCode": "2005",
    "presentFullAddress": "FULL ADDRESS",
    "presentAddressLine1": "PUROK 2",
    "presentAddressLine2": null,
    "presentBarangay": "San Vicente",
    "presentMunicipality": "Lubao",
    "presentProvince": "Pampanga",
    "presentCountry": "Philippines",
    "presentPostalCode": "2005",
    "residencyStatus": "N/A",
    "placeOfBirth": "LUBAO, PAMPANGA",
    "pobMunicipality": "Lubao",
    "pobProvince": "Pampanga",
    "pobCountry": "Philippines"
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

PCN 9999-0000-9999-0000 accepts any valid UUID as its faceLivenessSessionId, including a session id from a real liveness capture. Use it to test the full capture-then-verify flow end to end.

Rejected

A rejection is a completed verification, not an error: success is true, HTTP status is 200, and no identity fields are emitted. In live mode a rejection is billed.

REJECTED — Not verified against the PhilSys record

Request

{
  "faceLivenessSessionId": "5f78c1d4-9e06-4b83-d62f-0a4c6e9b3175",
  "pcn": "6403-8291-5740-1638"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": false
  },
  "verificationStatus": "REJECTED",
  "verificationStatusCode": 1,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

REJECTED — Not verified, unmatched payload fallback

Request

{
  "faceLivenessSessionId": "8c4f0a32-5b19-4e67-9d2a-3f7b1c6e0458",
  "pcn": "1357-2468-1357-2468"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys Check processed successfully",
  "data": {
    "isValid": false
  },
  "verificationStatus": "REJECTED",
  "verificationStatusCode": 1,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

This PCN matches no documented scenario, so it takes the no-match fallback — byte-identical to the documented rejection above apart from transactionId and metadata. Worth firing once to confirm that an unknown PCN never reaches live PhilSys.

Validation failures

All validation failures return HTTP 400 with code set to VALIDATION_FAILED and the same message; only errors differs. Validation runs before any fixture matching, so these behave identically in sandbox and live.

VALIDATION_FAILED — Face liveness session invalid or expired

Request

{
  "faceLivenessSessionId": "00000000-0000-4000-8000-000000000000",
  "pcn": "3721-0948-5163-2807"
}

Response — HTTP 400

{
  "success": false,
  "code": "VALIDATION_FAILED",
  "message": "The request could not be validated. Please check the submitted fields.",
  "errors": {
    "faceLivenessSessionId": [
      "The face liveness session is invalid or has expired."
    ]
  },
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

This is the only 400 that carries a real transactionId and echoes metadata. The request reached the service, so a transaction row was written with status FAILED (6). Every other 400 returns transactionId: null, omits metadata, and writes no row.

VALIDATION_FAILED — Request shape rejected before processing

These fail before the service is reached. Every one returns HTTP 400 with the same envelope:

{
  "success": false,
  "code": "VALIDATION_FAILED",
  "message": "The request could not be validated. Please check the submitted fields.",
  "errors": {},
  "transactionId": null,
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

Only errors differs. Each row below is a change to the by-PCN request:

Send	`errors`
Both `pcn` and `qrData`	`{ "input": ["Provide exactly one of pcn, pcnFormData, or qrData."] }`
Neither `pcn`, `pcnFormData`, nor `qrData`	`{ "input": ["Provide exactly one of pcn, pcnFormData, or qrData."] }`
`"pcn": "37210948"`	`{ "pcn": ["The PCN must contain exactly 16 digits."] }`
`"qrData": "not-a-philsys-qr"`	`{ "qrData": ["The QR format is not supported."] }`
Digital ID QR with `"id": "K7M2Q9XLONG"`	`{ "qrData": ["Digital ID must be alphanumeric and contain no more than 7 characters."] }`
`"trustFlowId": "anything"`	`{ "trustFlowId": ["The trust flow id field is prohibited."] }`
No `faceLivenessSessionId`	`{ "faceLivenessSessionId": ["The face liveness session id field is required."] }`

trustFlowId and trustValidationId are prohibited on stateless endpoints. Sending either is a validation failure, not a silently ignored field.

Source unavailable

FAILED — PhilSys source unavailable

Request

{
  "faceLivenessSessionId": "6a89d2e5-0f17-4c94-e73a-1b5d7f0c4286",
  "pcn": "7516-3820-9471-5029"
}

Response — HTTP 500

{
  "success": false,
  "code": "PH_GOV_UNAVAILABLE",
  "message": "The Philippine government source is currently unavailable. Please try again later.",
  "verificationStatus": "FAILED",
  "verificationStatusCode": 6,
  "transactionId": "<uuid generated per request>",
  "verificationType": "philsys_check_tier_2",
  "createdAt": "<UTC timestamp of the request>"
}

There is no data key at all. The envelope treats code and data as mutually exclusive, so a coded failure drops data rather than emitting an empty object. Branch on code, not on the presence of data.

Account-level responses

Two further responses are not specific to this endpoint. A missing or invalid Authorization header returns HTTP 401, and an account without the scan_qr plan returns HTTP 403 — both enforced in sandbox exactly as in live. See Sandbox introduction for their envelopes.

Stateless API Sandbox

Australia DVS

Philippines Government

Verified

Rejected

Validation failures

Source unavailable

Account-level responses

​Verified

​Rejected

​Validation failures

​Source unavailable

​Account-level responses

Verified

Rejected

Validation failures

Source unavailable

Account-level responses