Check an image for Depicta's AI marks
Check whether an image carries Depicta’s AI marks: Content Credentials (C2PA), the invisible TrustMark watermark and the exact file fingerprint. Free; no credits are charged.
Send the file as multipart/form-data in the field “image”: PNG, JPEG, WebP, GIF (first frame) or SVG, at most 50 MB (SVG 5 MB), 40 megapixels and 16,384 pixels per side. Convert HEIC or AVIF to JPEG or PNG first.
Or send application/json {“url”: “https://…”}: Depicta fetches a public http(s) URL on port 80 or 443 (at most 3 redirects, 10 s, 50 MB) and checks it the same way; by default 5 URL checks a minute per caller and 20 a minute per site. A URL that cannot be fetched answers 422 input_image_unreachable with the reason (blocked_address, http_status, timeout, too_large, connection_failed).
Authenticate with an API key (limits per account, by default 60 checks a minute and 2,000 a day) or, from the page at https://depicta.ai/verify, with a Cloudflare Turnstile token in the field cf-turnstile-response or the X-Turnstile-Token header (limits per address, by default 10 a minute and 100 a day). A request with neither gets 401 auth_missing_api_key.
The verdict is made_with_depicta, inconclusive or no_depicta_ai_marks, with one line per technique. no_depicta_ai_marks does not prove an image was not made with AI: marks can be removed, and other services use other marks. The answer never names an account, prompt, model or time of day; created_on is a UTC date.
Nothing uploaded is kept: the file is checked in memory and dropped, and the check is not recorded in the request audit log.
Errors: 401 auth_missing_api_key or auth_invalid_api_key; 403 auth_account_suspended (a suspended account’s key); 422 validation_error (no file, an unsupported format, too large, too many pixels, a failed captcha); 422 input_image_unreachable (URL mode); 429 rate_limit_exceeded with Retry-After; 503 service_unavailable with Retry-After when the checker is busy.
Authorizations
Section titled “ Authorizations ”- None
- ApiKeyAuth
Request Body
Section titled “ Request Body ”object
Cloudflare Turnstile token from https://depicta.ai/verify, for a request without an API key (or send it in the X-Turnstile-Token header).
A public http or https URL of the image (ports 80 and 443; at most 3 redirects, 10 s and 50 MB). Depicta fetches it, checks it in memory and keeps nothing.
object
Cloudflare Turnstile token from https://depicta.ai/verify, for a request without an API key (or send it in the X-Turnstile-Token header).
The file to check: PNG, JPEG, WebP, GIF (first frame) or SVG; at most 50 MB (SVG 5 MB), 40 megapixels and 16,384 pixels per side. HEIC and AVIF: convert to JPEG or PNG first. Checked in memory and never kept.
Responses
Section titled “ Responses ”OK
object
True when the verdict is made_with_depicta.
Generated (made from a prompt) or edited (AI-modified from input images); null when unknown or not made with Depicta.
When the check ran (RFC 3339, UTC).
The UTC date (YYYY-MM-DD) the image was made, from our registry; null when unknown. Never a time of day.
The checking tool and its rules version.
True when valid Content Credentials from another issuer are present; check them with Content Credentials Verify. Depicta does not vouch for them.
A compact JWS (ES256) of this result signed by Depicta: iss, iat, the sha256 of the checked file, verdict, techniques and detector. Check it with the keys at GET /v1/verify/keys. Depicta keeps no copy.
The verdict in plain words, with what it does and does not mean.
One entry per technique, always all three.
object
Watermark only, when one of our watermarks was read: the TrustMark variant.
Content_credentials only, when valid: who signed them.
Watermark only, when no invisible watermark was found and that is expected for this file: a per-format line (one text for GIF, one for SVG, one for every other format, such as very plain, very small or mostly transparent images) saying why. The Content Credentials identify the image. Never a sign of removal or tampering.
Content_credentials: valid (signed by Depicta and says AI), valid_not_ai (signed by Depicta, no AI claim), valid_other_issuer, invalid (damaged or not genuine) or absent. watermark: match, mismatch (a Depicta watermark that does not fit this picture) or absent. fingerprint: match or no_match.
The marking technique: Content Credentials (C2PA), the invisible watermark, or the exact file fingerprint.
Content_credentials only, when Depicta signed them: whether the signing time is backed by a trusted timestamp; otherwise it is the time the signer claimed.
Made_with_depicta: at least one technique confirms the image was made with Depicta’s AI. inconclusive: a Depicta mark is present but cannot be confirmed (a watermark that does not fit the picture, or Content Credentials naming Depicta that are damaged or not genuine). no_depicta_ai_marks: none found, which does not prove the image was not made with AI.
Unauthorized
object
Forbidden
object
Unprocessable Entity
object
Too Many Requests
object
Internal Server Error
object
Service Unavailable