> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idmetagroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PhilSys QR Verification sandbox

> Predetermined API payloads to retrieve every PhilSys QR Verification status in sandbox mode.

Sandbox payloads for the [Stateless PhilSys QR Verification](https://docs.idmetagroup.com/stateless-verification-api/philippines-government/philsys-qr-verification.md) endpoint.

```http theme={null}
POST /api/v3/verifications/philippines/philsys-qr-check-passthrough
```

When your account is in sandbox mode, these payloads return the outcomes shown below. Any other valid payload is answered as a no-match — HTTP `200` with `isValid` set to `false`.

Values are case-sensitive. `transactionId` and `createdAt` are generated per request, and `metadata` is echoed back from your request. See [Sandbox introduction](https://docs.idmetagroup.com/stateless-verification-api/sandbox.md) for the full matching rules.

### Verified

> **VERIFIED — sample 1**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-VALID-0001"
> }
> ```
>
> **Response** — HTTP `200`
>
> ```json theme={null}
> {
>   "success": true,
>   "message": "PhilSys QR Check processed successfully",
>   "data": {
>     "isValid": true,
>     "type": "ePhilID",
>     "qrValue": {
>       "PCN": "1234567890123456",
>       "firstName": "Juan",
>       "middleName": "Santos",
>       "lastName": "Dela Cruz",
>       "suffix": null,
>       "dateOfBirth": "1990-01-15",
>       "sex": "Male",
>       "placeOfBirth": "Manila",
>       "dateIssued": "2023-06-01",
>       "bestFingerCaptured": null
>     }
>   },
>   "verificationStatus": "VERIFIED",
>   "verificationStatusCode": 3,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```

> **VERIFIED — sample 2**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-VALID-0002"
> }
> ```
>
> **Response** — HTTP `200`
>
> ```json theme={null}
> {
>   "success": true,
>   "message": "PhilSys QR Check processed successfully",
>   "data": {
>     "isValid": true,
>     "type": "ePhilID",
>     "qrValue": {
>       "PCN": "6543210987654321",
>       "firstName": "Maria",
>       "middleName": "Lopez",
>       "lastName": "Reyes",
>       "suffix": null,
>       "dateOfBirth": "1985-07-22",
>       "sex": "Female",
>       "placeOfBirth": "Cebu City",
>       "dateIssued": "2024-02-14",
>       "bestFingerCaptured": null
>     }
>   },
>   "verificationStatus": "VERIFIED",
>   "verificationStatusCode": 3,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```

### Rejected

A rejection is a completed verification, not an error: `success` is `true` and HTTP status is `200`. In live mode a rejection is billed.

> **REJECTED — sample 1**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-INVALID-0001"
> }
> ```
>
> **Response** — HTTP `200`
>
> ```json theme={null}
> {
>   "success": true,
>   "message": "PhilSys QR Check processed successfully",
>   "data": {
>     "isValid": false,
>     "type": "ePhilID"
>   },
>   "verificationStatus": "REJECTED",
>   "verificationStatusCode": 1,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```
>
> A rejected QR returns no `qrValue`, `image` or `signature`.

> **REJECTED — sample 2**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-INVALID-0002"
> }
> ```
>
> **Response** — HTTP `200`
>
> ```json theme={null}
> {
>   "success": true,
>   "message": "PhilSys QR Check processed successfully",
>   "data": {
>     "isValid": false,
>     "type": "ePhilID"
>   },
>   "verificationStatus": "REJECTED",
>   "verificationStatusCode": 1,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```

> **REJECTED — Not verified, unmatched payload fallback**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-UNKNOWN-0001"
> }
> ```
>
> **Response** — HTTP `200`
>
> ```json theme={null}
> {
>   "success": true,
>   "message": "PhilSys QR Check processed successfully",
>   "data": {
>     "isValid": false,
>     "type": "ePhilID"
>   },
>   "verificationStatus": "REJECTED",
>   "verificationStatusCode": 1,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```
>
> This QR value matches no documented scenario, so it takes the no-match fallback — identical to the documented rejections above apart from `transactionId` and `metadata`. Fire it once to confirm that an unknown QR never reaches the live PhilSys source.

### Validation failures

All validation failures return HTTP `400` with `code` set to `VALIDATION_FAILED` and the same message; only `errors` differs. Validation runs before any fixture matching, so these behave identically in sandbox and live. `transactionId` is `null` and no transaction row is written.

> **VALIDATION\_FAILED — QR value missing**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": ""
> }
> ```
>
> **Response** — HTTP `400`
>
> ```json theme={null}
> {
>   "success": false,
>   "code": "VALIDATION_FAILED",
>   "message": "The request could not be validated. Please check the submitted fields.",
>   "errors": {
>     "qrValue": ["The qr value field is required."]
>   },
>   "transactionId": null,
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```

> **VALIDATION\_FAILED — QR format not supported**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "not-a-philsys-qr"
> }
> ```
>
> **Response** — HTTP `400`
>
> ```json theme={null}
> {
>   "success": false,
>   "code": "VALIDATION_FAILED",
>   "message": "The request could not be validated. Please check the submitted fields.",
>   "errors": {
>     "qrValue": ["The QR format is not supported."]
>   },
>   "transactionId": null,
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```
>
> `qrValue` must be an ePhilID value starting with `PH1:`, or a PhilID or Digital ID JSON value.

> **VALIDATION\_FAILED — Trust flow fields sent to a stateless endpoint**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-VALID-0001",
>   "trustFlowId": "anything"
> }
> ```
>
> **Response** — HTTP `400`
>
> ```json theme={null}
> {
>   "success": false,
>   "code": "VALIDATION_FAILED",
>   "message": "The request could not be validated. Please check the submitted fields.",
>   "errors": {
>     "trustFlowId": ["The trust flow id field is prohibited."]
>   },
>   "transactionId": null,
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```
>
> > [!WARNING]
> >
> > `trustFlowId` and `trustValidationId` are prohibited on stateless endpoints. Sending either is a validation failure, not a silently ignored field.

### Source unavailable

> **FAILED — PhilSys QR source unavailable, sample 1**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-UNAVAILABLE-0001"
> }
> ```
>
> **Response** — HTTP `500`
>
> ```json theme={null}
> {
>   "success": false,
>   "code": "PH_GOV_UNAVAILABLE",
>   "message": "The Philippine government source is currently unavailable. Please try again later.",
>   "verificationStatus": "FAILED",
>   "verificationStatusCode": 6,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```
>
> There is no `data` key at all. The envelope treats `code` and `data` as mutually exclusive, so a coded failure drops `data` rather than emitting an empty object. Branch on `code`, not on the presence of `data`.

> **FAILED — PhilSys QR source unavailable, sample 2**
>
> **Request**
>
> ```json theme={null}
> {
>   "qrValue": "PH1:SANDBOX-UNAVAILABLE-0002"
> }
> ```
>
> **Response** — HTTP `500`
>
> ```json theme={null}
> {
>   "success": false,
>   "code": "PH_GOV_UNAVAILABLE",
>   "message": "The Philippine government source is currently unavailable. Please try again later.",
>   "verificationStatus": "FAILED",
>   "verificationStatusCode": 6,
>   "transactionId": "<uuid generated per request>",
>   "verificationType": "qr_verification",
>   "createdAt": "<UTC timestamp of the request>"
> }
> ```

### Account-level responses

Two further responses are not specific to this endpoint. A missing or invalid `Authorization` header returns HTTP `401`, and an account without the `qr_verification` plan returns HTTP `403` — both enforced in sandbox exactly as in live. See [Sandbox introduction](https://docs.idmetagroup.com/stateless-verification-api/sandbox.md#non-verification-responses) for their envelopes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.