# Task: Issue an e-CPF with your face

I want my application to do what Lacuna's "Issue an e-CPF with your face" demo does: Prove who you are with your face, checked against the government's records, and get a test e-CPF, A1 or A3.

- Docs: https://docs.lacunasoftware.com/en-us/articles/amplia
- Live demo: https://try.lacunasoftware.com/en/amplia/issue-an-ecpf-with-your-face
- This demo for AI agents: https://try.lacunasoftware.com/en/amplia/issue-an-ecpf-with-your-face.md

## Samples

Lacuna lists no sample for this task: rely on the docs and the call sequence below.

## Call sequence

No call sequence has been recorded for this demo yet, so none is shown here: this page doesn't guess calls. The docs and samples below show the calls; the live demo makes them.

## Patterns to copy

- Run Serpro's Datavalid `pf-basica` check before any face capture, returning users included: the name must match exactly, the birth date match, the CPF be regular, and a CNH exist, since Datavalid compares the face with the CNH photo.
- Enroll with the CPF's digits as the Subject identifier and `VerifyFaceIdentityExternally = true`; on `BioSubjectAlreadyEnrolled`, start a Face authentication instead, never replacing the enrollment. The Demo uses a Rest PKI Core subscription of its own for these faces.
- Datavalid's result is not in the completion status: read it with `GetSessionDetailsAsync(sessionId)`, which needs an API key allowed to view bio sessions.
- Treat the session URL and the widget's ticket as credentials: never log or show them.
- Once the face passes, issue the e-CPF from a CSR, as in the e-CNPJ flow, with no Amplia issue page and no return trip. Never turn on the Serpro client's sensitive-data logging: it would log the CPF, name and birth date.

## What to do

Implement this in my project with its existing stack, language, framework and conventions, following the call sequence and the patterns above, and adapting the samples rather than copying them whole. Ask me before adding any dependency or package. Keep API keys and private keys out of the browser and out of the repository.