Read an image's Content Credentials (C2PA)
/v1/content-credentials/checkThe same validator and summary as the workflow's Content Credentials check: verdict, signer, generator, AI-generated and edited flags. CHF 0.05 per checked file; a format the validator cannot read is answered NOT_APPLICABLE and not charged. Needs the c2pa:check scope.
Send your API key in the x-api-key header.
Headers
- Idempotency-Keystring8–200 chars
Reuse on retries (printable non-space ASCII). For 24 hours the same key and the same request return the saved answer and check id without a second charge; a different request under the key returns 409.
Request bodyapplication/jsonrequired
- reference_idstring≤ 128 chars
Your own id, echoed in the answer.
- sandbox_outcomestring
Sandbox keys only: which test answer to return. No model runs and nothing is charged.
One of
trustedno_manifestai_generatedinvalid - filestringrequired
JPEG, PNG, WebP, HEIC, HEIF or AVIF, at most 20 MB.
Responses
200The answer.
- check_idstringuuid
- productstring
- environmentstring | null
- sandboxboolean
- checked_atstringdate-time
- reference_idstring
- signed_resultstring
The same answer as an ES256 JWS, verifiable with /.well-known/jwks.json.
- statestring
One of
CHECKEDNOT_APPLICABLE - reasonstring | null
- verdictstring | null
One of
trustedvalid_untrustedinvalidno_manifest - signerstring | null
- issuerstring | null
- claim_generatorstring | null
- signed_atstring | null
- digital_source_typestring | null
- actionsarray of string
- ai_generatedboolean
- editedboolean
- camera_captureboolean
- failure_codesarray of string
- 400Invalid input.
- 401Missing, unknown or expired API key.
- 402The balance does not cover the check.
- 403The key lacks the product's scope, its IP allowlist refuses the caller, or (code production_not_allowed) the organization may not use production yet.
- 409The Idempotency-Key is in progress (Retry-After: 1) or was used with a different request.
- 413A file or the body is too large.
- 415A file is not of an accepted type (checked by its bytes, not its name), or the body is neither multipart nor JSON.
- 422An image could not be decoded. Not charged.
- 429More than 300 calls in a minute for this product.
- 503The check could not run on our side. Nothing was charged; retry later with the same Idempotency-Key.
curl -X POST https://api-verify.secuveri.com/v1/content-credentials/check \
-H "x-api-key: $SECUVERI_API_KEY" \
-H "content-type: application/json" \
-H "Idempotency-Key: signup-1042-retry-safe" \
-d '{
"file": "<file>"
}'{
"check_id": "6f1c2e0a-8f43-4f7e-9a51-2b7c1d9e4a10",
"product": "<product>",
"environment": "<environment>",
"sandbox": true,
"checked_at": "2026-10-23T09:12:44.120Z",
"reference_id": "<reference id>",
"signed_result": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiJ9.…",
"state": "CHECKED",
"reason": "Confirmed fraud",
"verdict": "trusted",
"signer": "<signer>",
"issuer": "<issuer>",
"claim_generator": "<claim generator>",
"signed_at": "<signed at>",
"digital_source_type": "<digital source type>",
"actions": [
"string"
],
"ai_generated": true,
"edited": true,
"camera_capture": true,
"failure_codes": [
"string"
]
}