PhilSys QR Verification sandbox

Sandbox payloads for the Stateless PhilSys QR Verification endpoint.

POST /api/v3/verifications/philippines/philsys-qr-check-passthrough

When your account is in sandbox mode, these payloads return the outcomes shown below. Any other valid payload is answered as a no-match — HTTP 200 with isValid set to false. Values are case-sensitive. transactionId and createdAt are generated per request, and metadata is echoed back from your request. See Sandbox introduction for the full matching rules.

Verified

VERIFIED — sample 1

Request

{
  "qrValue": "PH1:SANDBOX-VALID-0001"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys QR Check processed successfully",
  "data": {
    "isValid": true,
    "type": "ePhilID",
    "qrValue": {
      "PCN": "1234567890123456",
      "firstName": "Juan",
      "middleName": "Santos",
      "lastName": "Dela Cruz",
      "suffix": null,
      "dateOfBirth": "1990-01-15",
      "sex": "Male",
      "placeOfBirth": "Manila",
      "dateIssued": "2023-06-01",
      "bestFingerCaptured": null
    }
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

VERIFIED — sample 2

Request

{
  "qrValue": "PH1:SANDBOX-VALID-0002"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys QR Check processed successfully",
  "data": {
    "isValid": true,
    "type": "ePhilID",
    "qrValue": {
      "PCN": "6543210987654321",
      "firstName": "Maria",
      "middleName": "Lopez",
      "lastName": "Reyes",
      "suffix": null,
      "dateOfBirth": "1985-07-22",
      "sex": "Female",
      "placeOfBirth": "Cebu City",
      "dateIssued": "2024-02-14",
      "bestFingerCaptured": null
    }
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

Rejected

A rejection is a completed verification, not an error: success is true and HTTP status is 200. In live mode a rejection is billed.

REJECTED — sample 1

Request

{
  "qrValue": "PH1:SANDBOX-INVALID-0001"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys QR Check processed successfully",
  "data": {
    "isValid": false,
    "type": "ePhilID"
  },
  "verificationStatus": "REJECTED",
  "verificationStatusCode": 1,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

A rejected QR returns no qrValue, image or signature.

REJECTED — sample 2

Request

{
  "qrValue": "PH1:SANDBOX-INVALID-0002"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys QR Check processed successfully",
  "data": {
    "isValid": false,
    "type": "ePhilID"
  },
  "verificationStatus": "REJECTED",
  "verificationStatusCode": 1,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

REJECTED — Not verified, unmatched payload fallback

Request

{
  "qrValue": "PH1:SANDBOX-UNKNOWN-0001"
}

Response — HTTP 200

{
  "success": true,
  "message": "PhilSys QR Check processed successfully",
  "data": {
    "isValid": false,
    "type": "ePhilID"
  },
  "verificationStatus": "REJECTED",
  "verificationStatusCode": 1,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

This QR value matches no documented scenario, so it takes the no-match fallback — identical to the documented rejections above apart from transactionId and metadata. Fire it once to confirm that an unknown QR never reaches the live PhilSys source.

Validation failures

All validation failures return HTTP 400 with code set to VALIDATION_FAILED and the same message; only errors differs. Validation runs before any fixture matching, so these behave identically in sandbox and live. transactionId is null and no transaction row is written.

VALIDATION_FAILED — QR value missing

Request

{
  "qrValue": ""
}

Response — HTTP 400

{
  "success": false,
  "code": "VALIDATION_FAILED",
  "message": "The request could not be validated. Please check the submitted fields.",
  "errors": {
    "qrValue": ["The qr value field is required."]
  },
  "transactionId": null,
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

VALIDATION_FAILED — QR format not supported

Request

{
  "qrValue": "not-a-philsys-qr"
}

Response — HTTP 400

{
  "success": false,
  "code": "VALIDATION_FAILED",
  "message": "The request could not be validated. Please check the submitted fields.",
  "errors": {
    "qrValue": ["The QR format is not supported."]
  },
  "transactionId": null,
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

qrValue must be an ePhilID value starting with PH1:, or a PhilID or Digital ID JSON value.

VALIDATION_FAILED — Trust flow fields sent to a stateless endpoint

Request

{
  "qrValue": "PH1:SANDBOX-VALID-0001",
  "trustFlowId": "anything"
}

Response — HTTP 400

{
  "success": false,
  "code": "VALIDATION_FAILED",
  "message": "The request could not be validated. Please check the submitted fields.",
  "errors": {
    "trustFlowId": ["The trust flow id field is prohibited."]
  },
  "transactionId": null,
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

trustFlowId and trustValidationId are prohibited on stateless endpoints. Sending either is a validation failure, not a silently ignored field.

Source unavailable

FAILED — PhilSys QR source unavailable, sample 1

Request

{
  "qrValue": "PH1:SANDBOX-UNAVAILABLE-0001"
}

Response — HTTP 500

{
  "success": false,
  "code": "PH_GOV_UNAVAILABLE",
  "message": "The Philippine government source is currently unavailable. Please try again later.",
  "verificationStatus": "FAILED",
  "verificationStatusCode": 6,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

There is no data key at all. The envelope treats code and data as mutually exclusive, so a coded failure drops data rather than emitting an empty object. Branch on code, not on the presence of data.

FAILED — PhilSys QR source unavailable, sample 2

Request

{
  "qrValue": "PH1:SANDBOX-UNAVAILABLE-0002"
}

Response — HTTP 500

{
  "success": false,
  "code": "PH_GOV_UNAVAILABLE",
  "message": "The Philippine government source is currently unavailable. Please try again later.",
  "verificationStatus": "FAILED",
  "verificationStatusCode": 6,
  "transactionId": "<uuid generated per request>",
  "verificationType": "qr_verification",
  "createdAt": "<UTC timestamp of the request>"
}

Account-level responses

Two further responses are not specific to this endpoint. A missing or invalid Authorization header returns HTTP 401, and an account without the qr_verification plan returns HTTP 403 — both enforced in sandbox exactly as in live. See Sandbox introduction for their envelopes.

Stateless API Sandbox

Australia DVS

Philippines Government

Document OCR

Verified

Rejected

Validation failures

Source unavailable

Account-level responses

​Verified

​Rejected

​Validation failures

​Source unavailable

​Account-level responses

Verified

Rejected

Validation failures

Source unavailable

Account-level responses