isGenAI Content Credentials API

openapi: 3.2.0
info:
  title: isGenAI public checker Content Credentials API
  version: 1.2.0
  description: 'Importable contract for the public evidence checker, saved-prompt extraction/optional reconstruction, C2PA Content Credentials inspection, the public remote MCP endpoint and the health endpoint. Other endpoints documented on /api are outside this contract. Evidence checks and image quality measurements do not establish human authorship. Saved records can be edited; reconstructed prompts describe a similar result and are not recovered originals. A valid C2PA signature and a trusted signer are reported separately. Response schemas: isgenai.check.v1, isgenai.prompt.v1 and isgenai.c2pa-inspection.v1; the MCP endpoint speaks JSON-RPC 2.0.'
  termsOfService: https://isgenai.com/terms
  contact:
    name: isGenAI
    url: https://isgenai.com/contact
servers:
- url: https://isgenai.com
  description: Public production API
security: []
tags:
- name: Content Credentials
  description: Read and validate the C2PA manifest of one uploaded file. Signature validity (cryptographic_validation) and signer trust (trust_validation) are separate results; a missing manifest is not evidence of a camera or of a human author.
  externalDocs:
    description: Content Credentials and C2PA inspection
    url: https://isgenai.com/content-credentials
paths:
  /api/v1/c2pa/inspect:
    post:
      operationId: inspectContentCredentials
      tags:
      - Content Credentials
      summary: Read and validate the C2PA Content Credentials of one file
      description: 'Reads the C2PA manifest store of the uploaded file with the Content Authenticity Node reader and validation enabled, and reports the active manifest, recorded actions, IPTC digital source types, signature details, cryptographic validation and signer trust as separate fields. Remote manifests may be fetched. The result describes the supplied copy only: screenshots, exports and most social uploads remove manifests, and a missing manifest does not establish human authorship.'
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/MultipartC2paInput'
            examples:
              signedImage:
                summary: Bind file to the file bytes; @test-signed.png is curl syntax, not the HTTP value
                value:
                  file: (binary file bytes)
      responses:
        '200':
          description: Inspection completed. Unsupported types and files without a manifest are also HTTP 200, distinguished by status.
          headers:
            Cache-Control:
              schema:
                type: string
                enum:
                - no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/C2paInspectionResponse'
              examples:
                validSignatureUntrustedSigner:
                  summary: Actual inspection of https://isgenai.com/examples/c2pa-lab/test-signed.png
                  description: Generated locally from this implementation with remote manifest fetching disabled; generated_at is normalized. The signature and data hash validate, but the disposable test signer is not trusted.
                  value:
                    schema: isgenai.c2pa-inspection.v1
                    generated_at: '2026-10-21T00:00:00.000Z'
                    status: C2PA_VALIDATED_WITH_WARNINGS
                    file:
                      name: test-signed.png
                      type: image/png
                      size: 58196
                      sha256: ce4b8329b838e06147f2c8b002ee366d23bcdecb9bba4b322481920944c255c5
                    c2pa:
                      detected: true
                      embedded: true
                      manifest_labels:
                      - urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c
                      active_manifest:
                        label: urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c
                        title: 'Controlled example: code-drawn pixels, disposable test signer'
                        claim_generator_info:
                        - isGenAI controlled-example builder 1.0
                        ingredients_count: 0
                        assertions_count: 1
                        action_count: 1
                        actions:
                        - c2pa.created (algorithmicMedia)
                        digital_source_types:
                        - algorithmicMedia
                        signature:
                          alg: Es256
                          issuer: Development demonstration only
                          common_name: isGenAI controlled-example disposable signer
                    validation:
                      state: Valid
                      cryptographic_validation: VALIDATED
                      trust_validation: UNTRUSTED_OR_UNKNOWN
                      success_codes:
                      - claimSignature.insideValidity
                      - claimSignature.validated
                      - assertion.hashedURI.match
                      - assertion.hashedURI.match
                      - assertion.hashedURI.match
                      - assertion.dataHash.match
                      informational_codes: []
                      failure_codes:
                      - signingCredential.untrusted
                      status_codes:
                      - code: claimSignature.insideValidity
                        explanation: claim signature valid
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.signature
                      - code: claimSignature.validated
                        explanation: claim signature valid
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.signature
                      - code: assertion.hashedURI.match
                        explanation: 'hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data'
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.assertions/c2pa.hash.data
                      - code: assertion.hashedURI.match
                        explanation: 'hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim'
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.assertions/c2pa.thumbnail.claim
                      - code: assertion.hashedURI.match
                        explanation: 'hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions.v2'
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.assertions/c2pa.actions.v2
                      - code: assertion.dataHash.match
                        explanation: data hash valid
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.assertions/c2pa.hash.data
                      - code: signingCredential.untrusted
                        explanation: signing certificate untrusted
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.signature
                      - code: signingCredential.untrusted
                        explanation: signing certificate untrusted
                        url: self#jumbf=/c2pa/urn:c2pa:37c68114-5933-4318-ab6a-507a46ace50c/c2pa.signature
                    limitations:
                    - Supported C2PA manifests are read with the Content Authenticity Node reader and validation enabled.
                    - Trust status depends on the signing credential and available trust material; an untrusted signer is reported separately from a broken manifest.
                    - Files without C2PA manifests may still contain other provenance or watermark signals that require separate checks.
                    - This is not a universal AI detector and does not prove legal compliance by itself.
                noManifest:
                  summary: Actual inspection of https://isgenai.com/examples/c2pa-lab/unsigned-control.png
                  value:
                    schema: isgenai.c2pa-inspection.v1
                    generated_at: '2026-10-21T00:00:00.000Z'
                    status: NO_C2PA_MANIFEST
                    file:
                      name: unsigned-control.png
                      type: image/png
                      size: 13179
                      sha256: acdc3a0a5e011cf57af9bf0f1da74c75c2d280a2cc9af9297410c529f86932cf
                    c2pa:
                      detected: false
                      embedded: false
                      manifest_labels: []
                    validation:
                      cryptographic_validation: NOT_PRESENT
                      trust_validation: NOT_PRESENT
                      success_codes: []
                      informational_codes: []
                      failure_codes: []
                      status_codes: []
                    limitations:
                    - Supported C2PA manifests are read with the Content Authenticity Node reader and validation enabled.
                    - Trust status depends on the signing credential and available trust material; an untrusted signer is reported separately from a broken manifest.
                    - Files without C2PA manifests may still contain other provenance or watermark signals that require separate checks.
                    - This is not a universal AI detector and does not prove legal compliance by itself.
        '400':
          description: The multipart field file is missing or is not a file.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/C2paInspectError'
              example:
                error: Upload a file using multipart form field `file`.
        '413':
          description: The multipart body exceeds 26,279,936 bytes (shared upload limiter, error.code too_large), or the file part exceeds 26,214,400 bytes (status UNSUPPORTED_FILE).
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/UploadTooLargeError'
                - $ref: '#/components/schemas/C2paFileTooLargeError'
              examples:
                bodyTooLarge:
                  value:
                    error:
                      code: too_large
                      message: This upload exceeds the allowed size.
                fileTooLarge:
                  value:
                    schema: isgenai.c2pa-inspection.v1
                    status: UNSUPPORTED_FILE
                    error: File is larger than 25 MB.
        '429':
          description: Shared concurrent upload capacity is full; error.code is busy. Respect Retry-After and use a bounded retry policy.
          headers:
            Retry-After:
              description: Seconds to wait before a bounded retry.
              schema:
                type: integer
                minimum: 1
                example: 5
            Cache-Control:
              schema:
                type: string
                enum:
                - no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusyError'
              example:
                error:
                  message: Checks are busy. Please try again shortly.
                  code: busy
components:
  schemas:
    C2paFileTooLargeError:
      type: object
      required:
      - schema
      - status
      - error
      description: The file part is larger than 25 MiB while the multipart body is still within its cap.
      properties:
        schema:
          type: string
          enum:
          - isgenai.c2pa-inspection.v1
        status:
          type: string
          enum:
          - UNSUPPORTED_FILE
        error:
          type: string
    C2paStatusCode:
      type: object
      required:
      - code
      properties:
        code:
          type: string
        success:
          type: boolean
        explanation:
          type: string
        url:
          type: string
    MultipartC2paInput:
      type: object
      required:
      - file
      description: Upload one file in the multipart field file. Only file is read. Full multipart body cap is 26,279,936 bytes including boundaries; larger bodies return HTTP 413 too_large.
      x-maxBodyBytes: 26279936
      properties:
        file:
          type: string
          format: binary
          x-maxSizeBytes: 26214400
          description: 'File bytes, at most 26,214,400 bytes (25 MiB). Inspected types: JPEG, PNG, WebP, AVIF, HEIC/HEIF, TIFF, MP4, MOV, MP3, M4A, WAV and PDF; the type comes from the part''s Content-Type, or the file extension when it is missing or application/octet-stream. Other types return HTTP 200 with status UNSUPPORTED_FILE. The file is processed in memory on isGenAI servers.'
    BusyError:
      type: object
      description: Shared concurrency limiter response, without a schema field. Current responses include code=busy; code remains optional for compatibility with historical message-only responses.
      properties:
        error:
          type: object
          properties:
            message:
              type: string
            code:
              type: string
              enum:
              - busy
          required:
          - message
      required:
      - error
    C2paInspectionStatus:
      type: string
      enum:
      - C2PA_TRUSTED
      - C2PA_VALIDATED
      - C2PA_VALIDATED_WITH_WARNINGS
      - C2PA_INVALID
      - NO_C2PA_MANIFEST
      - UNSUPPORTED_FILE
      - C2PA_VALIDATION_ERROR
      description: Overall inspection outcome. C2PA_VALIDATED_WITH_WARNINGS includes a valid signature from a signer that is not on the trust list. NO_C2PA_MANIFEST means no manifest was found in this copy, not that the content is human-made.
    UploadTooLargeError:
      type: object
      required:
      - error
      description: Shared upload-limit response when the streamed body exceeds the route's byte cap, without a schema field.
      properties:
        error:
          type: object
          required:
          - code
          - message
          properties:
            code:
              type: string
              enum:
              - too_large
            message:
              type: string
    C2paInspectionResponse:
      type: object
      description: isgenai.c2pa-inspection.v1. Optional fields are omitted when the manifest does not carry them.
      required:
      - schema
      - generated_at
      - status
      - file
      - c2pa
      - validation
      - limitations
      properties:
        schema:
          type: string
          enum:
          - isgenai.c2pa-inspection.v1
        generated_at:
          type: string
          format: date-time
        status:
          $ref: '#/components/schemas/C2paInspectionStatus'
        file:
          type: object
          required:
          - name
          - type
          - size
          - sha256
          properties:
            name:
              type: string
            type:
              type: string
            size:
              type: integer
              minimum: 0
            sha256:
              type: string
              pattern: ^[0-9a-f]{64}$
        c2pa:
          type: object
          required:
          - detected
          - embedded
          - manifest_labels
          properties:
            detected:
              type: boolean
            embedded:
              type: boolean
            remote_url:
              type: string
            manifest_labels:
              type: array
              items:
                type: string
            active_manifest:
              $ref: '#/components/schemas/C2paActiveManifest'
        validation:
          type: object
          required:
          - cryptographic_validation
          - trust_validation
          - success_codes
          - informational_codes
          - failure_codes
          - status_codes
          properties:
            state:
              type: string
              enum:
              - Invalid
              - Valid
              - Trusted
            cryptographic_validation:
              type: string
              enum:
              - VALIDATED
              - FAILED
              - NOT_PRESENT
              - NOT_EVALUATED
            trust_validation:
              type: string
              enum:
              - TRUSTED
              - UNTRUSTED_OR_UNKNOWN
              - NOT_PRESENT
              - NOT_EVALUATED
            success_codes:
              type: array
              items:
                type: string
            informational_codes:
              type: array
              items:
                type: string
            failure_codes:
              type: array
              items:
                type: string
            status_codes:
              type: array
              items:
                $ref: '#/components/schemas/C2paStatusCode'
        limitations:
          type: array
          items:
            type: string
    C2paInspectError:
      type: object
      required:
      - error
      description: 'Request error from the C2PA inspection route: a plain message string, without a schema field.'
      properties:
        error:
          type: string
    C2paActiveManifest:
      type: object
      required:
      - claim_generator_info
      - ingredients_count
      - assertions_count
      - action_count
      - actions
      properties:
        label:
          type: string
        title:
          type: string
        format:
          type: string
        claim_generator:
          type: string
        claim_generator_info:
          type: array
          items:
            type: string
        ingredients_count:
          type: integer
          minimum: 0
        assertions_count:
          type: integer
          minimum: 0
        action_count:
          type: integer
          minimum: 0
        actions:
          type: array
          maxItems: 8
          items:
            type: string
          description: Up to eight recorded actions, with the IPTC digital source type in parentheses when present.
        digital_source_types:
          type: array
          items:
            type: string
          description: IPTC digital source type codes recorded in c2pa.actions, e.g. trainedAlgorithmicMedia.
        signature:
          type: object
          properties:
            alg:
              type: string
            issuer:
              type: string
            common_name:
              type: string
            time:
              type: string
            revocation_status:
              type: boolean
externalDocs:
  description: API instructions and interpretation
  url: https://isgenai.com/api
x-mcp:
  endpoint: https://isgenai.com/mcp
  transport: streamable-http
  stateless: true
  authentication: none
  tools:
  - check_text
  - check_url
  - check_image
  - extract_saved_prompt
  - read_content_credentials
  serverCard: https://isgenai.com/.well-known/mcp/server-card.json
  documentation: https://isgenai.com/developers/mcp