cURL with fictitious data

curl --request POST \
  --url https://api.example.com/cob-hub/v1/brcodes/decode \
  --header 'Authorization: Bearer demo-access-token' \
  --header 'Content-Type: application/json' \
  --data '{
  "emvPayload": "00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD"
}'

import requests

url = "https://api.example.com/cob-hub/v1/brcodes/decode"

payload = { "emvPayload": "00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    emvPayload: '00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD'
  })
};

fetch('https://api.example.com/cob-hub/v1/brcodes/decode', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/cob-hub/v1/brcodes/decode",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'emvPayload' => '00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/cob-hub/v1/brcodes/decode"

	payload := strings.NewReader("{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/cob-hub/v1/brcodes/decode")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/cob-hub/v1/brcodes/decode")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}"

response = http.request(request)
puts response.read_body

{
  "amount": "100.50",
  "currency": "BRL",
  "description": "Pagamento do pedido 12345",
  "expiresAt": "2026-05-06T11:30:00Z",
  "isReusable": true,
  "keyType": "EVP",
  "keyValue": "123e4567-e12b-12d1-a456-426655440000",
  "merchantCity": "Goiania",
  "merchantName": "Loja Teste",
  "txId": "TX12345",
  "type": "STATIC"
}

{
  "code": "ERR-0001",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Decode a Pix EMV payload

Parses a Pix EMV payload and returns the structured payment details. Third-party payloads are accepted, so decoding is more permissive than BR Code creation: a payload without a Point of Initiation method is decoded as STATIC. keyType is inferred from the key value and omitted when no key type defined by the BCB both matches the value and passes validation. See the response schema for the rules that apply to each field.

POST

brcodes

decode

cURL with fictitious data

curl --request POST \
  --url https://api.example.com/cob-hub/v1/brcodes/decode \
  --header 'Authorization: Bearer demo-access-token' \
  --header 'Content-Type: application/json' \
  --data '{
  "emvPayload": "00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD"
}'

import requests

url = "https://api.example.com/cob-hub/v1/brcodes/decode"

payload = { "emvPayload": "00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    emvPayload: '00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD'
  })
};

fetch('https://api.example.com/cob-hub/v1/brcodes/decode', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/cob-hub/v1/brcodes/decode",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'emvPayload' => '00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/cob-hub/v1/brcodes/decode"

	payload := strings.NewReader("{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/cob-hub/v1/brcodes/decode")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/cob-hub/v1/brcodes/decode")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"emvPayload\": \"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD\"\n}"

response = http.request(request)
puts response.read_body

{
  "amount": "100.50",
  "currency": "BRL",
  "description": "Pagamento do pedido 12345",
  "expiresAt": "2026-05-06T11:30:00Z",
  "isReusable": true,
  "keyType": "EVP",
  "keyValue": "123e4567-e12b-12d1-a456-426655440000",
  "merchantCity": "Goiania",
  "merchantName": "Loja Teste",
  "txId": "TX12345",
  "type": "STATIC"
}

{
  "code": "ERR-0001",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Body

application/json

emvPayload

string

required

EMV BR Code payload to decode

Example:

"00020101021126580014br.gov.bcb.pix0136123e4567-e12b-12d1-a456-4266554400005204000053039865802BR5913Fulano de Tal6008BRASILIA62070503***630448CD"

Response

isReusable

boolean

required

Whether the BR Code may be paid more than once. True for every STATIC payload, including one whose Point of Initiation method is absent.

Example:

true

merchantCity

string

required

Example:

"Goiania"

merchantName

string

required

Example:

"Loja Teste"

type

enum<string>

required

Type embedded in the payload. A payload that names NO Point of Initiation method (EMV tag 01 absent) is reported as STATIC: EMVCo makes the element optional and defines its absence as static, and BCB's own composed QR Code examples omit it. Such a payload was previously rejected as malformed.

Available options:

STATIC,

DYNAMIC_IMMEDIATE,

DYNAMIC_DUEDATE

Example:

"STATIC"

amount

string

Example:

"100.50"

currency

enum<string>

Available options:

BRL

Example:

"BRL"

description

string

Example:

"Pagamento do pedido 12345"

expiresAt

string<date-time>

Example:

"2026-05-06T11:30:00Z"

keyType

enum<string>

Pix key type inferred from keyValue, ABSENT when no type both matches and validates. A CPF/CNPJ must satisfy its Modulo 11 check digits — a document that does not is unregistrable at DICT, so no type is reported. A masked document ("529.982.247-25") IS recognised. A phone is any E.164 number, not only "+55".

Available options:

CPF,

CNPJ,

PHONE,

EMAIL,

EVP

Example:

"EVP"

keyValue

string

Pix key exactly as the payload carries it, punctuation included. It is never normalized: this endpoint reports what was scanned.

Example:

"123e4567-e12b-12d1-a456-426655440000"

txId

string

Example:

"TX12345"

Pix — Lerian SPI (native messaging)

Pix Lerian

Pix — JD (interface, direct)

Pix — BTG (interface, indirect)

TED — Lerian SPB (native messaging)

TED — JD (interface)

Boletos — BTG (interface)

Lerian SILOC (native messaging)

Lerian SLC (native messaging)

Lerian STA (native messaging)

Lerian SISBAJUD (native messaging)

Lerian Consignado — Dataprev

Decode a Pix EMV payload

Authorizations

Body

Response