{"openapi":"3.1.0","info":{"title":"Verified capture — tenant API","version":"1.3.2","summary":"Verification as a service, and a sandbox that serves the public conformance corpus.","description":"Generated from the endpoints this service really serves and from\nthe contract that declares which fields they accept. It is not\nwritten by hand and cannot describe an endpoint that does not\nexist: it is regenerated on every build, and any difference fails\nit.\n\nAuthentication is `Authorization: Bearer <api key>`. A key names one\nof the tenant's three fixed environments (`dev`, `sandbox`,\n`production`) and the environment names the tenant and its limits, so\nthe environment is chosen by choosing the key and there is no second\nchannel that could disagree with it.\n\n**Verification never requires this API.** A sealed file verifies\noffline — in the browser page, with the command-line verifier, or\nwith any implementation of the public specification. What this\nservice adds is the two answers a file cannot carry: whether a key\nhas since been revoked, and what the chain recorded for an anchor.\nBoth can only make a verdict stronger. If any part of your pipeline\n*needs* us to reach a verdict at all, that is a design error on our\nside, not a feature.\n\nBase URL: whichever host issued your key. This document declares no\nserver of its own, because the host you were given is the one that\nanswers your key and naming a second one here could only be wrong.\n"},"security":[{"apiKey":[]}],"tags":[{"name":"Keys"},{"name":"Verification"},{"name":"Sandbox"}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","description":"An environment's API key, `vcap_<environment>_<8>_<40>`. The part up to the last underscore is the key's public prefix and is what appears in logs and in the console; the rest is the secret and is shown once."}},"schemas":{"Error":{"type":"object","description":"Every refusal has this shape. `code` is what a client branches on; `message` is for a human reading a log. A boundary refusal adds `pointer`, a JSON pointer to the offending field — never its value.","required":["code","message"],"properties":{"code":{"type":"string","enum":["VCAP_DATA_UNREACHABLE","VCAP_IDEMPOTENCY_IN_PROGRESS","VCAP_IDEMPOTENCY_KEY_INVALID","VCAP_IDEMPOTENCY_KEY_REUSED","VCAP_LIMIT_REACHED","VCAP_NOT_FOUND","VCAP_RATE_LIMITED","VCAP_SANDBOX_CORPUS_UNAVAILABLE","VCAP_SANDBOX_ONLY","VCAP_UNAUTHENTICATED","VCAP_UNDECLARED_FIELD"]},"message":{"type":"string"},"pointer":{"type":"string"}}}},"x-vcap-errors":{"VCAP_UNAUTHENTICATED":"The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","VCAP_RATE_LIMITED":"Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","VCAP_LIMIT_REACHED":"A limit of your organization's agreement is reached: `limit` names which, `resets_at` when a monthly one rolls over. A limit of 0 is the endpoint switched off for your organization. Retrying before `resets_at` gets the same answer.","VCAP_IDEMPOTENCY_KEY_REUSED":"That idempotency key was used with a different body. Refused, never served.","VCAP_IDEMPOTENCY_IN_PROGRESS":"The first request with that key is still running.","VCAP_IDEMPOTENCY_KEY_INVALID":"The `Idempotency-Key` header is longer than 255 characters. An error this API could answer and this document did not name misleads in the same direction as one it names and cannot.","VCAP_NOT_FOUND":"No such job, or not this environment's.","VCAP_SANDBOX_ONLY":"This endpoint answers keys of the `sandbox` environment only.","VCAP_SANDBOX_CORPUS_UNAVAILABLE":"This deployment has no conformance corpus on disk. The endpoint refuses rather than serve something it made up.","VCAP_DATA_UNREACHABLE":"The verification plane did not answer. Nothing was counted. Retry.","VCAP_UNDECLARED_FIELD":"The request carries a field the plane boundary does not declare. The answer names a JSON pointer and the rule, never the value."}},"paths":{"/api/v1/me":{"get":{"operationId":"whoAmI","tags":["Keys"],"summary":"What the presented key is","description":"The smallest endpoint there is: it answers with the organization, the\nenvironment and the key's public prefix. Call it once from a new\ndeployment to be sure the key you shipped is the key you meant —\nabove all, that a key you believe is a test key really names the\n`sandbox` environment.\n\nIt does no metered work, so it counts against no limit of your\norganization's; the per-key and per-address rate limits still apply.\n","responses":{"200":{"description":"The key's organization, environment (`dev`, `sandbox` or `production`) and public prefix.\n\nThe verdict is the public specification's, verbatim (§7 outcome, §8 labels, `not_evaluated`). Its schema lives in vcap-spec (`schema/`), not here: a second copy would be a second thing to keep in step."},"401":{"description":"`VCAP_UNAUTHENTICATED` — The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"`VCAP_RATE_LIMITED` — Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-vcap-examples":[{"name":"Check a key before shipping it","method":"GET","path":"/api/v1/me","expect_status":200,"expect_keys":["organization","environment","key"]}]}},"/api/v1/verify":{"post":{"operationId":"verify","tags":["Verification"],"summary":"Verify a sealed file","description":"Send the media, and the sidecar when the proof lives beside the file\nrather than in it. Both base64. A proof carried in C2PA Content\nCredentials is read from the file itself; a manifest store kept\nbeside the file (`.c2pa`) goes in `c2pa_store_b64`, and is read\nonly when the file embeds none.\n\nThe answer is the verdict of the same isomorphic core the web page\nand the command-line verifier run, plus the `trust` set it was\nreached under. **This endpoint is a convenience, never a\ndependency**: the same file verifies with no server at all. What a\nserver adds can only make a verdict stronger — it can ask the\ntransparency log whether a key was revoked, and it can compare an\nanchored root with what the chain recorded — and both of those are\nquestions a file cannot carry an answer to.\n\nRead the verdict in the specification's own words: `outcome`,\n`labels` and `not_evaluated`. A missing piece of evidence is a\nweaker verdict, not an error. `proof_source` says where the proof\nwas read — the file's trailer, the sidecar, or its Content\nCredentials — and is never a label: where a proof sits is not\nevidence.\n","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"Any string of yours, on a request you may retry. The same key with the same body replays the stored response for 24 hours; with a different body it is refused (422 VCAP_IDEMPOTENCY_KEY_REUSED). Only a success is remembered."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["media_b64"],"properties":{"media_b64":{"description":"base64 (standard alphabet, padded). A blob, not text: the pattern is what a validator can check without modelling the proof format.","type":"string","contentEncoding":"base64","pattern":"^[A-Za-z0-9+/]+={0,2}$","minLength":4,"maxLength":32000000},"sidecar_b64":{"description":"base64 (standard alphabet, padded). A blob, not text: the pattern is what a validator can check without modelling the proof format.","type":"string","contentEncoding":"base64","pattern":"^[A-Za-z0-9+/]+={0,2}$","minLength":4,"maxLength":200000},"c2pa_store_b64":{"description":"base64 (standard alphabet, padded). A C2PA manifest store kept beside the file (.c2pa), read by the core only when the file embeds none, and only for the vcap proof it may carry. A blob, not text, bounded like the media because a store can hold thumbnails, within the same cap on the request as a whole.","type":"string","contentEncoding":"base64","pattern":"^[A-Za-z0-9+/]+={0,2}$","minLength":4,"maxLength":32000000},"recompute_segments":{"type":"boolean"},"watermark":{"description":"The detector, as an optional upgrade (C10). off: not run, and the response carries no watermark block. sync: run inside the request. async: queued, and the response carries an opaque job id. auto: sync for a still, async for a clip, decided from the proof's own media.mime.","type":"string","enum":["off","auto","sync","async"]}},"description":"Exactly the fields this endpoint accepts, as the server itself validates them; anything else is refused. metering_ref is added by this service and is not yours to send."}}}},"responses":{"200":{"description":"`verdict` (the specification's §7 verdict, verbatim), `trust` (the named logs and roots it was reached under), and — when detection ran inside the request — `watermark` evidence with its `watermark_note`. For `async`, `watermark_job` instead.\n\nThe verdict is the public specification's, verbatim (§7 outcome, §8 labels, `not_evaluated`). Its schema lives in vcap-spec (`schema/`), not here: a second copy would be a second thing to keep in step."},"401":{"description":"`VCAP_UNAUTHENTICATED` — The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"`VCAP_LIMIT_REACHED` — A limit of your organization's agreement is reached: `limit` names which, `resets_at` when a monthly one rolls over. A limit of 0 is the endpoint switched off for your organization. Retrying before `resets_at` gets the same answer.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"`VCAP_IDEMPOTENCY_IN_PROGRESS` — The first request with that key is still running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"`VCAP_IDEMPOTENCY_KEY_REUSED` — That idempotency key was used with a different body. Refused, never served.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"`VCAP_RATE_LIMITED` — Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"502":{"description":"`VCAP_DATA_UNREACHABLE` — The verification plane did not answer. Nothing was counted. Retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-vcap-examples":[{"name":"A file with no proof is a verdict, not an error","method":"POST","path":"/api/v1/verify","body":{"media_b64":"BASE64_OF_A_FILE_WITH_NO_PROOF"},"needs_data_plane":true,"expect_status":200,"expect_keys":["verdict","trust"],"expect_verdict_outcome":"no_proof_found"}]}},"/api/v1/verify/watermark/{job_id}":{"get":{"operationId":"verificationJob","tags":["Verification"],"summary":"Poll an asynchronous verification","description":"`watermark: \"async\"` — and `\"auto\"` on a clip — queues the detector\nand hands back an opaque job id. Poll this, or subscribe to the\n`verification.completed` webhook and be told.\n\nOnce `state` is `done` the answer carries both the raw detector\nevidence and a verdict recomputed with that evidence folded in, so a\ncontradiction between the pixels and the signed core arrives as\n`verdict.outcome === \"tampered\"` rather than as a footnote beside a\npositive verdict.\n\nThe job expires within the hour. A job id that belongs to another\nenvironment and one that never existed answer the same 404: an\nanswer that told them apart would say whether a capture had been\nverified here.\n","parameters":[{"name":"job_id","in":"path","required":true,"schema":{"type":"string","pattern":"^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"},"description":"Opaque job id, a UUID v4. It carries nothing: not the capture, not the tenant, not the caller."}],"responses":{"200":{"description":"`state` (`queued`, `running`, `done`, `failed`), and once done `watermark`, `watermark_note` and the recomputed `verdict` with its `trust`.\n\nThe verdict is the public specification's, verbatim (§7 outcome, §8 labels, `not_evaluated`). Its schema lives in vcap-spec (`schema/`), not here: a second copy would be a second thing to keep in step."},"401":{"description":"`VCAP_UNAUTHENTICATED` — The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"`VCAP_NOT_FOUND` — No such job, or not this environment's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"`VCAP_RATE_LIMITED` — Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"502":{"description":"`VCAP_DATA_UNREACHABLE` — The verification plane did not answer. Nothing was counted. Retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-vcap-examples":[{"name":"An unknown job id is a 404, not a hint","method":"GET","path":"/api/v1/verify/watermark/00000000-0000-4000-8000-000000000000","expect_status":404,"expect_keys":["code"]}]}},"/api/v1/sandbox/vectors":{"get":{"operationId":"sandboxVectors","tags":["Sandbox"],"summary":"List the conformance vectors this sandbox serves","description":"The sandbox is not a pretend world. It serves the **conformance\ncorpus of the public specification** — real sealed files, whose\nexpected verdict is known because the specification says what it is,\nreviewed and written down before the file was generated.\n\nThe answer names the corpus: its version, the SHA-256 of the\nmanifest as committed, how many vectors the manifest declares, and\nhow many of them this API serves. Every vector carries the outcome\nthe specification expects.\n\nOnly a key of the **`sandbox` environment** may call this. A `dev`\nor `production` key is refused with 403 `VCAP_SANDBOX_ONLY` — the\nenvironment boundary that already separates your keys is the one\nthat separates test traffic from real data, and there is no second\none.\n","responses":{"200":{"description":"`corpus` (version, manifest digest, declared and served counts, where the corpus comes from) and `vectors`, each with its name, kind and expected outcome.\n\nThe verdict is the public specification's, verbatim (§7 outcome, §8 labels, `not_evaluated`). Its schema lives in vcap-spec (`schema/`), not here: a second copy would be a second thing to keep in step."},"401":{"description":"`VCAP_UNAUTHENTICATED` — The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"`VCAP_SANDBOX_ONLY` — This endpoint answers keys of the `sandbox` environment only.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"`VCAP_RATE_LIMITED` — Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"`VCAP_SANDBOX_CORPUS_UNAVAILABLE` — This deployment has no conformance corpus on disk. The endpoint refuses rather than serve something it made up.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-vcap-examples":[{"name":"What the sandbox holds","method":"GET","path":"/api/v1/sandbox/vectors","expect_status":200,"expect_keys":["corpus","vectors"]}]}},"/api/v1/sandbox/vectors/{name}":{"get":{"operationId":"sandboxVector","tags":["Sandbox"],"summary":"Fetch one vector and the verdict the specification expects","description":"The file, base64, in exactly the shape `POST /api/v1/verify` takes —\n`media_b64` and, where the vector has one, `sidecar_b64` or\n`c2pa_store_b64` — next to\n`expected`, copied from the vector's own `expected.json` in the\nspecification repository.\n\n`expected` is **not our answer and not a promise about ours**: it is\nwhat the specification says any conformant verifier must produce for\nthese bytes. Feed the same bytes to the offline page, to the\ncommand-line verifier, or to your own implementation, and compare\nagainst the same file. That is the whole point of shipping the\ncorpus instead of a mock.\n\n`verify` is the request the vector has to be sent with. For a\n`container` vector it carries `recompute_segments: true`, because\nthat is what the kind means in the corpus — the expectation is the\none reached with every present segment's content hash recomputed\nfrom the received container. Send a container vector without it and\nyou get `segment content not recomputed`, and a replaced frame\nreads `frames_not_compared` instead of `tampered`, as does a\ngenuine clip: a proof's own segment hashes prove that somebody\nsigned some hashes, not that those are the frames you received.\n\nServed vectors are the subset whose expected verdict depends on the\nfile alone. The corpus also holds vectors that pin an injected\ninput — a verifier clock, an online revocation answer, a chain read\n— and those cannot be reproduced by sending bytes to a live service,\nbecause the service has its own clock and its own trust set. They\nare declared in the listing rather than quietly dropped, and the\nplace to run them is the corpus runner in the specification.\n","parameters":[{"name":"name","in":"path","required":true,"schema":{"type":"string","pattern":"^[0-9]{2}-[a-z0-9-]{1,80}$"},"description":"The vector's directory name in the corpus, e.g. `01-jpeg-sealed`."}],"responses":{"200":{"description":"`name`, `kind`, `media_b64`, optional `sidecar_b64` and `c2pa_store_b64`, `expected` (the specification's expected verdict), `verify` (the request to send it with) and `corpus` (version and manifest digest).\n\nThe verdict is the public specification's, verbatim (§7 outcome, §8 labels, `not_evaluated`). Its schema lives in vcap-spec (`schema/`), not here: a second copy would be a second thing to keep in step."},"401":{"description":"`VCAP_UNAUTHENTICATED` — The key is unknown, malformed or revoked. All three answer the same, so a probe learns nothing about which prefixes exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"`VCAP_SANDBOX_ONLY` — This endpoint answers keys of the `sandbox` environment only.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"`VCAP_NOT_FOUND` — No such job, or not this environment's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"`VCAP_RATE_LIMITED` — Too many requests, too fast. Retry in a second — this is not a limit of your organization's.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"`VCAP_SANDBOX_CORPUS_UNAVAILABLE` — This deployment has no conformance corpus on disk. The endpoint refuses rather than serve something it made up.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-vcap-examples":[{"name":"A sealed photo, with the verdict the specification expects","method":"GET","path":"/api/v1/sandbox/vectors/01-jpeg-sealed","expect_status":200,"expect_keys":["name","kind","media_b64","expected","corpus"]}]}}},"x-vcap-changelog":[{"version":"1.3.2","date":"2026-09-27","digest":"7cecb9cbcabd213c16cce677c654b9d9ba0596003855c023f6fa2dc60d30e132","changes":["No field changed. The verdict now follows corpus 3.0.0 of the public specification: green requires proven device integrity, a registry-signed Google Play Integrity verdict of hardware. Without one — no verdict, basic, failed, or any Apple App Attest verdict — the ceiling is amber and the labels carry integrity not proven. A capture that read green without such a verdict now reads amber, and every iOS capture is amber at best."]},{"version":"1.3.1","date":"2026-09-25","digest":"7cecb9cbcabd213c16cce677c654b9d9ba0596003855c023f6fa2dc60d30e132","changes":["GET /api/v1/sandbox/vectors/{name} returns c2pa_store_b64 where the vector keeps a C2PA store beside the file (vector 132), and the listing says has_c2pa_store. Send it as c2pa_store_b64 to POST /api/v1/verify."]},{"version":"1.3.0","date":"2026-09-25","digest":"971b228bd0627a9ccf060e39c3224d5fe8508313dc80255957e212a9c6c88ff9","changes":["POST /api/v1/verify takes an optional c2pa_store_b64: a C2PA manifest store kept beside the file (.c2pa), read only when the file embeds none. A proof carried in Content Credentials embedded in the file is read without it.","The verdict says where the proof was read, in proof_source (trailer, sidecar, or c2pa with the manifest and how far up the parentOf chain), and what a C2PA store held in content_credentials. Neither is a label. A proof read from the capture a file was made from makes the file no_proof_found, never tampered; a trailer whose proof differs from the active manifest's copy carries the label manifest copy differs."]},{"version":"1.2.1","date":"2026-09-24","digest":"5ca3917a637786d69ae0aeee0753f824a31010237c78ee0e7be3be971723ff8d","changes":["No field changed. The verdict now follows corpus 2.0.0 of the public specification, which adds the outcome frames_not_compared: a video whose signatures hold and whose frames were not tied to them. A container sent without recompute_segments reads it where it used to read verified_clip, so a replaced frame no longer reads as a clip.","The sandbox serves vectors numbered past 99, and does not serve the corpus's empty-file vector: a request carries at least one byte."]},{"version":"1.2.0","date":"2026-09-24","digest":"59f2e2df336d2410e975a25f8d3775256bcd59605eaabac0098f6eb69b4d7f23","changes":["POST /api/v1/verify no longer answers 402 VCAP_QUOTA_EXCEEDED: there are no plans or quotas any more. A monthly limit agreed for your organization answers 403 VCAP_LIMIT_REACHED, as described since 1.1.0.","The webhook events quota.threshold_reached and quota.exceeded are withdrawn with the quotas they reported on."]},{"version":"1.1.0","date":"2026-09-24","digest":"24261d03dd221a22f74127edd42f1e7994ca8e687c345c460eaccc377aabc292","changes":["POST /api/v1/verify may answer 403 VCAP_LIMIT_REACHED: a monthly limit agreed for your organization is reached, or the endpoint is switched off for it. The body names the limit and when it rolls over."]},{"version":"1.0.1","date":"2026-09-22","digest":"23701ac77a2c40a36f6cca14792b30e87ea648a45e2750151c6cdb33b0666f22","changes":["No wire change: every endpoint, field and answer is what 1.0.0 described.","Wording only. This document is public, so it no longer describes how the service is built — which component mints a job id, which file a field list is read from, how many environments are deployed. What it promises is unchanged: the description is generated from what the server serves and a disagreement fails the build."]},{"version":"1.0.0","date":"2026-09-12","digest":"1126e79a68a6cebdd72b485340c559e69f92a9fc8ff0942961f106a39dd3a5e6","changes":["First published description of the tenant API: GET /api/v1/me, POST /api/v1/verify, GET /api/v1/verify/watermark/{job_id}.","Sandbox added: GET /api/v1/sandbox/vectors and GET /api/v1/sandbox/vectors/{name} serve the vcap-spec conformance corpus to keys of the sandbox environment."]}],"x-vcap-not-implemented":[{"subject":"SAML single sign-on","statement":"Not implemented. Tenant SSO is OpenID Connect only, with a public client and PKCE; an identity provider that requires a confidential client is declared unsupported rather than half-supported.","why":"SAML would mean either a dependency with a long history of authentication-bypass advisories or our own XML-signature code, and with no identity provider to exercise it against it would be believed rather than verified (D26)."},{"subject":"Connectors to claims or ERP systems","statement":"Not implemented, and not planned here. A tenant's data leaves as typed NDJSON over GET /organizations/{id}/export in the console.","why":"We hold no account on any such system, so a connector could not be exercised. The open format is the part we can verify (D41)."},{"subject":"A key management service or hardware key store","statement":"Not present. A webhook secret and the evidence report signing key are ordinary secrets this service holds itself; nothing they sign is protected by hardware or by a certificate.","why":"There is no KMS here (D16). The consequence for you is stated rather than dressed up: a webhook signature authenticates a delivery only as far as a shared secret can, and a report signature says the document came from this installation unaltered — it is not an eIDAS signature of any kind."},{"subject":"Qualified electronic timestamps","statement":"Not available. A proof may carry an RFC 3161 token, and this API validates it against configured roots, but no qualified trust service provider is behind it and no eIDAS claim is made.","why":"There is no legal entity to hold a qualified certificate yet (D2, R4). Changing this costs two URLs and two roots, not a format change."},{"subject":"A signed or transportable watermark result","statement":"Not available. Watermark evidence is this platform's own detector reading. Nothing signs it and it cannot be handed to a third party as proof.","why":"Nothing in the format binds a detection to the signed core (D18). The response says so in `watermark_note` every time it carries one."},{"subject":"No index of anybody's media, and so no lookup from a file or a core hash","statement":"Refused by design, not missing by omission. No endpoint of this API answers \"has this file been verified here\", no endpoint resolves a core hash to anything, and verdicts are not stored beyond an idempotency window of 24 hours. What does exist is one public page, GET /t/{capture_id}, which answers the capture id a watermark carries with the proof of that capture and nothing about the organization behind it — and only as far as that organization chose to publish (D76). It is reached with an id, never with a file, and it is not part of this API.","why":"An index keyed on the *media* — a core hash, a file digest — would be a media-to-origin correlation surface, and the platform refuses to build one (D21, D32, D38): that is why nothing here takes a file and answers a question about it. A capture id is different in kind: it is in the pixels the asker already holds, so answering it discloses nothing they could not read themselves, and refusing would only mean a forwarded copy has no proof anywhere."}]}