history
Snapshot-consistent tenant asset, job, receipt, and verification history.
| Method | Path | Operation ID |
|---|---|---|
| GET | /v1/assets |
listAssets |
| GET | /v1/assets/{asset_id}/detail |
getAssetDetail |
| DELETE | /v1/history/snapshots |
releaseHistorySnapshot |
| GET | /v1/jobs |
listJobs |
| GET | /v1/receipts |
listReceipts |
| GET | /v1/verification-history/{verification_id} |
getVerificationHistory |
| GET | /v1/verifications |
listVerifications |
GET /v1/assets
Section titled “GET /v1/assets”Operation ID: listAssets
List a bounded snapshot-consistent page of tenant assets.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
kind |
query | AssetHistoryKind or null | no | |
status |
query | AssetHistoryStatus or null | no | |
media |
query | AssetMediaFamily or null | no | |
from |
query | string or null | no | |
recipe_id |
query | string or null | no | |
verification_outcome |
query | VerificationOverall or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 25. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json AssetHistoryPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of AssetHistoryResponse | yes | |
next_cursor |
string or null | yes | |
total_count |
integer | yes | Minimum 0. |
workspace_governance |
WorkspaceGovernanceResponse | yes | Tenant-wide governance constraining every item on this page. Separate from each item’s own governance because it is a different claim: a row states what is true of that asset, this states what is true of the workspace. A row can hold an available preview while a workspace hold means delivery refuses, and a surface that showed only the row would leave the reader with a false expectation. |
GET /v1/assets/{asset_id}/detail
Section titled “GET /v1/assets/{asset_id}/detail”Operation ID: getAssetDetail
Read one asset’s complete record: identity, media, related records, verification history, activity, governance and action state.
Read one asset’s complete record on a single snapshot. The two continuation cursors are independent because the two collections are: paging deeper into verification history must not disturb where the activity timeline had reached, and vice versa.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
asset_id |
path | string | yes | Pattern: ^ast_[a-z2-7]{16}$. |
verification_cursor |
query | string or null | no | |
activity_cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 25. Default 25. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json AssetDetailResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
actions |
array of AssetActionResponse | yes | |
activity |
AssetActivityResponse | yes | |
as_of |
string | yes | |
asset |
AssetHistoryResponse | yes | |
verification_history |
AssetVerificationHistoryResponse | yes | |
workspace_governance |
WorkspaceGovernanceResponse | yes | Tenant-wide governance constraining every item on this page. Separate from each item’s own governance because it is a different claim: a row states what is true of that asset, this states what is true of the workspace. A row can hold an available preview while a workspace hold means delivery refuses, and a surface that showed only the row would leave the reader with a false expectation. |
DELETE /v1/history/snapshots
Section titled “DELETE /v1/history/snapshots”Operation ID: releaseHistorySnapshot
Release one live opaque history traversal before its bounded expiry.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
cursor |
query | string | yes | Pattern: ^[A-Za-z0-9_-]+$. Max length 256. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 204 | Successful Response | none |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
GET /v1/jobs
Section titled “GET /v1/jobs”Operation ID: listJobs
List a bounded snapshot-consistent page of tenant jobs and progress.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
kind |
query | JobKind or null | no | |
state |
query | JobState or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 25. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json JobHistoryPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of JobHistoryResponse | yes | |
next_cursor |
string or null | yes |
GET /v1/receipts
Section titled “GET /v1/receipts”Operation ID: listReceipts
List a bounded snapshot-consistent page of tenant publication receipts.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
asset_id |
query | string or null | no | |
job_id |
query | string or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 25. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json ReceiptHistoryPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of ReceiptHistoryResponse | yes | |
next_cursor |
string or null | yes |
GET /v1/verification-history/{verification_id}
Section titled “GET /v1/verification-history/{verification_id}”Operation ID: getVerificationHistory
Read one tenant-owned historical verification summary and validation path.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
verification_id |
path | string | yes | Pattern: ^vfy_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json VerificationHistoryResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
created_at |
string | yes | |
job_id |
string or null | yes | |
overall |
VerificationOverall | yes | One of: valid, invalid, indeterminate, recovered. |
policy_version |
string or null | yes | |
source_byte_length |
integer or null | yes | |
source_media_type |
HistoryMediaType or null | yes | |
status_vocabulary_version |
C2PAStatusVocabularyVersion or null | yes | |
subject_type |
VerificationSubjectType | yes | One of: uploaded_object, stored_object, public_url, asset, manifest, receipt. |
validated_at |
string | yes | |
validation_path |
ValidationPath or null | yes | |
verification_id |
string | yes | Pattern: ^vfy_[a-z2-7]{16}$. |
verification_url |
string | yes | Pattern: ^/v1/verification-history/vfy_[a-z2-7]{16}$. |
GET /v1/verifications
Section titled “GET /v1/verifications”Operation ID: listVerifications
List a bounded snapshot-consistent page of tenant verification observations.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
overall |
query | VerificationOverall or null | no | |
subject_type |
query | VerificationSubjectType or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 25. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json VerificationHistoryPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of VerificationHistoryResponse | yes | |
next_cursor |
string or null | yes |