C2PA Content Credentials

Example

{
  "has_c2pa": true,
  "bytes_size": 184320,
  "media_type": "image/jpeg",
  "source_url": "https://example.com/photo.jpg",
  "manifest_count": 1,
  "active_manifest": {
    "label": "urn:uuid:1234...",
    "title": "photo.jpg",
    "format": "image/jpeg",
    "signer": {
      "time": "2024-06-15T10:30:00Z",
      "issuer": "C=US, O=Adobe Inc., CN=Adobe Photoshop CS Test Cert"
    },
    "vendor": "Adobe",
    "assertions": [
      {
        "kind": "Json",
        "label": "c2pa.actions"
      },
      {
        "kind": "Json",
        "label": "c2pa.hash.data"
      }
    ],
    "ai_generated": false,
    "claim_generator": "Adobe Photoshop 25.0",
    "signature_valid": true,
    "assertions_count": 4,
    "ingredients_count": 0
  },
  "validation_status": []
}

Inputs

Output fields

How reliably each field appears in a successful answer.

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "c2pa-inspect",
    "inputs": {
      "url": "https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/CA.jpg"
    },
    "max_price_cents": 10
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "c2pa-inspect",
    "inputs": {
      "url": "https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/CA.jpg"
    },
    "max_price_cents": 10
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "c2pa-inspect",
  inputs: {
    "url": "https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/CA.jpg"
  },
  max_price_cents: 10,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="c2pa-inspect",
    inputs={
        "url": "https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/CA.jpg",
    },
    max_price_cents=10,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/c2pa-inspect \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/CA.jpg"
  }'

Limitations

• Images only; video and audio are not supported

  Supports JPEG, PNG, WebP, AVIF, HEIF, TIFF, DNG and GIF images. Video and audio formats, including MP4, M4A, MP3 and WAV, are not supported.

  What to do instead: Convert the relevant frame to a still image before inspection.

• 15 MB per-fetch size cap

  Fetched media is limited to 15 MB. Supply a smaller derivative or downsampled image for larger originals.

  What to do instead: Provide a publicly accessible URL for a downsampled image.

• Public HTTP or HTTPS URL required

  Accepts only publicly accessible HTTP or HTTPS URLs. Direct uploads and base64-encoded media are not supported.

  What to do instead: Host the media on a publicly accessible URL (e.g. S3 public object, CDN) before calling.

• Unlisted signers can report as untrusted

  `signature_valid` checks cryptographic verification against the tool’s bundled trust list; a valid signature from an unlisted signer can still report untrusted in `validation_status`. Assess `signer.issuer` together with `signature_valid`.

  What to do instead: Inspect validation_status for codes ending in ".untrusted" and decide whether to trust the signer organisation separately.

• AI-generation flag is heuristic, not authoritative

  ai_generated returns true if any manifest assertion label matches a known generative-AI marker (c2pa.training-mining, com.adobe.generative-ai, etc.). C2PA does not yet have a single canonical "this content is AI" assertion, so absence of the flag does not prove the content is human-made.

  What to do instead: For high-stakes decisions, also inspect the assertions array for vendor-specific generative-AI labels not in the built-in list.