What are CPF and CNPJ?

CPF (Cadastro de Pessoa Física) is the Brazilian individual tax ID, equivalent to the US Social Security Number (SSN) or European Tax Identification Number (TIN). Every Brazilian citizen receives a unique 11-digit CPF used for all financial transactions, bank account opening, purchases, and service contracts. CNPJ (Cadastro Nacional da Pessoa Jurídica) is the Brazilian business tax ID, similar to the US EIN (Employer Identification Number) or UK Company Number, with 14 digits. Both are issued by the Brazilian Federal Revenue Service (Receita Federal) and mandatory for legal commercial operations in Brazil.

What is a CPF/CNPJ validation API used for?

A validation API allows companies to automatically verify if CPFs and CNPJs are valid, officially exist, and are active with the Brazilian Federal Revenue. This prevents fraud, ensures regulatory compliance, and automates KYC (Know Your Customer) processes. Use cases include: customer validation in e-commerce during checkout, digital account opening in fintechs, driver onboarding in mobility apps, remote employee hiring for international companies, and invoice issuance for cross-border payments. The API returns not only whether the document is valid, but also official data such as full name, company name, address, and registration status, enabling cross-validation and inconsistency detection essential for operating legally in Brazil.

What's the difference between checksum validation and Federal Revenue query?

Checksum validation is a mathematical calculation (mod-11 algorithm) that verifies if the last two digits of CPF/CNPJ are mathematically correct. This validation is instant and can be done offline, but only confirms the format is valid - it doesn't guarantee the document exists or is active. Federal Revenue query goes beyond: it accesses the Brazilian government's official database to confirm the document was actually issued, is active (not cancelled or suspended), and returns complete data about the holder. Our API combines both approaches: first validates checksums locally (if invalid, rejects immediately at no cost), then queries Federal Revenue only for documents with valid format, optimizing both performance and cost-efficiency while ensuring comprehensive validation.

How does API authentication work?

Authentication uses a token-based system generated in your control panel after registration. Each HTTP GET request includes your unique token directly in the URL: api.cpfcnpj.com.br/{your_token}/{package_id}/{cpf_or_cnpj}. The token automatically identifies your account and controls credit consumption in real-time. You can generate multiple tokens for different applications or environments (production, staging, development) and revoke them instantly via dashboard if security is compromised. We don't use header-based authentication to simplify integration, allowing testing via browser or curl without complex configurations. No OAuth or complicated handshakes required - just include your token in the URL.

What is the average API response time?

Average response time is 0.4 to 2 seconds for both CPF and CNPJ queries. Variation depends on load at Federal Revenue servers, which can fluctuate especially during peak business hours (2pm-5pm Brasília time). We recommend setting a 60-second timeout in your HTTP requests to accommodate occasional slowdowns in government systems. Important: data is always real-time D+0 (updated same day). We never use cache or intermediate databases to "artificially speed up" responses, ensuring you always receive the most current information available from the Federal Revenue. Integrity over speed.

What data does the API return beyond validation?

For CPF, the API returns: (1) Full name of holder as per official registration, (2) Date of birth, (3) Mother's full name (important field for additional anti-fraud verification), (4) Registration status (active, suspended, cancelled, null, pending regularization), (5) Federal Revenue registration date. For CNPJ, returns: (1) Legal business name (razão social), (2) Trade name if different from legal name (nome fantasia), (3) Primary economic activity code (CNAE), (4) Complete registered address (street, number, complement, neighborhood, city, state, ZIP code), (5) Registration status, (6) Opening date, (7) Share capital, (8) Secondary economic activities, (9) Legal nature (sole proprietorship, LLC, corporation, etc). All data comes directly from Federal Revenue without modifications or enrichment. Raw, official data only.

How to integrate the API in 5 minutes?

Simplified 4-step process: (1) Register in 30 seconds without credit card requirement for trial, (2) Copy your token that appears immediately in dashboard after login, (3) Make GET request to api.cpfcnpj.com.br/{token}/{package}/{cpf_or_cnpj} (can test directly in browser), (4) Receive JSON with complete data. Our technical documentation (/dev/) has ready-to-use copy-paste examples in PHP, Python, Node.js, Java, Ruby, Go, and cURL. Technical support answers questions in under 4 hours during business hours (UTC-3) via email or live chat in English.

Is the API LGPD/GDPR certified? How does compliance work?

Yes, we maintain rigorous compliance with LGPD (Brazilian General Data Protection Law, articles 7, 11, and 46) and GDPR (General Data Protection Regulation), validated by our ISO/IEC 27001:2022 (Information Security Management), ISO/IEC 27701:2025 (Privacy Information Management), and ISO/IEC 37301:2021 (Compliance Management System) certifications. All data transmitted via HTTPS with TLS 1.3, we implement end-to-end encryption (E2EE), don't store personal data queried (only technical request logs without PIIs), maintain dedicated Data Protection Officer (DPO) at dpo@alas.technology, operate with customized DPA (Data Processing Agreement) including EU Standard Contractual Clauses for international clients, and conduct annual independent audits. We provide complete compliance documentation for corporate due diligence, quarterly conformity reports, and verifiable ISO certificates for regulated clients.

Do you have ISO/IEC certifications? What security controls are implemented?

Yes, we hold three internationally recognized ISO/IEC certifications, all audited annually by independent accredited bodies: (1) ISO/IEC 27001:2022 - Information Security Management System (Certificate Q7LUQTCU20251113BRAIS1Z1): comprehensive controls including multi-factor authentication, RBAC (role-based access control), AES-256 encryption for data at rest, E2EE for data in transit, certified data centers with 24/7 monitoring, dedicated SOC (Security Operations Center), incident response plans, and business continuity procedures. (2) ISO/IEC 27701:2025 - Privacy Information Management (Certificate Q7LUQTCU20251113BRAPI15R): full alignment with LGPD/GDPR, Privacy by Design and by Default in all systems, documented procedures for data subject rights (access, rectification, erasure, portability), DPIAs (Data Protection Impact Assessments) for new processing activities, complete records of processing activities per LGPD Art. 37. (3) ISO/IEC 37301:2021 - Compliance Management System (Certificate Q7LUQTCC20251113BRACM1X7): organizational compliance culture, appointed DPO, register of all applicable legal obligations, continuous team training, regular audits, and confidential whistleblowing mechanisms. All certifications undergo annual surveillance audits ensuring continuous compliance with evolving standards.

Are queried data stored on API servers?

No. For GDPR/LGPD compliance, we don't store personal data returned by queries. We maintain only technical request logs (timestamp, token used, query type, HTTP status code) without including PIIs (Personally Identifiable Information). These logs are necessary for debugging, technical support, and billing, but don't contain queried CPF/CNPJ nor personal data returned. Logs are retained for 90 days then automatically deleted. Enterprise clients can request copies of their own logs for internal auditing. We never share, sell, or use query data for secondary purposes. Your customers' data stays private.

How to prevent fraud using the API?

Recommended anti-fraud strategies: (1) Cross-validate name returned by API with name on ID document submitted (passport/driver's license) - divergences indicate possible fraud, (2) Compare name on credit card with CPF name during checkout, (3) Use date of birth as second validation factor when available, (4) Verify mother's name consistency if your system collects this information, (5) Implement velocity checks detecting same CPF used multiple times in short period, (6) Monitor suspicious patterns like sequential CPFs, same IP making multiple attempts, or high volume of cancelled/suspended CPFs. Combining cadastral validation via API with sector-specific business rules, clients report 60-80% fraud reduction in the first quarter of implementation.

Why not use leaked databases or web scraping?

Leaked databases (often sold illegally on dark web) have critical problems: (1) Partial coverage of only 70-85% of existing documents with random gaps, (2) Outdated data from months or years ago - doesn't reflect cadastral changes (address updates, cancellations, regularizations), (3) Illegality - usage violates GDPR/LGPD exposing your company to fines up to 4% of annual revenue (GDPR) or 2% (LGPD), (4) Reputational risk and impossibility to prove compliance in regulatory audits. Screen-scraping the Federal Revenue website is also problematic: (1) Breaks frequently when website changes layout, (2) Requires captcha solving for each request, (3) Violates terms of service, (4) IP can be permanently blocked. Our API provides legal, reliable, and auditable access to the same official source.

How does pricing work? How much per query?

The most affordable package, Unified NFe, is BRL 0.04 per query. CPF validation packages start at BRL 0.17 (CPF A — full name only) up to BRL 1.57 (CPF K with address and tax registration status). CNPJ packages range from BRL 0.15 (CNPJ A) to BRL 2.25 (Detailed QsA with ownership percentages). The top sellers: CPF C at BRL 0.29 (Name + DOB + Mother + Gender) and CNPJ D at BRL 0.51 (full real-time Federal Revenue dataset with Cartão CNPJ PDF). Queries never expire, balance is cumulative across packages and credited proportionally on upgrades. Payment via credit card, bank slip and PIX; e-invoice (NF-e) automatically issued for corporate clients. Full table at /en/pricing.

Is there a free plan or trial period?

Yes, every new registration receives free queries to test the API in real environment without functionality limitations and without commitment. We don't ask for credit card during trial - just email and password to create account. After consuming free queries, you can purchase paid plans. No long-term contracts: cancel anytime, instant upgrade or downgrade between plans, and credits never expire. Simple, transparent, and developer-friendly pricing.

Do I need a Brazilian company to contract the API?

No, international companies can contract as individuals or businesses. We accept international payment methods: Visa, Mastercard, Amex, PayPal, wire transfer, and cryptocurrency for large volume contracts. Invoices issued in English with international tax compliance documentation. For enterprise customers, we offer annual contracts with fixed pricing in your preferred currency (USD, EUR, GBP) protecting against BRL currency fluctuation. Perfect for payment processors, multinational HR platforms, and international companies operating in Brazil. No Brazilian legal entity required.

Is the API ready for the new Alphanumeric CNPJ taking effect in July 2026?

Yes. Our API already accepts and validates the new Alphanumeric CNPJ defined by Federal Revenue Normative Instruction (IN RFB) 2.229/2024, which takes effect in July 2026. The new format keeps 14 characters, but the first 12 may contain uppercase letters and digits (0-9, A-Z), while the last 2 remain numeric check digits calculated by an adaptation of the mod-11 algorithm (each letter contributes its ASCII value minus 48). Both legacy numeric CNPJs and the new alphanumeric ones are queried through the same endpoint, with no integration changes required. Existing companies keep their current numeric CNPJ — the alphanumeric format applies only to new registrations after July 2026. We recommend updating front-end validation regex to ^[A-Z\d]{12}\d{2}$ and widening database columns that currently only accept digits.

Does the CNPJ query already cover IBS, CBS and the 2026 Tax Reform?

Starting in 2026, the Brazilian Tax Reform (Constitutional Amendment 132/2023 and Supplementary Laws 214/2025 and 215/2025) introduces the IBS (Goods and Services Tax — state/municipal) and the CBS (Federal Contribution on Goods and Services), gradually replacing ICMS, ISS, PIS and Cofins. When made available by the Federal Revenue, our API exposes the corresponding new fields (tax regime, IBS/CBS status, effective rate by CNAE when published) at no extra cost for packages that already deliver full CNPJ cadastral data. During the transition phase (test rate of 0.9% CBS + 0.1% IBS in 2026), these fields may return null for companies not yet enrolled. Documentation is updated as the Federal Revenue releases the official endpoints.

Is the data really real-time or coming from cache?

Data is D+0 real-time, queried directly against the Federal Revenue official systems on every request in CPF D, CPF E and CNPJ D packages. We do not use intermediate caches, owned databases, scraped data or third-party banks in these packages. If a CNPJ was reactivated moments ago, your next query already returns situacao_cadastral=ATIVA — no staleness window. Trade-off: response time follows the Federal Revenue latency (average 400 ms to 2 s, with peaks during business hours). Set HTTP timeout to 60 seconds and retry with exponential backoff for 3 attempts. Simplified packages (CPF A, B, C, F, etc.) use partner sources with lower latency (1 second average).

What is the LGPD legal basis for querying third-party CPFs via API?

Querying third-party CPFs via our API is allowed by Brazil's LGPD (Law 13.709/2018) under several Article 7 grounds: legal obligation (II), contract execution (V), credit protection (X) and legitimate interest (IX). Typical covered use cases: e-commerce cadastral validation, fintech onboarding (Brazilian Central Bank Resolution 5/2020 — KYC), CLT employee hiring, NF-e issuance (mandated by SPED), financial fraud prevention and anti-money-laundering compliance (Law 9.613/1998 and Central Bank Circular 3.978/2020). What is NOT a legal basis: direct marketing without consent, enrichment for lead reselling or research unrelated to the contractual purpose. We recommend maintaining a processing record (LGPD Article 37) documenting the purpose of each query. DPA available on request for corporate clients.

Does the query generate an official PDF receipt for audits or legal proceedings?

Yes. Every query returns a unique protocol (consultaID), UTC timestamp with millisecond precision and a cryptographic audit chain in the JSON response. These three elements together carry evidentiary weight equivalent to a screenshot of the Federal Revenue's public consultation. For CPF D, CPF E (real-time RF) and CNPJ D packages, we generate the official receipt PDF Base64-encoded (field situacaoComprovantePdf) with the same layout issued by the Federal Revenue itself, accepted by banks, notary offices and courts as due-diligence evidence. The CPF CAC/SINIC package (BRL 0.27) additionally returns the Federal Police's Criminal Background Certificate PDF with the SINIC protocol number and a 'clean record' flag.

Pricing and Plans | CPF.CNPJ - CPF and CNPJ Query Packages for Businesses

CPF A

R$ 0,17 / price per query

Full Name

Birth date required:Não
Average response time:2 Seconds

Compare

CPF B

R$ 0,25 / price per query

Full Name
Date of Birth

Birth date required:Não
Average response time:2 Seconds

Compare

CPF C

Top Seller

R$ 0,29 / price per query

Full Name
Date of Birth
Mother's Name
Gender

Birth date required:Não
Average response time:2 Seconds

Compare

CPF D

Real-time RF

R$ 0,41 / price per query

Real-time query at the Brazilian Federal Revenue with receipt + control code. Response in 1 second.

Full Name
Social Name
Date of Birth
Registration Status
Death and Date
PDF Receipt
Receipt Number

Birth date required:Não
Average response time:1 Second

Compare

CPF D Simplificado

R$ 0,37 / price per query

Full Name
Date of Birth
Registration Status

Birth date required:Não
Average response time:1 Second

Compare

CPF E

Real-time RF

R$ 0,53 / price per query

Real-time query at the Brazilian Federal Revenue with receipt + control code. Response in 1 second.

Full Name
Social Name
Date of Birth
Mother's Name
Gender
Registration Status
Death and Date
PDF Receipt
Receipt Number

Birth date required:Não
Average response time:1 Second

Compare

CPF F

R$ 1,35 / price per query

Full Name
Date of Birth
Gender
Complete Address

Birth date required:Não
Average response time:2 Seconds

Compare

CPF H

R$ 0,23 / price per query

Full Name
Politically Exposed Person (PEP) and Related

Birth date required:Não
Average response time:2 Seconds

Compare

CPF I

R$ 0,23 / price per query

Full Name
Companies in name

Birth date required:Não
Average response time:2 Seconds

Compare

CPF K

R$ 1,57 / price per query

Full Name
Date of Birth
Complete Address
Registration Status

Birth date required:Não
Average response time:2 Seconds

Compare

Lookalike

R$ 0,27 / price per query

Full Name
E-mails
Phones
WhatsApp

Birth date required:Não
Average response time:2 Seconds

Compare

Family

R$ 1,13 / price per query

Full Name
Family and Related

Birth date required:Não
Average response time:2 Seconds

Compare

Social Programs

R$ 0,17 / price per query

Full Name
Social Programs

Birth date required:Não
Average response time:2 Seconds

Compare

Criminal Records

R$ 1,46 / price per query

Full Name
Criminal Records

Birth date required:Não
Average response time:2 Seconds

Compare

CNS

R$ 0,25 / price per query

Full Name
CNS Data (National Health Registry)

Birth date required:Não
Average response time:2 Seconds

Compare

CPF CAC/SINIC

New

R$ 0,27 / price per query

Full Name
SINIC protocol number
Criminal Background Certificate PDF
Clean record indicator

Average response time:2 Seconds

Compare

Choose our packages according to your needs

Features of CPF and CNPJ individual query packages

CPF A

CPF B

CPF C

CPF D

CPF D Simplificado

CPF E

CPF F

CPF H

CPF I

CPF K

Lookalike

Family

Social Programs

Criminal Records

CNS

CPF CAC/SINIC

The fastest way to query CPF and CNPJ

Compare

Integrate

Query

Trusted by +11 mil Companies

Have any questions?

The plan for your company size

Choose our packages according to your needs

Features of CPF and CNPJ individual query packages

Compare subscription plans

The fastest way to query CPF and CNPJ

Compare

Integrate

Query

Trusted by +11 mil Companies

Have any questions?

The plan for your company size