Identity lookup

CPF lookup

Official individual registry data for a CPF plus date of birth.

GET/openapi/v3/consultas/cpf/{cpf}/{nascimento}

Requires the token, timestamp and sign signature headers, see Authentication.

Returns individual registry data for an 11-digit personal tax number plus date of birth: name, registration status and date of birth. The upstream source validates CPF and date of birth as a pair; a mismatched pair and a non-existent CPF both return the same code 10016003, deliberately indistinguishable (see Identity lookup).

GET request: the signed body is the empty string and both path variables are part of the signed path. The response is a bare object with no platform envelope.

Parameters

Path parameters

cpfstringrequired
11 digits, digits only; formatting characters are not accepted.
Example: 40710536828
nascimentostringrequired
Date of birth, DDMMYYYY, 8 digits (e.g. 09011997 = 9 January 1997).
Example: 09011997

Responses

200

Lookup succeeded; adult holder. Individual registry data.

nistring
CPF, 11 digits.
nomestring
Individual's full name.
situacaoobject
Registration status.
nascimentostring
Date of birth, echoed back in the original DDMMYYYY format.

Errors

Code	HTTP
10016000	400	Invalid CPF format (11 digits required). Check for stray formatting characters or wrong length.
10016001	400	Invalid CPF check digits. Validate locally with the mod-11 algorithm first to avoid wasted calls.
10016002	400	Invalid date of birth (valid DDMMYYYY required). Note the day-month-year order, and that the date must actually exist.
10016003	400	CPF not found: the CPF does not exist or the CPF and date of birth do not match (deliberately indistinguishable). Billed per call.
10016005	422	`LGPD: menor de idade`: holder is 16 to 17 years old. Data lawfully withheld by the upstream source, no personal fields; do not retry. Billed per call.
10016004	451	`LGPD: menor de 16 anos (Lei Felca)`: holder is under 16. Data lawfully withheld, no personal fields; do not retry. Billed per call.
10016006	428	`LGPD: idade nao verificavel - informe a data de nascimento para completar a verificacao`: age cannot be verified. The platform already re-verified once with the date of birth you supplied; do not retry. Not billed.
10016020	503	Upstream data source is temporarily unavailable. Retry with exponential backoff (start at 1 s, double up to 30 s, add jitter); contact the platform if it persists. Not billed.

situacao.codigo values

Code	Description	Meaning
`0`	REGULAR	Regular
`2`	SUSPENSA	Suspended
`3`	TITULAR FALECIDO	Holder deceased
`4`	PENDENTE DE REGULARIZACAO	Pending regularisation
`5`	CANCELADA POR MULTIPLICIDADE	Cancelled (duplicate registration)
`8`	NULA	Void
`9`	CANCELADA DE OFICIO	Cancelled ex officio

Business note: when codigo is not 0, it is up to the caller to decide whether the business flow may continue. Issuing an invoice to a deceased holder (3), for instance, usually warrants a block; this endpoint reports the status faithfully and does not make that judgment for you.

Minors and age verification (LGPD / Lei Felca)

The upstream source answers CPF lookups by the holder's age bracket. The platform passes the upstream status code through unchanged:

Age verification result	HTTP	code	Response
Adult (18 or older)	200	(none)	Name, registration status and date of birth as usual
16 to 17 years old	422	10016005	`{ "code": 10016005, "message": "LGPD: menor de idade" }`, no personal fields at all
Under 16	451	10016004	`{ "code": 10016004, "message": "LGPD: menor de 16 anos (Lei Felca)" }`, no personal fields at all
Age cannot be verified	428	10016006	`{ "code": 10016006, "message": "LGPD: idade nao verificavel - informe a data de nascimento para completar a verificacao" }`, no personal fields at all

The message of the three blocking tiers is the statutory wording set by the upstream source (Portuguese) and is not translated by the Language header; branch on code in code.
428 means the upstream database has no date of birth for the holder and cannot compute an age. The platform has already re-verified once with the date of birth you supplied (within the same call; you do not need to retry): if verification succeeds you get the regular result per the table; a 428 that persists means the official source could not verify either, and retrying is pointless.
Billing: 422 (age 16 to 17), 451 (under 16) and not found / birth date mismatch (400 + 10016003) are billed per call; the upstream source charges for these conclusions as well. 428 (age unverifiable) and upstream outage (503) are not billed. The platform stores nothing for the blocking tiers. On 422 / 451 do not query the same CPF repeatedly: age does not change with retries, and every retry is billed.
Format and check-digit errors are rejected locally, never reach the upstream source and are not billed.