REST API

Base URL

https://16.61.203.65/rest

Interactive API explorers: Swagger UI (try requests in the browser) and ReDoc. The OpenAPI description is at /rest/openapi.json. A local backend serves the same pages at /docs and /redoc.

Authentication

No authentication is required for local or private deployments. For public-facing instances, configure API key authentication at the reverse proxy level.

Extract metadata

Extract provenance metadata from a JPEG or PNG image. Tries JUMBF JSON first, then falls back to binary manifests.

curl -X POST https://16.61.203.65/rest/extract \
  -F "image=@photo.jpg"

import requests

resp = requests.post(
    "https://16.61.203.65/rest/extract",
    files={"image": open("photo.jpg", "rb")},
)
metadata = resp.json()

const form = new FormData();
form.append("image", fileInput.files[0]);

const resp = await fetch("https://16.61.203.65/rest/extract", {
  method: "POST",
  body: form,
});
const metadata = await resp.json();

{
  "@context": ["https://jpeg.org/jpegtrust/"],
  "declaration": {
    "claim": {
      "alg": "sha256",
      "claim_generator_info": [{ "name": "Joe's Camera App" }],
      "signature_status": "claimSignature.validated",
      "content_status": "assertion.dataHash.match"
    },
    "assertions": {
      "cawg.metadata": {
        "@context": { "dc": "http://purl.org/dc/elements/1.1/" },
        "dc:creator": ["Jane Doe"]
      },
      "c2pa.actions.v2": {
        "actions": [{
          "action": "c2pa.created",
          "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/digitalCapture"
        }]
      }
    }
  },
  "manifests": [...]
}

Embed metadata

Embed provenance metadata into a JPEG or PNG image. Returns the modified image as a binary download.

curl -X POST https://16.61.203.65/rest/embed \
  -F "image=@photo.jpg" \
  -F "metadata=@metadata.json" \
  -F "digital_source_type=digitalCapture" \
  -o embedded.jpg

import requests

resp = requests.post(
    "https://16.61.203.65/rest/embed",
    files={
        "image": open("photo.jpg", "rb"),
        "metadata": open("metadata.json", "rb"),
    },
    data={"digital_source_type": "digitalCapture"},
)
with open("embedded.jpg", "wb") as f:
    f.write(resp.content)

Verify image

Verify an image against a trust profile. Returns a scored verification report.

curl -X POST https://16.61.203.65/rest/verify \
  -F "image=@signed.jpg" \
  -F "profile=@newsroom_profile.yml"

{
  "status": "pass",
  "score": 0.9167,
  "verdict": "trusted",
  "profile": "Newsroom Trust Profile",
  "passed_checks": 10,
  "total_checks": 11,
  "passed": ["signature_chain", "capture_timestamp", ...],
  "failed": ["gps_location"],
  "ai_label": "not AI-labelled",
  "c2pa": {
    "detected": true,
    "validation": "valid",
    "signature_valid": true,
    "content_intact": true
  }
}

Validate record

Run the offline JPEG Trust validator on one image. Returns its full report and the verdict of the selected checks (see the validator docs). GET /validate/config reports whether the server has default trust anchors.

curl -X POST https://16.61.203.65/rest/validate \
  -F "image=@signed.jpg" \
  -F "use-default-anchors=true" \
  -F "require-trust=true" -F "require-conformance=true"

Batch operations

Process multiple images in a single request. All batch endpoints accept multiple files via the images form field.

curl -X POST https://16.61.203.65/rest/batch/extract \
  -F "images=@photo1.jpg" \
  -F "images=@photo2.jpg" \
  -F "images=@photo3.png"

curl -X POST https://16.61.203.65/rest/batch/verify \
  -F "images=@photo1.jpg" \
  -F "images=@photo2.jpg" \
  -F "profile=@newsroom.yml"

{
  "results": [
    { "filename": "photo1.jpg", "status": "pass", "score": 0.92, "verdict": "trusted" },
    { "filename": "photo2.jpg", "status": "fail", "score": 0.33, "verdict": "profile_mismatch" }
  ],
  "summary": { "total": 2, "passed": 1, "warnings": 0, "failed": 1, "errors": 0 }
}

Profiles

Browse available trust profiles and create new ones from templates or custom check lists.

curl -X POST https://16.61.203.65/rest/profiles/create \
  -F "template=newsroom" \
  -F "name=Wire Photo Policy" \
  -o profile.yml

IPTC source types

List all IPTC digital source types. These slugs declare how an image was created and are used with the digital_source_type parameter on embed endpoints.

Showing a subset. Call the endpoint for the full list of 17 source types.

Error handling

All errors return JSON with a detail field.

{ "detail": "No JPEG Trust metadata found." }

Health check

Returns {"status": "ok"} when the API is running. Use this for uptime monitoring.