Introduction
Original Pictures is a content provenance API. You upload an immutable media object, run one of three reviewed recipes against it, and get back a published asset, a signing receipt, and verification evidence. You can also submit any stored object for independent verification later.
What a recipe can do
Section titled “What a recipe can do”Each recipe runs a fixed, reviewed sequence of steps. The public capabilities are:
c2pa_signing: create a C2PA manifest and sign it.watermark: embed an imperceptible watermark.fingerprint: compute a perceptual fingerprint used for bounded recovery.
List the recipes available to your account with GET /v1/recipes.
Supported media
Section titled “Supported media”The current executable contract lists these media types:
| Format | Media type |
|---|---|
| JPEG | image/jpeg |
| PNG | image/png |
| WebP | image/webp |
| TIFF RGB8 | image/tiff |
| AVIF SDR8 | image/avif |
| WAV | audio/wav |
| MP3 | audio/mpeg |
| AAC | audio/mp4 |
| MP4 | video/mp4 |
TIFF accepts one uncompressed 8-bit RGB image with upright orientation and no
alpha, tiles, thumbnails or ICC profile, up to 128 MiB.
AVIF accepts one 8-bit SDR still image with optional alpha, up to 50 MiB,
40 million pixels and 16,384 pixels per side.
MP4 (video/mp4) accepts one H.264 video track (8-bit 4:2:0) and at most one AAC-LC audio track, in a non-fragmented file with no other tracks. HEVC, 10-bit/HDR, HE-AAC and fragmented MP4 are refused with MEDIA_CODEC_UNSUPPORTED; phone recordings are often HEVC, so re-export them as H.264/AAC first.
AAC audio (audio/mp4, an .m4a file) can be signed but not watermarked: the
audio runtime decodes AAC and does not encode it, so recipes that embed an audio
watermark decline this type. Use a sign-only recipe.
Sign-only media
Section titled “Sign-only media”Eleven more types are signed with the manifest embedded in the file, through one recipe,
rcp_system_structural_sign_only:
| Format | Media type |
|---|---|
| GIF | image/gif |
| JPEG XL (container) | image/jxl |
| SVG | image/svg+xml |
| DNG | image/x-adobe-dng |
| HEIC | image/heic |
| HEIF | image/heif |
| HEIC image sequence | image/heic-sequence |
| HEIF image sequence | image/heif-sequence |
| QuickTime | video/quicktime |
| AVI | video/x-msvideo |
| FLAC | audio/flac |
These are signed only: no watermark and no perceptual fingerprint, so there is no recovery by similarity if the manifest is later stripped. The service checks each file’s structure and never decodes its pixels or samples, which is why the watermark and fingerprinting recipes decline these types by name — both would need a decode. A JPEG XL file must use the ISO-BMFF container; a bare codestream has nowhere to hold a manifest. An SVG is signed as the text you uploaded; scripts or external references in it are recorded, not removed. A DNG is rewritten by the signer, so the signed file is not byte-identical to your upload outside the manifest.
Sidecar media
Section titled “Sidecar media”These types are signed with the manifest beside the file rather than inside it: the asset
you download is byte-for-byte the asset you uploaded, and its C2PA manifest arrives as a
separate .c2pa file that must travel with it. The hard binding covers the whole file with no
excluded region. None of them is watermarked or perceptually fingerprinted, so each is
sign-only, through its family’s own recipe.
| Family | Format | Media type |
|---|---|---|
| Image | TIFF-based image | image/x-tiff-based |
| Image | RIFF-based image | image/x-riff-based |
| Video | ISO BMFF-based video | video/x-bmff-based |
| Video | RIFF-based video | video/x-riff-based |
| Audio | AAC audio (ADTS) | audio/aac |
| Audio | MPEG audio stream | audio/MPA |
| Audio | RIFF-based audio | audio/x-riff-based |
| Text | Plain text | text/plain |
| Text | HTML | text/html |
| Text | XML | text/xml, application/xml |
| Text | XHTML | application/xhtml+xml |
| Documents | application/pdf |
|
| Documents | EPUB | application/epub+zip |
| Documents | Word (DOCX) | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| Documents | OpenDocument text | application/vnd.oasis.opendocument.text |
| Documents | OpenXPS | application/oxps |
| Documents | ZIP-based file | application/x-zip-based |
| Fonts | OpenType font | font/otf |
| ML model | NumPy array | application/x-npy |
| ML model | ONNX | application/onnx |
| ML model | PyTorch checkpoint | application/x-pytorch |
| ML model | Python pickle | application/x-pickle |
| ML model | TensorFlow graph / SavedModel | application/x-tensorflow, application/x-tensorflow-savedmodel |
| ML model | Protocol Buffers | application/x-protobuf |
| ML model | Keras | application/x-keras |
| ML model | JAX / Flax | application/x-jax |
| ML model | MXNet parameters | application/x-mxnet |
| ML model | ML.NET | application/x-mlnet |
| ML model | OpenVINO topology / weights | application/x-openvino-ir+xml, application/x-openvino-weights |
Each upload is checked by a bounded structural inspector before anything is signed – a PDF’s cross-reference chain, a ZIP package’s central directory, a model’s container structure – and nothing is rendered, decompressed to disk, executed or unpickled. A pickle or a PyTorch checkpoint is a program: it is scanned and signed, never run, and loading one you did not create runs whatever it contains. A file that already carries an embedded C2PA manifest is refused, because this lane does not re-sign. Uploads are bounded at 32 MiB (HTML at 4 MiB).
The recipes are rcp_private_sidecar_{family}_sign_only for font, model, document,
text, audio, image and video; name the one for your file’s family in POST /v1/sign.
A validator is only recommended, never required, to look for a manifest beside a file, so keep
the two together. A font’s manifest carries no font.info assertion: every field it requires is
a string out of your font’s own name table, and this product does not copy your content into a
manifest it hands to third parties. An ML model’s manifest names its container in its
format field and carries no c2pa.asset-type assertion: the only form of it the signing
engine can write is the one C2PA 2.4 deprecates.
A recipe may support a subset. Check the supported_media_types field of each recipe.
The presence of a decoder or an image-profile entry does not establish public
availability. Use the account-specific recipe and capability responses; planned
or privately tested profiles are not enabled by this documentation.
What provenance does not prove
Section titled “What provenance does not prove”A valid signature shows that a manifest was signed by a given certificate and has not changed since. It does not show that the content is truthful, and it does not guarantee compliance with any regulation. Verification results that come only from watermark or fingerprint recovery are labelled as recovery, not as cryptographic validity. See Verify.
Next steps
Section titled “Next steps”- Quickstart: run the whole flow with
curl. - API overview: base URL, authentication, idempotency, and errors.
- API reference: every operation, generated from the contract.