Verification

Every card carries a verification code, shown as a QR code and printed text. Anyone holding the code, such as a receptionist, a security guard or another system, can confirm that the card is genuine and still valid, and that the person presenting it matches the name returned.

Verify a card

GET/cards/verify?code={code}public, no key

Parameter	Description
code	The verification code, for example 7KQ2-M4XD-9F1B. Case, spaces and hyphens are normalised

curl -sS "https://app.cardoffice.nz/api/v1/cards/verify?code=7KQ2-M4XD-9F1B"

{
  "data": {
    "status": "active",
    "serialNumber": "AC-000123",
    "holderName": "Emma Hall",
    "organisationName": "Acme Polytechnic",
    "issuedAt": "2027-02-03T01:00:00.000Z",
    "expiresAt": "2027-12-31",
    "valid": true
  }
}

Use valid, not status, to decide. valid is true only when the card is live, the holder is currently active, and the card has not passed its expiry date. A deactivated person’s card stops verifying immediately, even though the card record itself is unchanged.

The response deliberately contains the minimum needed to check someone at a door: the name (the preferred name when set), the organisation, the card’s serial and dates. It exposes no contact details and no photo.

Status	When
400 bad_request	No code supplied
404 not_found	No card has that code
429 rate_limited	More than 120 requests a minute from one IP address

There is also a public verification web page for people checking a card by hand; the QR code on the card opens it.