AI Safety & Agents Tier 3 Ready POST /v1/content-provenance

C2PA & AI Content Provenance Inspector API — Detect AI Metadata & Watermarks

Detect C2PA manifests, AI generator EXIF/XMP tags, and stripped metadata in files or headers. Inspect media headers, C2PA / JUMBF manifests, EXIF/XMP metadata, and AI generator signatures (Midjourney, DALL-E, Firefly, Stable Diffusion).

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/content-provenance`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "verdict": "likely_synthetic_metadata",
    "confidence": 0.9,
    "detected_mime": null,
    "c2pa": {
      "jumbf_detected": false,
      "manifest_boxes": [],
      "claim_generator_hint": null
    },
    "iptc_digital_source_type": "trainedAlgorithmicMedia",
    "detected_generators": [
      "Midjourney"
    ],
    "signals": [
      {
        "category": "iptc_source_type",
        "name": "IPTC DigitalSourceType",
        "evidence": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
        "confidence": "high"
      },
      {
        "category": "ai_generator_signature",
        "name": "Midjourney",
        "evidence": "Midjourney",
        "confidence": "high"
      }
    ],
    "caveats": [
      "Unsigned EXIF, XMP, and PNG tEXt/iTXt metadata tags can be stripped by social platforms or modified by end users."
    ]
  },
  "meta": {
    "request_id": "req_cp_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/content-provenance" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"metadata_text":"Software: Midjourney 6.1\nDigitalSourceType: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/content-provenance", {
  "metadata_text": "Software: Midjourney 6.1\nDigitalSourceType: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/content-provenance",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "metadata_text": "Software: Midjourney 6.1\nDigitalSourceType: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/content-provenance", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "metadata_text": "Software: Midjourney 6.1\nDigitalSourceType: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_content_provenance",
    "arguments": {
      "metadata_text": "Software: Midjourney 6.1\nDigitalSourceType: http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/content-provenance`)

Parameter	Type & Constraints	Description
`content_base64`optional	`string` maxLen: 180000	Base64-encoded file header or full file bytes (up to ~128 KB) of JPEG, PNG, WebP, PDF, or MP4.
`metadata_text`optional	`string` maxLen: 131072	Optional raw EXIF, XMP, PNG tEXt/iTXt, or JSON metadata dump to inspect alongside or instead of binary bytes.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`verdict`	`"c2pa_synthetic_disclosed" \| "c2pa_manifest_present" \| "likely_synthetic_metadata" \| "no_provenance_signals"`	Field 'verdict'
`confidence`	`number`	Field 'confidence'
`detected_mime`	`string \| null`	Field 'detected_mime'
`c2pa`	`object`	Field 'c2pa'
`iptc_digital_source_type`	`string \| null`	Field 'iptc_digital_source_type'
`detected_generators`	`string[]`	Field 'detected_generators'
`signals`	`object[]`	Field 'signals'
`caveats`	`string[]`	Field 'caveats'

3. What Synthetic Content Provenance Checker API Detects & Validates

C2PA / JUMBF box markers (c2pa, jumd, c2ma, c2cl) in binary/base64 headers
IPTC DigitalSourceType URIs (trainedAlgorithmicMedia, compositeSynthetic)
EXIF, XMP, and PNG tEXt/iTXt parameters from Midjourney, DALL-E, Adobe Firefly, ComfyUI, and Automatic1111
Flags social-media metadata stripping caveats when containers lack both camera EXIF and C2PA manifests

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Inspects container markers and metadata headers; does not perform pixel-level deepfake CNN classification or cryptographic C2PA certificate chain revocation lookups.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

What happens if an AI image was screenshotted or stripped by social media?

When metadata is stripped, the API returns an unknown/inconclusive verdict with a metadata_stripped caveat rather than guessing.

Does it recognize Stable Diffusion PNG parameters?

Yes, it detects Automatic1111/ComfyUI generation parameters, CFG scale, sampler, and checkpoint tags.

What is the maximum payload size?

Up to 64 KB on BASIC, 128 KB on PRO, and 256 KB on ULTRA/MEGA (you only need to pass the first 64 KB header slice of a media file).

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

File headers and metadata are inspected in memory and discarded immediately after the response.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.