Lookup and recovery

llms.txt Ask agent

# Lookup and recovery

Source: https://docs.originalpictures.com/api/lookup/
Full index for AI agents: https://docs.originalpictures.com/llms.txt

The API has no standalone lookup endpoint. Soft-binding lookup happens inside
[verification](/api/verify/), as a bounded recovery step.

## When recovery runs

Verification first validates the submitted object's C2PA manifest directly. If that does not
establish validity (for example, because the manifest was stripped), verification may consult the
soft bindings your recipes recorded:

- the imperceptible watermark, when the recipe applied one (`watermark` capability);
- the perceptual fingerprints (`fingerprint` capability).

For an image, recovery tries each signal in a fixed order and stops at the first that decides:
the exact SHA-256, the watermark, ISCC Image-Code, then the fingerprints a job may have selected
(PDQ, then the keyed DINOv2 hash, then the DINOv2 descriptor). SSCD is not searched: it was
stopped entirely on 2026-09-28, and jobs admitted before it was retired are found by the exact
hash, the watermark or ISCC. Each signal matches only bindings made under its own pinned version and
threshold, and only your own tenant's. The keyed DINOv2 hash is computed under a key derived for
your tenant, so it never compares across tenants. See [Fingerprints](/api/fingerprints/).

## Outcomes

- **One unique candidate:** when no manifest could be read, the result is recovery-only
  (`VALIDATION_RECOVERY_ONLY`). This is not cryptographic validity. Show it as recovered provenance
  and keep the recovery evidence. When a manifest was read, its finding is the status and the
  match is supplementary evidence in `result.recovery`.
- **Several plausible candidates:** recovery fails closed with `BINDING_LOOKUP_AMBIGUOUS` rather
  than guessing.
- **Undecidable or unavailable:** codes such as `BINDING_LOOKUP_INDETERMINATE` or
  `BINDING_LOOKUP_FORBIDDEN` explain why.

The full list is in [Reason codes](/api/reference/reason-codes/).

## Bindings you can inspect

A signing receipt ([`GET /v1/receipts/{receipt_id}`](/api/reference/assets/#getSigningReceipt))
records the bindings a job produced and whether publication validation took the direct or the
recovery path.

The API has no standalone lookup endpoint. Soft-binding lookup happens inside verification, as a bounded recovery step.

When recovery runs

Verification first validates the submitted object’s C2PA manifest directly. If that does not establish validity (for example, because the manifest was stripped), verification may consult the soft bindings your recipes recorded:

the imperceptible watermark, when the recipe applied one (watermark capability);
the perceptual fingerprints (fingerprint capability).

For an image, recovery tries each signal in a fixed order and stops at the first that decides: the exact SHA-256, the watermark, ISCC Image-Code, then the fingerprints a job may have selected (PDQ, then the keyed DINOv2 hash, then the DINOv2 descriptor). SSCD is not searched: it was stopped entirely on 2026-09-28, and jobs admitted before it was retired are found by the exact hash, the watermark or ISCC. Each signal matches only bindings made under its own pinned version and threshold, and only your own tenant’s. The keyed DINOv2 hash is computed under a key derived for your tenant, so it never compares across tenants. See Fingerprints.

Outcomes

One unique candidate: when no manifest could be read, the result is recovery-only (VALIDATION_RECOVERY_ONLY). This is not cryptographic validity. Show it as recovered provenance and keep the recovery evidence. When a manifest was read, its finding is the status and the match is supplementary evidence in result.recovery.
Several plausible candidates: recovery fails closed with BINDING_LOOKUP_AMBIGUOUS rather than guessing.
Undecidable or unavailable: codes such as BINDING_LOOKUP_INDETERMINATE or BINDING_LOOKUP_FORBIDDEN explain why.

The full list is in Reason codes.

Bindings you can inspect

A signing receipt (GET /v1/receipts/{receipt_id}) records the bindings a job produced and whether publication validation took the direct or the recovery path.