---
title: "Public validation"
description: "Public validation in Digiploma: validation code formats and how to check diplomas, transcripts and curriculums on the validation page or API, no API key."
canonical: "https://docs.lacunasoftware.com/en-us/articles/digiploma/api/validation"
locale: "en"
product: "Digiploma"
last_updated: "2026-10-11"
---

# Public validation

Every diploma, academic transcript and curriculum issued by Digiploma has a **validation code** (*código de validação*). Anyone holding the
code can check the document on the instance's validation page, `/validar` (for example
`https://www.digiploma.com.br/validar/{code}`), and the same check is available through the API, **without an API key**.

## The validation code

| Document | Format |
|---|---|
| Diploma | `{issuer MEC code}.{registrar MEC code}.{12 hexadecimal characters}` |
| Academic transcript | `{issuer MEC code}.{12 hexadecimal characters}` |
| Curriculum | `{issuer MEC code}.{12 hexadecimal characters}` |

The code is printed on the visual representation of the document, next to a QR code that opens the validation page, by default at
`/validar/{code}`. Leading and trailing spaces are ignored.

## Validate a document

| Document | Operation |
|---|---|
| Diploma | `GET /api/degrees/{code}/validation` |
| Academic transcript | `GET /api/academic-transcripts/{code}/validation` |
| Curriculum | `GET /api/curriculums/{code}/validation` |

These operations need no API key, although the API reference shows the key on every operation.

```bash
curl "https://www.digiploma.com.br/api/degrees/1234.5678.3f9a0c1b2d4e/validation?captcha=$TOKEN"
```

```json
{
  "isValid": true,
  "isCancelled": false,
  "id": "9b0f…",
  "hasVisualRepresentation": true,
  "visualRepresentationTicket": { "location": "/api/degrees/…/visual-representation/file?access_ticket=…", "filename": "diploma-….pdf" },
  "xmlTicket": { "location": "/api/degrees/…/xml/file?access_ticket=…", "filename": "diploma-….xml" },
  "history": [ { "status": "Active", "reason": null, "date": "2026-08-20T14:02:11-03:00" }, … ],
  "dataIngresso": "2022-02-01",
  "dataConclusao": "2026-06-30",
  "information": { "diplomado": { "nome": "…", "cpf": "***456789**", … }, "dadosCurso": { … }, "iesEmissora": { … }, … },
  "dadosRegistro": { "iesRegistradora": { … }, "livroRegistro": { … }, … }
}
```

| Field | Description |
|---|---|
| `isValid` | `true` when the document is active and signed. |
| `information` | The public data of the document, only when it is valid. For a diploma, `dadosDiploma` read from the signed XML (the diploma also has `dadosRegistro`, `dataIngresso` and `dataConclusao`, in fields of their own). For a transcript, its type, the student, the course, the institution, the student's current situation, the admission data and the issue date and time. For a curriculum, its code, date, course and institution. |
| `history` | The status changes of the document. |
| `xmlTicket`, `visualRepresentationTicket` | [Tickets](https://docs.lacunasoftware.com/en-us/articles/digiploma/api#downloads-and-tickets) to download the signed XML and the visual representation. |

The CPF of the graduate or student is masked in `information` (as in `***456789**`), unless the instance turns masking off. No other field is
masked.

A code that does not exist returns `{"isValid": false}`, with no other data, and so does a document that is still waiting for signatures or
is temporarily canceled. A document that was canceled is not reported as valid either: the call fails with `DegreeNotValid`,
`AcademicTranscriptNotValid` or `CurriculumNotValid`. Treat anything other than `"isValid": true` as **not valid**.

## CAPTCHA

When the instance has reCAPTCHA enabled, which is the case at www.digiploma.com.br, the validation operations require a reCAPTCHA token in
the `captcha` query parameter, and fail with `InvalidCaptcha` without a valid one. The token is the one produced by the reCAPTCHA widget
(invisible reCAPTCHA v2) with the instance's site key, so these operations are meant for a validation page displayed to a person. In that
case, download the files with the tickets returned by the validation.

When CAPTCHA is disabled, the files can also be downloaded directly by code:

| Document | Visual representation | Signed XML |
|---|---|---|
| Diploma | `GET /api/degrees/{code}/validation/visual-representation` | `GET /api/degrees/{code}/validation/xml` |
| Academic transcript | `GET /api/academic-transcripts/{code}/validation/visual-representation` | `GET /api/academic-transcripts/{code}/validation/xml` |
| Curriculum | `GET /api/curriculums/{code}/validation/visual-representation` | `GET /api/curriculums/{code}/validation/xml` |

With CAPTCHA enabled, these operations fail with `InvalidOperationCaptchaEnabled`. An unknown code fails with `InvalidVerificationCode`,
and a document that is not valid with `DegreeNotValid`, `AcademicTranscriptNotValid` or `CurriculumNotValid`.

## Validate your own documents

To check documents of your own organization from your systems, without a CAPTCHA, use the authenticated operations, with the API key:

* `GET /api/degrees/codes/{code}`
* `GET /api/academic-transcripts/codes/{code}`
* `GET /api/curriculums/codes/{code}`

They return the same model as the public validation, with the CPF unmasked, and only for documents that belong to the organization of the
key.