Public validation

Every diploma, academic transcript and curriculum issued by Digiploma has a validation code (código de validação). Anyone holding the code can check the document on the instance's validation page, /validar (for example https://www.digiploma.com.br/validar/{code}), and the same check is available through the API, without an API key.

The validation code

Document	Format
Diploma	{issuer MEC code}.{registrar MEC code}.{12 hexadecimal characters}
Academic transcript	{issuer MEC code}.{12 hexadecimal characters}
Curriculum	{issuer MEC code}.{12 hexadecimal characters}

The code is printed on the visual representation of the document, next to a QR code that opens the validation page, by default at /validar/{code}. Leading and trailing spaces are ignored.

Validate a document

Document	Operation
Diploma	GET /api/degrees/{code}/validation
Academic transcript	GET /api/academic-transcripts/{code}/validation
Curriculum	GET /api/curriculums/{code}/validation

These operations need no API key, although the API reference shows the key on every operation.

curl "https://www.digiploma.com.br/api/degrees/1234.5678.3f9a0c1b2d4e/validation?captcha=$TOKEN"

{
  "isValid": true,
  "isCancelled": false,
  "id": "9b0f…",
  "hasVisualRepresentation": true,
  "visualRepresentationTicket": { "location": "/api/degrees/…/visual-representation/file?access_ticket=…", "filename": "diploma-….pdf" },
  "xmlTicket": { "location": "/api/degrees/…/xml/file?access_ticket=…", "filename": "diploma-….xml" },
  "history": [ { "status": "Active", "reason": null, "date": "2026-08-20T14:02:11-03:00" }, … ],
  "dataIngresso": "2022-02-01",
  "dataConclusao": "2026-06-30",
  "information": { "diplomado": { "nome": "…", "cpf": "***456789**", … }, "dadosCurso": { … }, "iesEmissora": { … }, … },
  "dadosRegistro": { "iesRegistradora": { … }, "livroRegistro": { … }, … }
}

Field	Description
isValid	true when the document is active and signed.
information	The public data of the document, only when it is valid. For a diploma, dadosDiploma read from the signed XML (the diploma also has dadosRegistro, dataIngresso and dataConclusao, in fields of their own). For a transcript, its type, the student, the course, the institution, the student's current situation, the admission data and the issue date and time. For a curriculum, its code, date, course and institution.
history	The status changes of the document.
xmlTicket, visualRepresentationTicket	Tickets to download the signed XML and the visual representation.

The CPF of the graduate or student is masked in information (as in ***456789**), unless the instance turns masking off. No other field is masked.

A code that does not exist returns {"isValid": false}, with no other data, and so does a document that is still waiting for signatures or is temporarily canceled. A document that was canceled is not reported as valid either: the call fails with DegreeNotValid, AcademicTranscriptNotValid or CurriculumNotValid. Treat anything other than "isValid": true as not valid.

CAPTCHA

When the instance has reCAPTCHA enabled, which is the case at www.digiploma.com.br, the validation operations require a reCAPTCHA token in the captcha query parameter, and fail with InvalidCaptcha without a valid one. The token is the one produced by the reCAPTCHA widget (invisible reCAPTCHA v2) with the instance's site key, so these operations are meant for a validation page displayed to a person. In that case, download the files with the tickets returned by the validation.

When CAPTCHA is disabled, the files can also be downloaded directly by code:

Document	Visual representation	Signed XML
Diploma	GET /api/degrees/{code}/validation/visual-representation	GET /api/degrees/{code}/validation/xml
Academic transcript	GET /api/academic-transcripts/{code}/validation/visual-representation	GET /api/academic-transcripts/{code}/validation/xml
Curriculum	GET /api/curriculums/{code}/validation/visual-representation	GET /api/curriculums/{code}/validation/xml

With CAPTCHA enabled, these operations fail with InvalidOperationCaptchaEnabled. An unknown code fails with InvalidVerificationCode, and a document that is not valid with DegreeNotValid, AcademicTranscriptNotValid or CurriculumNotValid.

Validate your own documents

To check documents of your own organization from your systems, without a CAPTCHA, use the authenticated operations, with the API key:

• GET /api/degrees/codes/{code}
• GET /api/academic-transcripts/codes/{code}
• GET /api/curriculums/codes/{code}

They return the same model as the public validation, with the CPF unmasked, and only for documents that belong to the organization of the key.