BHYT XML Checker Online

Check the health-insurance assessment XML (QĐ 130/4750/3176/1931) before sending: envelope, base64 tables, fields, codes, formulas and XML1 totals.

XML (GIAMDINHHS or one table)

Return decoded tables

Free tool: 20 requests per minute.

Result

Press “Run” to see the result.

Send the GIAMDINHHS file (as xml, a raw XML body or a multipart file) or a single table (e.g. <TONG_HOP>). The API decodes every FILEHOSO (XML1–XML11, XML13–XML15, base64) and checks it against the schema of QĐ 130/QĐ-BYT as amended by QĐ 4750/QĐ-BYT, QĐ 3176/QĐ-BYT and QĐ 1931/QĐ-BYT (from 1/7/2026): required fields, numbers with a dot separator, maximum lengths, yyyyMMddHHmm / yyyyMMdd dates, code lists (MA_LOAI_KCB, KET_QUA_DTRI, MA_LOAI_RV, GIOI_TINH, PHAM_VI…), ICD-10 format, BHYT card codes with matching MA_DKBD / GT_THE_* lists, 5-character facility codes and NGAY_VAO ≤ NGAY_RA.

Cross-checks: MA_LK identical in every table of a HOSO, STT sequences, the QĐ 3176 line formulas of XML2 / XML3 (THANH_TIEN_BV, THANH_TIEN_BH, T_BHTT, T_BNTT, T_BNCCT) as warnings, and the XML1 totals (T_THUOC, T_VTYT, T_TONGCHI_BV, T_TONGCHI_BH, T_BNTT, T_BNCCT, T_BHTT, T_NGUONKHAC, T_BHTT_GDV) against the sums of XML2 + XML3 as errors, with a tolerance of 1 VND per 10 lines (tolerance). Every problem comes with HOSO, MA_LK, table, row, field and a code. list=schema returns the field tables; include_data=true returns the decoded tables as JSON.

This is a pre-submission check: the BHXH assessment rules are more detailed and not all public, so a clean result does not guarantee acceptance. Files are processed in memory and never stored.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/vn-bhyt-xml" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"xml":"<TONG_HOP><MA_LK>LK0001</MA_LK><STT>1</STT><MA_BN>BN01</MA_BN><HO_TEN>Nguyễn Văn An</HO_TEN><NGAY_SINH>199003150000</NGAY_SINH><GIOI_TINH>1</GIOI_TINH><MA_QUOCTICH>000</MA_QUOCTICH><MA_DANTOC>01</MA_DANTOC><MA_NGHE_NGHIEP>00</MA_NGHE_NGHIEP><MA_THE_BHYT>DN4797931234567</MA_THE_BHYT><MA_DKBD>79001</MA_DKBD><GT_THE_TU>20260101</GT_THE_TU><GT_THE_DEN>20261231</GT_THE_DEN><MA_BENH_CHINH>J18.9</MA_BENH_CHINH><MA_DOITUONG_KCB>1</MA_DOITUONG_KCB><NGAY_VAO>202611100800</NGAY_VAO><NGAY_RA>202611091000</NGAY_RA><SO_NGAY_DTRI>1</SO_NGAY_DTRI><KET_QUA_DTRI>1</KET_QUA_DTRI><MA_LOAI_RV>1</MA_LOAI_RV><T_THUOC>50000</T_THUOC><T_VTYT>0</T_VTYT><T_TONGCHI_BV>88700</T_TONGCHI_BV><T_TONGCHI_BH>88700</T_TONGCHI_BH><T_BNTT>0</T_BNTT><T_BNCCT>17740</T_BNCCT><T_BHTT>70960</T_BHTT><T_NGUONKHAC>0</T_NGUONKHAC><T_BHTT_GDV>70960</T_BHTT_GDV><NAM_QT>2026</NAM_QT><THANG_QT>11</THANG_QT><MA_LOAI_KCB>1</MA_LOAI_KCB><MA_KHOA>K01</MA_KHOA><MA_CSKCB>79001</MA_CSKCB><MA_TTDV>000123/HCM-GPHN</MA_TTDV></TONG_HOP>"}'

const res = await fetch('https://apibox.io.vn/v1/vn-bhyt-xml', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "xml": "<TONG_HOP><MA_LK>LK0001</MA_LK><STT>1</STT><MA_BN>BN01</MA_BN><HO_TEN>Nguyễn Văn An</HO_TEN><NGAY_SINH>199003150000</NGAY_SINH><GIOI_TINH>1</GIOI_TINH><MA_QUOCTICH>000</MA_QUOCTICH><MA_DANTOC>01</MA_DANTOC><MA_NGHE_NGHIEP>00</MA_NGHE_NGHIEP><MA_THE_BHYT>DN4797931234567</MA_THE_BHYT><MA_DKBD>79001</MA_DKBD><GT_THE_TU>20260101</GT_THE_TU><GT_THE_DEN>20261231</GT_THE_DEN><MA_BENH_CHINH>J18.9</MA_BENH_CHINH><MA_DOITUONG_KCB>1</MA_DOITUONG_KCB><NGAY_VAO>202611100800</NGAY_VAO><NGAY_RA>202611091000</NGAY_RA><SO_NGAY_DTRI>1</SO_NGAY_DTRI><KET_QUA_DTRI>1</KET_QUA_DTRI><MA_LOAI_RV>1</MA_LOAI_RV><T_THUOC>50000</T_THUOC><T_VTYT>0</T_VTYT><T_TONGCHI_BV>88700</T_TONGCHI_BV><T_TONGCHI_BH>88700</T_TONGCHI_BH><T_BNTT>0</T_BNTT><T_BNCCT>17740</T_BNCCT><T_BHTT>70960</T_BHTT><T_NGUONKHAC>0</T_NGUONKHAC><T_BHTT_GDV>70960</T_BHTT_GDV><NAM_QT>2026</NAM_QT><THANG_QT>11</THANG_QT><MA_LOAI_KCB>1</MA_LOAI_KCB><MA_KHOA>K01</MA_KHOA><MA_CSKCB>79001</MA_CSKCB><MA_TTDV>000123/HCM-GPHN</MA_TTDV></TONG_HOP>"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/vn-bhyt-xml",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"xml": "<TONG_HOP><MA_LK>LK0001</MA_LK><STT>1</STT><MA_BN>BN01</MA_BN><HO_TEN>Nguyễn Văn An</HO_TEN><NGAY_SINH>199003150000</NGAY_SINH><GIOI_TINH>1</GIOI_TINH><MA_QUOCTICH>000</MA_QUOCTICH><MA_DANTOC>01</MA_DANTOC><MA_NGHE_NGHIEP>00</MA_NGHE_NGHIEP><MA_THE_BHYT>DN4797931234567</MA_THE_BHYT><MA_DKBD>79001</MA_DKBD><GT_THE_TU>20260101</GT_THE_TU><GT_THE_DEN>20261231</GT_THE_DEN><MA_BENH_CHINH>J18.9</MA_BENH_CHINH><MA_DOITUONG_KCB>1</MA_DOITUONG_KCB><NGAY_VAO>202611100800</NGAY_VAO><NGAY_RA>202611091000</NGAY_RA><SO_NGAY_DTRI>1</SO_NGAY_DTRI><KET_QUA_DTRI>1</KET_QUA_DTRI><MA_LOAI_RV>1</MA_LOAI_RV><T_THUOC>50000</T_THUOC><T_VTYT>0</T_VTYT><T_TONGCHI_BV>88700</T_TONGCHI_BV><T_TONGCHI_BH>88700</T_TONGCHI_BH><T_BNTT>0</T_BNTT><T_BNCCT>17740</T_BNCCT><T_BHTT>70960</T_BHTT><T_NGUONKHAC>0</T_NGUONKHAC><T_BHTT_GDV>70960</T_BHTT_GDV><NAM_QT>2026</NAM_QT><THANG_QT>11</THANG_QT><MA_LOAI_KCB>1</MA_LOAI_KCB><MA_KHOA>K01</MA_KHOA><MA_CSKCB>79001</MA_CSKCB><MA_TTDV>000123/HCM-GPHN</MA_TTDV></TONG_HOP>"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/vn-bhyt-xml');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"xml":"<TONG_HOP><MA_LK>LK0001</MA_LK><STT>1</STT><MA_BN>BN01</MA_BN><HO_TEN>Nguyễn Văn An</HO_TEN><NGAY_SINH>199003150000</NGAY_SINH><GIOI_TINH>1</GIOI_TINH><MA_QUOCTICH>000</MA_QUOCTICH><MA_DANTOC>01</MA_DANTOC><MA_NGHE_NGHIEP>00</MA_NGHE_NGHIEP><MA_THE_BHYT>DN4797931234567</MA_THE_BHYT><MA_DKBD>79001</MA_DKBD><GT_THE_TU>20260101</GT_THE_TU><GT_THE_DEN>20261231</GT_THE_DEN><MA_BENH_CHINH>J18.9</MA_BENH_CHINH><MA_DOITUONG_KCB>1</MA_DOITUONG_KCB><NGAY_VAO>202611100800</NGAY_VAO><NGAY_RA>202611091000</NGAY_RA><SO_NGAY_DTRI>1</SO_NGAY_DTRI><KET_QUA_DTRI>1</KET_QUA_DTRI><MA_LOAI_RV>1</MA_LOAI_RV><T_THUOC>50000</T_THUOC><T_VTYT>0</T_VTYT><T_TONGCHI_BV>88700</T_TONGCHI_BV><T_TONGCHI_BH>88700</T_TONGCHI_BH><T_BNTT>0</T_BNTT><T_BNCCT>17740</T_BNCCT><T_BHTT>70960</T_BHTT><T_NGUONKHAC>0</T_NGUONKHAC><T_BHTT_GDV>70960</T_BHTT_GDV><NAM_QT>2026</NAM_QT><THANG_QT>11</THANG_QT><MA_LOAI_KCB>1</MA_LOAI_KCB><MA_KHOA>K01</MA_KHOA><MA_CSKCB>79001</MA_CSKCB><MA_TTDV>000123/HCM-GPHN</MA_TTDV></TONG_HOP>"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Which version is implemented?

QĐ 130/QĐ-BYT with QĐ 4750 (1/7/2024), QĐ 3176 (1/1/2025) and the verified part of QĐ 1931/QĐ-BYT (MUC_HUONG size 4, from 1/7/2026).

Does it check drug and service codes against the catalogues?

No: codes are checked for format only. Catalogue lookups (drugs, services, departments, doctors) need the facility’s registered lists.

Is the digital signature verified?

No: the response only says whether CHUKYDONVI is present.