QSA

This endpoint returns the QSA (quadro societário e de administradores, the ownership and management structure of a company) of a CNPJ (the Brazilian company taxpayer number), as recorded at the Brazilian Federal Revenue Service: who the partners and officers are, with name, qualification and, for a foreign partner, country of origin.

🚧 The body is passed through from the provider, with no transformation

The content of data is whatever the provider returns, delivered as is inside the standard envelope. Three practical consequences:

• The field names are in Portuguese, in the provider's vocabulary (nome, qualificacao, paisOrigem), and not in the English camelCase used by the rest of the API.
• Every block is optional. A block only shows up when the provider has data for it. Never assume a key exists: test before accessing it.
• There is no type guarantee. Since there is no conversion along the way, the same field may arrive as a number or as text depending on where the data came from.

Request

GET /receita-federal-cnpj-qsa/v1

Parameters

Parameter	Description	Required
taxId	CNPJ	Yes

TIP

The CNPJ can be sent with or without the mask (12.345.678/0001-95 or 12345678000195) and must be sent with all its characters, including any leading zeros.

A CNPJ that fails the check-digit validation returns 422 before any lookup is performed — and that is also what happens when taxId is not informed.

Alphanumeric CNPJ

The endpoint accepts the alphanumeric CNPJ defined by IN RFB 2.229/2024 (a Federal Revenue Service normative instruction), in which the first eight positions of the root and the four of the order number may contain letters, while the two check digits remain numeric.

GET /receita-federal-cnpj-qsa/v1?taxId=12ABC34501DE35

The letters can be sent in lowercase: the API normalizes them to uppercase before querying the provider. The mask is accepted as well: 12.ABC.345/01DE-35.

Headers

Authorization: ApiKey <your-api-key>

An unknown query parameter is ignored

A parameter other than taxId does not raise an error: it is simply ignored, and the response comes back 200 as usual.

Example request

GET /receita-federal-cnpj-qsa/v1?taxId=12.345.678/0001-95

curl -i -G 'https://api.nxcd.app/receita-federal-cnpj-qsa/v1' \
  --header 'Authorization: ApiKey YOUR_API_KEY' \
  --data-urlencode 'taxId=12345678000195'

Response

Field	Description	Type
id	Unique ID of the request	String
version	API version	String
data	Object with the result of the lookup	Object
data.cnpj	CNPJ queried	String
data.receitaFederalQsa	Object with the result of the lookup	Object
data.receitaFederalQsa.qsa	List with the data found for each person	Object[]
data.receitaFederalQsa.urlComprovante	URL with the receipt of the lookup performed	String
metadata	Object with the metadata of the request	Object
metadata.timeSpent	Request time, in milliseconds	Number

data.receitaFederalQsa.qsa[]

Each item is a person in the ownership and management structure.

Field	Description	Type
nome	Name of the partner or manager	String
qualificacao	Code and description of the role ("qualificação") at the Federal Revenue Service	String
nomeRepresentanteLegal	Name of the legal representative, when there is one	String
qualificacaoRepresentanteLegal	Role of the legal representative, when there is one	String
paisOrigem	Country of origin, when the partner is a foreign national	String

A field with no value comes as an empty string.

🚧 The lookup also brings the Federal Revenue Service registration, without the receipt

Besides the QSA, the provider is also queried for the registration of the CNPJ, and the receitaFederal block may come in the response. The API removes the urlComprovante from that block before answering — the QSA receipt, in receitaFederalQsa, is not removed.

JSON examples

Here are some JSON examples of the response.

1. Example when the data is found

Status Code: 200

{
  "id": "13cfec7c-b238-4820-a4d1-5173e4c1418e",
  "version": "v1",
  "data": {
    "cnpj": "12345678000195",
    "receitaFederalQsa": {
      "qsa": [
        {
          "nome": "FULANO",
          "qualificacao": "49-Sócio-Administrador",
          "nomeRepresentanteLegal": "",
          "qualificacaoRepresentanteLegal": "",
          "paisOrigem": ""
        },
        {
          "nome": "FULANO",
          "qualificacao": "49-Sócio-Administrador",
          "nomeRepresentanteLegal": "",
          "qualificacaoRepresentanteLegal": "",
          "paisOrigem": ""
        }
      ],
      "urlComprovante": "https://..."
    }
  },
  "metadata": {
    "timeSpent": 10000
  }
}

Response headers

Header	When it appears
Nextid-ReqId	On every response. Carries the request identifier, the same one as the id field of the body.

Errors

Code	When it happens
401 Unauthorized	API key missing, invalid, or without the nextid.bureaus.qsa permission.
404 Not Found	The version informed in the URL does not exist. Only v1 is accepted.
422 Unprocessable Entity	taxId missing, or a CNPJ that fails the check-digit validation.
500 Internal Server Error	Unexpected failure during processing.

Example of a response with an invalid or missing CNPJ:

Status Code: 422

{
  "id": "13cfec7c-b238-4820-a4d1-5173e4c1418e",
  "error": {
    "statusCode": 422,
    "error": "Unprocessable Entity",
    "message": "Invalid taxId (CNPJ)"
  }
}

The format of the error responses is described in HTTP response codes.

Versions

The only version is v1, and it is the one that answers when the version is omitted from the URL. /receita-federal-cnpj-qsa and /receita-federal-cnpj-qsa/v1 are equivalent.

Version	Status	What changes
v1	Recommended	The only version. It is what answers when the version is omitted from the URL.

Any other value in place of v1 returns 404 with the message API version not found.

Related endpoints

For the state tax registration of the same CNPJ, see Sintegra. For the full dossier of the company, with the ownership structure among many other blocks, see Background Check (company).