Rose, if you open the browser toolbar of your browser, go to the network tab and do tests on the page, you will see the URL being called and the parameters. I extracted a portion for simulation, as below:
$.post('https://cadastro.r7.com/ajax/validate/cpf'
, { 'user.documentNumber':'111.111.111-11', 'user.birthDate':'01/01/1900' }
, function (data) {
if (data == '') {
alert('Válido');
} else {
// Este trecho converte códigos de acentos
// (ex.: á ç) nos seus respectivos caracteres.
var div = document.createElement('div');
div.innerHTML = data.message;
alert(div.innerText);
}
}
);
This section will only work on R7's own website (developer tools console), because for security, the browser blocks cross-domain requests. There are libraries to circumvent such restrictions, but there is always the disadvantage that since the R7 portal did not make this feature available to share with third parties, one day your validation stops working and you have to study the code again and do the necessary changes. I do not know if it's worth the risk.
You can create a page on your server to send the data to the Revenue, including captcha, and retrieve the return, but it falls at the same disadvantage as being vulnerable to Revenue changes. An example in C #, but for CNPJ (worth to understand how complex the mission is): link
There may be third-party (paid) services that provide a WebService to perform such queries, but I do not know how valuable it is to do this validation. You can make it difficult for the user to fill in incorrect data by performing the same validation on the server, but if he is willing to circumvent it, the user is at risk of using third party data.
When deciding which way to go, update the question to serve as a reference for other programmers who find this page.