verify-pages

Generated reference

Generated from packages/contracts/openapi/openapi.yaml by apps/docs/scripts/generate-reference.mjs. Do not edit by hand.

Hosted public verify page configuration and the unauthenticated public check (declared origin only, never a real/fake verdict).

Method	Path	Operation ID
GET	/v1/public/verify-pages/{slug}	getPublicVerifyPage
POST	/v1/public/verify-pages/{slug}/checks	createPublicCheck
GET	/v1/public/verify-pages/{slug}/checks/{check_id}	getPublicCheck
GET	/v1/public/verify-pages/{slug}/logo	getPublicVerifyPageLogo
GET	/v1/verify-pages	getVerifyPage
PUT	/v1/verify-pages	putVerifyPage

GET /v1/public/verify-pages/{slug}

Operation ID: getPublicVerifyPage

Read the public rendering configuration of an enabled verify page.

Unauthenticated. The configuration the hosted page and <op-verify> render. Served with Access-Control-Allow-Origin: * and a short public cache lifetime.

Authentication: none (anonymous).

Parameters

Name	In	Type	Required	Description
slug	path	string	yes	Pattern: ^[a-z0-9](?:[a-z0-9-]{1,46})[a-z0-9]$.

Responses

Status	Description	Body
200	Successful Response	application/json PublicVerifyPageResponse
404	VERIFY_PAGE_NOT_FOUND: no enabled page has this slug.	application/json ErrorResponse
422	VERIFY_PAGE_INVALID: the slug or check id is malformed.	application/json ErrorResponse
503	Verification is temporarily unavailable.	application/json ErrorResponse

200 response fields

Field	Type	Required	Description
accepted_media_types	array of string or null	no	The media types a check accepts; any other is refused before it is billed (415 PUBLIC_CHECK_MEDIA_UNSUPPORTED, or 422 MEDIA_FORMAT_UNDETECTED for a format that cannot be read).
check_url	string	yes
colours	VerifyPageColours	yes	Brand colours for the hosted page and the embed card. Omitted ones use defaults.
display_name	string	yes
logo_url	string or null	yes
max_upload_bytes	integer	yes
recover_own_assets	boolean	yes
schema_version	const “op.public-verify-page.v1”	yes
slug	string	yes
statement	string	yes

POST /v1/public/verify-pages/{slug}/checks

Operation ID: createPublicCheck

Check one file’s declared origin against a verify page, IP rate-limited.

Unauthenticated. Check one file against this page: its Content Credentials and, if the page owner opted in, recovery against the owner’s own assets only. 200 with a completed result, or 202 while it runs. Accepts any origin. Limited per client network (an IPv6 /64 counts as one) and per page across all clients.

Authentication: none (anonymous).

Parameters

Name	In	Type	Required	Description
slug	path	string	yes	Pattern: ^[a-z0-9](?:[a-z0-9-]{1,46})[a-z0-9]$.

Request body

multipart/form-data: object (required)

Field	Type	Required	Description
file	string	yes	The file to check, at most 25 MB. It is held only for the check, never stored with the result and never logged.

Responses

Status	Description	Body
200	Successful Response	application/json PublicCheckResponse
202	The check is still running (state running); poll check_id.	application/json PublicCheckResponse
404	VERIFY_PAGE_NOT_FOUND: no enabled page has this slug.	application/json ErrorResponse
413	MEDIA_COMPRESSED_SIZE_LIMIT: the file is larger than 25 MB.	application/json ErrorResponse
415	PUBLIC_CHECK_MEDIA_UNSUPPORTED: a public check does not run this media type (video/mp4 today); the message lists the types it accepts. Nothing is staged or billed.	application/json ErrorResponse
422	VERIFY_PAGE_INVALID: the slug is malformed or the body is not multipart/form-data with one file part; or a MEDIA_* reason: the file’s format cannot be checked (the message lists the accepted types).	application/json ErrorResponse
429	PUBLIC_CHECK_RATE_LIMITED: too many checks from this network for this page, or for this page from all networks together. PUBLIC_CHECK_MONTHLY_LIMIT_REACHED: the page has answered its monthly allowance (the owner’s monthly_check_limit or the platform default) and resumes next UTC month. Retryable after Retry-After seconds.	application/json ErrorResponse
503	Verification is temporarily unavailable.	application/json ErrorResponse

200 response fields

Field	Type	Required	Description
check_id	string	yes	Pattern: ^pchk_[a-z2-7]{16}$.
completed_at	string or null	yes
content_credentials	PublicContentCredentials or null	yes	Present when state is completed.
created_at	string	yes
failure_reason	ReasonCode or null	yes	Present when state is failed.
made_with	MadeWith or null	yes	Present when state is completed.
media_type	string or null	yes	The detected media type of the checked file.
page	PublicCheckPage	yes
schema_version	const “op.public-check.v1”	yes
state	enum	yes	running: poll GET …/checks/{check_id} (at most every 2 seconds, for at most 15 minutes); completed and failed are terminal. One of: running, completed, failed.
statement	string	yes	Show this sentence with every result.

GET /v1/public/verify-pages/{slug}/checks/{check_id}

Operation ID: getPublicCheck

Poll one unexpired public check of a verify page.

Unauthenticated. Poll a running public check.

Authentication: none (anonymous).

Parameters

Name	In	Type	Required	Description
slug	path	string	yes	Pattern: ^[a-z0-9](?:[a-z0-9-]{1,46})[a-z0-9]$.
check_id	path	string	yes	Pattern: ^pchk_[a-z2-7]{16}$.

Responses

Status	Description	Body
200	Successful Response	application/json PublicCheckResponse
404	VERIFY_PAGE_NOT_FOUND, or PUBLIC_CHECK_NOT_FOUND: the check does not belong to this page or has expired (15 minutes).	application/json ErrorResponse
422	VERIFY_PAGE_INVALID: the slug or check id is malformed.	application/json ErrorResponse
503	Verification is temporarily unavailable.	application/json ErrorResponse

200 response fields

Field	Type	Required	Description
check_id	string	yes	Pattern: ^pchk_[a-z2-7]{16}$.
completed_at	string or null	yes
content_credentials	PublicContentCredentials or null	yes	Present when state is completed.
created_at	string	yes
failure_reason	ReasonCode or null	yes	Present when state is failed.
made_with	MadeWith or null	yes	Present when state is completed.
media_type	string or null	yes	The detected media type of the checked file.
page	PublicCheckPage	yes
schema_version	const “op.public-check.v1”	yes
state	enum	yes	running: poll GET …/checks/{check_id} (at most every 2 seconds, for at most 15 minutes); completed and failed are terminal. One of: running, completed, failed.
statement	string	yes	Show this sentence with every result.

GET /v1/public/verify-pages/{slug}/logo

Operation ID: getPublicVerifyPageLogo

Read the logo image of an enabled verify page.

Unauthenticated. The page logo; 404 when the page has none.

Authentication: none (anonymous).

Parameters

Name	In	Type	Required	Description
slug	path	string	yes	Pattern: ^[a-z0-9](?:[a-z0-9-]{1,46})[a-z0-9]$.

Responses

Status	Description	Body
200	The page logo (PNG, JPEG or WebP), served with nosniff.	image/jpeg string image/png string image/webp string
404	VERIFY_PAGE_NOT_FOUND: no enabled page has this slug.	application/json ErrorResponse
422	VERIFY_PAGE_INVALID: the slug or check id is malformed.	application/json ErrorResponse
503	Verification is temporarily unavailable.	application/json ErrorResponse

GET /v1/verify-pages

Operation ID: getVerifyPage

Read the account’s hosted public verify page configuration.

Read the account’s verify page. 404 VERIFY_PAGE_NOT_FOUND until one is saved.

Authentication: Authorization: Bearer <API key or console session> (Authentication).

Responses

Status	Description	Body
200	Successful Response	application/json VerifyPageResponse
401	The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists.	application/json HttpErrorResponse
403	The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope.	application/json HttpErrorResponse or ErrorResponse
404	Not Found	application/json ErrorResponse
409	Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse
422	A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse
429	The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity.	application/json ErrorResponse
503	Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse

200 response fields

Field	Type	Required	Description
check_usage	VerifyPageCheckUsage or null	no	This UTC calendar month’s public checks against the cap.
colours	VerifyPageColours	yes	Brand colours for the hosted page and the embed card. Omitted ones use defaults.
created_at	string	yes
display_name	string	yes
enabled	boolean	yes
hosted_url	string	yes	The hosted page on originalpictures.com.
logo_asset_id	string or null	yes
monthly_check_limit	integer or null	no	The owner’s monthly cap on public checks; null is the platform default.
recover_own_assets	boolean	yes
slug	string	yes
updated_at	string	yes
version	integer	yes

PUT /v1/verify-pages

Operation ID: putVerifyPage

Create or replace the account’s hosted public verify page.

Create (expected_version 0) or replace the account’s verify page. A taken or reserved slug, or a stale expected_version, is 409 VERIFY_PAGE_CONFLICT.

Authentication: Authorization: Bearer <API key or console session> (Authentication).

Request body

application/json: VerifyPageUpdateRequest (required)

Field	Type	Required	Description
colours	VerifyPageColours or null	no
display_name	string	yes	The provider name visitors see, as in ’made with {display_name}‘s system’. Max length 80.
enabled	boolean	no	A disabled page answers 404 publicly and keeps its slug reserved. Default true.
expected_version	integer	yes	0 to create the page; the version you read to replace it. Minimum 0.
logo_asset_id	string or null	no	An uploaded PNG, JPEG or WebP asset of this account, at most 1 MB, shown on the page. It becomes publicly readable through the page’s logo URL.
monthly_check_limit	integer or null	no	The most public checks the page answers per UTC calendar month; each one bills you one verification. Past it, checks are refused with 429 PUBLIC_CHECK_MONTHLY_LIMIT_REACHED until the next month. null uses the platform default (10,000); omit the field to keep the page’s current limit.
recover_own_assets	boolean	no	Also look for this account’s invisible watermark and fingerprints in files visitors check, so a copy whose Content Credentials were stripped can still answer ‘made with your system’. Recovery only ever searches this account’s own assets. Default false.
slug	string	yes	The page address: originalpictures.com/verify/{slug}/. 3 to 48 lowercase letters, digits and hyphens, starting and ending with a letter or digit. Reserved words and slugs another account uses are refused (409). Pattern: ^[a-z0-9](?:[a-z0-9-]{1,46})[a-z0-9]$.

Responses

Status	Description	Body
200	Successful Response	application/json VerifyPageResponse
401	The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists.	application/json HttpErrorResponse
403	The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope.	application/json HttpErrorResponse or ErrorResponse
404	Not Found	application/json ErrorResponse
409	Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse
422	A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse
429	The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity.	application/json ErrorResponse
503	Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status.	application/json HttpErrorResponse or ErrorResponse

200 response fields

Field	Type	Required	Description
check_usage	VerifyPageCheckUsage or null	no	This UTC calendar month’s public checks against the cap.
colours	VerifyPageColours	yes	Brand colours for the hosted page and the embed card. Omitted ones use defaults.
created_at	string	yes
display_name	string	yes
enabled	boolean	yes
hosted_url	string	yes	The hosted page on originalpictures.com.
logo_asset_id	string or null	yes
monthly_check_limit	integer or null	no	The owner’s monthly cap on public checks; null is the platform default.
recover_own_assets	boolean	yes
slug	string	yes
updated_at	string	yes
version	integer	yes