Retrieve a verification
Returns the verification with its current status and, once confirmed, how it was confirmed (`confirmation`).
apiKeyAuthorizationBearer <token>API key in the Authorization: Bearer cf_live_... header. Create and revoke keys in the dashboard, under Desenvolvedores > Chaves de API (Developers > API keys).
verification_id*stringThe verification id, starting with ver_.
The verification.
application/json- response
A physical address verification: CartaFlow mails a letter with a code, under your brand, and the address is verified when the person confirms the code. The code never shows in this object, nor in the dashboard.
id*stringUnique identifier of the verification. Always starts with ver_.
^ver_[A-Za-z0-9]+$object*stringObject type. Always verification.
status*stringWhere the verification is. It only moves forward: received, in_production, awaiting_code, verified. From received it can move to canceled; from in_production, to canceled (by CartaFlow) or revoked; from awaiting_code, to failed, expired or revoked; from verified, to revoked. Only verified means a confirmed address.
Possible values
received: CartaFlow received the request, charged the price to your balance and put the letter with the code in the production queue. If you cancel now, nothing is printed and the amount goes back to the balance.in_production: The letter with the code is being printed and enveloped. Canceling now revokes the verification (revoked), with no refund.awaiting_code: The letter was posted. Now we wait for the person to confirm the code. They have 60 days from posting (seeexpires_at). Canceling now revokes the verification, with no refund.verified: The person confirmed the right code. They receive mail at the address on file.confirmationsays how and when. You can still revoke the verification, which moves it torevoked.failed: 5 wrong codes were entered. The verification was locked to stop guessing. Create a new verification to try again.expired: 60 days went by after posting without the person confirming the code.canceled: The verification was canceled before posting and the amount went back to your balance. Either you canceled it while it wasreceived, or CartaFlow canceled it because the letter could not be produced.revoked: You canceled the verification after production started: in production, awaiting the code or already verified. The amount does not go back to the balance, because production already started, and a letter that was in production is still posted. The code stops working, on the page and in the API, and the verification never shows asverifiedagain.
"received""in_production""awaiting_code""verified""failed""expired""canceled""revoked"method*stringHow the person confirms the code.
Possible values
hosted_page: On the page with your brand, through the QR code or by typing the code.code: By typing the code into your website or app.
"hosted_page""code"source*stringWhere the verification was created. It does not depend on how it is confirmed (see confirmation).
Possible values
api: Through the API, with POST /v1/verifications.dashboard: In the dashboard, by someone on your team.
"api""dashboard"to*The address being verified.
document*|||How the letter was made: the CartaFlow letter template or your own PDF. A copy of it, with the code hidden (000 000), is at preview_url.
instructions*|The text you sent to print below the code, on the CartaFlow letter template. null when you did not send one.
return_url*|Where the page sends the person after confirming. null when not set.
urihosted_page_url*|The address of the confirmation page, with your brand (for now on the verifica.cartaflow.com.br domain): https://verifica.cartaflow.com.br/{your account id}/{page token}. It is the address printed on the letter and the one the QR code opens; the QR code carries the code with it, but this link does not, so whoever opens the link has to type the code. You can email this link or show it in your app. Treat it as an opaque address: store and use it as it came. null when method is code.
uriattempts_remaining*integerHow many more wrong codes can be entered. Starts at 5 and goes down with each wrong code, on the page or through the API. At 0 the verification moves to failed.
0 <= value <= 5expires_at*|Deadline for the person to confirm: 60 days after posting. null before posting.
date-timeconfirmation*|How and when the person confirmed the code: where (method), when, from which IP and from where, approximately. null until the verification is confirmed. A verification revoked after being confirmed keeps this record, but its status is revoked: the address no longer counts as verified.
preview_url*|Link to a copy of the letter as it will be printed, address included, but without the code: in its place it shows 000 000, and in place of the QR code, a box that shows where it will be printed. The code only exists in the file CartaFlow prints: neither the API nor the dashboard can show it. The link works for 60 minutes: retrieve the verification again for a fresh link. null in events and webhooks, and when the file is not available.
uriprice*The price charged to the balance at creation. With the CartaFlow letter template, one base mailing on your plan: a single base line. With your own PDF, the price of a letter with the same options: base, additional_sheets and color. There are never Correios services. It goes back to the balance when the verification is canceled (canceled); it does not when the verification is revoked (revoked).
reference*|Your identifier for this verification, such as the invoice number or the customer id in your system. Shown in the dashboard and usable as a filter when listing. It does not have to be unique. Up to 100 characters. null when you did not send one.
length <= 100metadata*Key-value pairs to store your own data with the object, such as your customer or contract id. Returned in every response and webhook and never printed. Up to 20 keys; keys up to 40 characters and string values up to 500 characters. Do not store sensitive data such as passwords or card numbers. Empty object {} when you did not send any.
properties <= 20status_transitions*When the verification reached each status. null for statuses it has not reached. The received status happens at created_at. A verification revoked after being confirmed keeps verified_at.
created_at*stringWhen the verification was created.
date-timecurl "https://api.cartaflow.com.br/v1/verifications/string" \ -H "Authorization: Bearer $CARTAFLOW_API_KEY"{ "id": "ver_3Hd9Kp2qZ6tW", "object": "verification", "status": "awaiting_code", "method": "hosted_page", "source": "api", "to": { "name": "Destinatário Exemplo", "street": "Praça da Sé", "number": "128", "complement": "Ap. 52", "neighborhood": "Sé", "city": "São Paulo", "state": "SP", "postal_code": "01001-000" }, "document": { "type": "template", "title": "Confirme o seu endereço", "body": "{{empresa}} pediu a confirmação de que você recebe correspondência neste endereço. Use o código abaixo para confirmar.", "footer": "O código vale por 60 dias depois da postagem e só funciona para este endereço. Não compartilhe este código com ninguém.", "include_qr_code": true, "include_page_url": true }, "instructions": null, "return_url": "https://www.exemplo.com.br/conta", "hosted_page_url": "https://verifica.cartaflow.com.br/acc_7Jw3Nf8Xq2Lp/9Qx2Lm7Tp4Rb8Kd3Wn6Yc1", "attempts_remaining": 5, "expires_at": "2026-12-14T16:05:00Z", "confirmation": null, "preview_url": "https://files.cartaflow.com.br/previews/ver_3Hd9Kp2qZ6tW.pdf?expires=1760369400&signature=5d2e81b3", "price": { "currency": "BRL", "total": 990, "items": [ { "type": "base", "quantity": 1, "unit_amount": 990, "amount": 990 } ] }, "reference": "cliente-1842", "metadata": {}, "status_transitions": { "in_production_at": "2026-10-13T21:00:00Z", "awaiting_code_at": "2026-10-15T16:05:00Z", "verified_at": null, "failed_at": null, "expired_at": null, "canceled_at": null, "revoked_at": null }, "created_at": "2026-10-13T14:20:00Z"}