Inyo

Document Number Validator

Check whether a document number is well-formed for its jurisdiction, before you create a session or submit a verification. Nothing is stored and no verification is consumed.


Endpoint: POST /v1/validators/document-number
Authentication: Bearer token with the sessions scope

A stateless format check against the same registry the verification pipeline uses. Nothing is stored and no verification is consumed β€” but it accepts government identifiers, so it is attributed to a tenant like every other endpoint here. Useful for validating input in your own form before creating a session.

curl --request POST \
  --url https://{FQDN}/v1/validators/document-number \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "documentType": "drivers_license",
  "number": "31612967",
  "issuingCountry": "USA",
  "issuingState": "PA"
}'
{
  "documentType": "drivers_license",
  "issuingCountry": "USA",
  "issuingState": "PA",
  "valid": true,
  "rule": "drivers_license:USA:PA",
  "detail": "document number matches the PA license format"
}

The number you send is never echoed back. The response reports the jurisdiction that was applied, not the identifier you submitted.

What Is Covered

Countrydrivers_licensepassportidentity_cardssn / itin
πŸ‡ΊπŸ‡Έ United Statesβœ“ 51 jurisdictions (50 states + DC)βœ“β€”βœ“ structural rules
πŸ‡¨πŸ‡¦ Canadaβœ“ 13 jurisdictions (10 provinces + 3 territories)βœ“β€”β€”
πŸ‡§πŸ‡· Brazilβœ“ CNH β€” check digits verifiedβœ“βœ“ CPF β€” check digits verifiedβ€”
πŸ‡²πŸ‡½ Mexicoβ€”βœ“βœ“ CURP β€” structureβ€”
πŸ‡ͺπŸ‡Έ Spainβ€”βœ“βœ“ DNI/NIE β€” control letter verifiedβ€”
🌎 11 more countriesβ€”βœ“β€”β€”
🌐 Everywhere elseβ€”βœ“ generic ICAO shapeβ€”β€”

The 11 additional passport countries, as the issuingCountry you send: ARG, AUS, CHN, DEU, FRA, GBR, IND, ITA, JPN, NLD, RUS.

Anything not marked βœ“ β€” inside the table or beyond it β€” returns valid: null, never false. Treat a null as "we do not know": accept it, and do not read it as either a pass or a fail. A jurisdiction that is marked βœ“ also answers null when the number matches none of the shapes we hold for it β€” see the verdict table below.

The CNH, CPF and DNI/NIE are checked with real check-digit arithmetic, so a transposed digit is caught β€” unlike the licence tables, which are shape-only because those jurisdictions publish no check digit.

Naming the Jurisdiction

issuingCountry is the country β€” an ISO 3166-1 alpha-3 code, a country name, or a common alias. issuingState is a subdivision within that country β€” a US state or a Canadian province or territory β€” and only driver's licenses use it.

Document typeissuingCountryissuingStateNotes
drivers_license (US)USAthe state, e.g. PA
drivers_license (Canada)CANthe province or territory, e.g. ON
drivers_license (Brazil)BRAβ€”The CNH is national; the issuing DETRAN does not change the number
passportthe issuing countryβ€”
identity_cardthe issuing countryβ€”
ssn, itinUSAβ€”US-only identifiers; any other country is a 422

A subdivision must name its country. Send issuingState without issuingCountry and the request is refused whatever the document type, because PA alone could be Pennsylvania or ParΓ‘ and the answer would name a jurisdiction you never supplied. ssn and itin are exempt β€” their country is never in doubt. Sending neither is allowed and returns valid: null β€” unverifiable, not invalid. Nothing infers a country: a passport or identity card without one also returns valid: null.

ssn and itin are validator-only. They are not capturable document types β€” you cannot create a session for one β€” but the structural rules are useful when you collect them on your own forms.

Interpreting the Response

valid is deliberately three-valued:

ValueMeaningHow to treat it
trueMatches a format we hold for that jurisdictionAccept
falseRefuted β€” failed a check digit or published structure, or is not a document number at allReject before creating the session
nullNothing here can judge it: no rule for the jurisdiction, or rules that none of matchedAccept β€” never a failure

A false needs a proof. The CNH, CPF, DNI/NIE, SSN and ITIN carry one, and a value that no jurisdiction could issue β€” punctuation in a licence number, a shape outside the generic ICAO one for a passport β€” is refuted on its face.

A licence or passport number that simply matches none of the shapes we hold for its jurisdiction returns null, not false. Those tables recognise shapes; they do not verify them, and they are incomplete in ways real documents keep finding. Maryland issues an MD-prefixed number alongside its legacy one, and Massachusetts a two-letter prefix; each was missing until a genuine licence was rejected by it. Answering false there told a caller a valid document was invalid.

rule names the rule that was applied, so you can tell which jurisdiction answered:

ruleMeaning
drivers_license:USA:PAA US license checked against Pennsylvania's format
drivers_license:CAN:ONA Canadian licence checked against Ontario's format
drivers_license:BRAA Brazilian CNH checked against the national check digits β€” no subdivision component, because the issuing DETRAN does not change the number
drivers_license:USA:PA with valid: nullPennsylvania's rules were applied and none matched β€” unverified, not refuted
drivers_license:genericNot a licence number in any jurisdiction β€” valid: false
drivers_license:USA:unknown_subdivisionA US license with no resolvable state β€” valid: null
drivers_license:<country>:no_ruleA license from a country we have no license rules for β€” valid: null
drivers_license:unknown_countryNeither country nor subdivision resolved β€” valid: null
passport:USAA passport checked against that country's format
passport:genericA passport whose number does not fit the generic ICAO shape β€” valid: false
passport:no_ruleA passport from a country we have no format for β€” valid: null
identity_card:ESPAn identity card checked against that country's national scheme
identity_card:no_ruleAn identity card from a country we have no scheme for β€” valid: null
ssn:USA, itin:USAThe US structural rules

Every rule names the documentType it belongs to, so the prefix maps to the type by string equality. The one exception is a sandbox reserved value, which is prefixed reserved: and carries the type in its second segment β€” see Sandbox and Test Data.

Errors

StatusCause
401Missing or invalid Bearer token
403Token lacks the sessions scope
422issuingCountry could not be resolved to a country
422issuingState sent with no issuingCountry β€” a subdivision alone cannot name a jurisdiction, whatever the document type. ssn and itin are exempt: their country is always USA
422ssn or itin sent with a non-US issuingCountry
503The identity provider could not be reached to verify the token β€” transient, retry with backoff

Next Steps