Read an image's Content Credentials (C2PA)

POST/v1/content-credentials/check

The same validator and summary as the workflow's Content Credentials check: verdict, signer, generator, AI-generated and edited flags. CHF 0.05 per checked file; a format the validator cannot read is answered NOT_APPLICABLE and not charged. Needs the c2pa:check scope.

Send your API key in the x-api-key header.

Headers

  • Idempotency-Keystring8–200 chars

    Reuse on retries (printable non-space ASCII). For 24 hours the same key and the same request return the saved answer and check id without a second charge; a different request under the key returns 409.

Request bodyapplication/jsonrequired

  • reference_idstring≤ 128 chars

    Your own id, echoed in the answer.

  • sandbox_outcomestring

    Sandbox keys only: which test answer to return. No model runs and nothing is charged.

    One oftrustedno_manifestai_generatedinvalid

  • filestringrequired

    JPEG, PNG, WebP, HEIC, HEIF or AVIF, at most 20 MB.

Responses

  • 200The answer.
    • check_idstringuuid
    • productstring
    • environmentstring | null
    • sandboxboolean
    • checked_atstringdate-time
    • reference_idstring
    • signed_resultstring

      The same answer as an ES256 JWS, verifiable with /.well-known/jwks.json.

    • statestring

      One ofCHECKEDNOT_APPLICABLE

    • reasonstring | null
    • verdictstring | null

      One oftrustedvalid_untrustedinvalidno_manifest

    • signerstring | null
    • issuerstring | null
    • claim_generatorstring | null
    • signed_atstring | null
    • digital_source_typestring | null
    • actionsarray of string
    • ai_generatedboolean
    • editedboolean
    • camera_captureboolean
    • failure_codesarray of string
  • 400Invalid input.
  • 401Missing, unknown or expired API key.
  • 402The balance does not cover the check.
  • 403The key lacks the product's scope, its IP allowlist refuses the caller, or (code production_not_allowed) the organization may not use production yet.
  • 409The Idempotency-Key is in progress (Retry-After: 1) or was used with a different request.
  • 413A file or the body is too large.
  • 415A file is not of an accepted type (checked by its bytes, not its name), or the body is neither multipart nor JSON.
  • 422An image could not be decoded. Not charged.
  • 429More than 300 calls in a minute for this product.
  • 503The check could not run on our side. Nothing was charged; retry later with the same Idempotency-Key.
curl -X POST https://api-verify.secuveri.com/v1/content-credentials/check \
  -H "x-api-key: $SECUVERI_API_KEY" \
  -H "content-type: application/json" \
  -H "Idempotency-Key: signup-1042-retry-safe" \
  -d '{
  "file": "<file>"
}'
Response · 200
{
  "check_id": "6f1c2e0a-8f43-4f7e-9a51-2b7c1d9e4a10",
  "product": "<product>",
  "environment": "<environment>",
  "sandbox": true,
  "checked_at": "2026-10-23T09:12:44.120Z",
  "reference_id": "<reference id>",
  "signed_result": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiJ9.…",
  "state": "CHECKED",
  "reason": "Confirmed fraud",
  "verdict": "trusted",
  "signer": "<signer>",
  "issuer": "<issuer>",
  "claim_generator": "<claim generator>",
  "signed_at": "<signed at>",
  "digital_source_type": "<digital source type>",
  "actions": [
    "string"
  ],
  "ai_generated": true,
  "edited": true,
  "camera_capture": true,
  "failure_codes": [
    "string"
  ]
}