I built an API that inspects C2PA Content Credentials and hidden Unicode signals

## ProvenanceScan ProvenanceScan is a conservative content provenance inspection API for developers, media tools, moderation systems, and forensic workflows. It inspects verifiable signals that are actually present in submitted content instead of estimating a generic "AI-generated probability." ## What it can inspect ### Images Supported formats: - JPEG - PNG - WebP Current image checks include: - C2PA / Content Credentials detection - C2PA manifest and signature information - Claim generator information - Issuer and signing timestamp when available - Image metadata extraction - MIME validation using file contents rather than filename alone ### Text The text endpoint inspects hidden and control Unicode signals, including: - Zero-width characters - Variation selectors - Soft hyphens - Unicode tag characters - Bidirectional and control characters - Other selected invisible Unicode signals Where applicable, findings include the Unicode code point, occurrence count, and positions in the input. ## What ProvenanceScan does NOT claim ProvenanceScan is not a generic AI detector. A result of `not_detected` does NOT prove that content is: - human-created - non-AI-generated - authentic - unedited - free of every possible watermark or provenance signal Likewise, the presence of metadata or unusual Unicode characters is not by itself proof of AI generation or malicious watermarking. The API reports observable signals and leaves higher-level interpretation to the consuming application. ## Privacy The standard local inspection endpoints do not intentionally persist uploaded content and do not intentionally log the submitted image or text content. Local inspection does not require forwarding submitted content to an external AI provider. Requests made through RapidAPI are also subject to RapidAPI's own infrastructure, logging, and data-handling practices. ## Current limits - Text: up to 100,000 Unicode code points - Image: up to 10 MiB - JPEG, PNG, and WebP only in the current release - PDF, audio, and video are not supported yet ## Main endpoints ### `POST /inspect/text` Inspect text for hidden and control Unicode signals. ### `POST /inspect/file` Inspect a JPEG, PNG, or WebP image for C2PA provenance and image metadata. ### `GET /capabilities` Returns the currently supported formats, limits, detectors, and privacy-related capability flags. ## Image upload For reliable image uploads through the RapidAPI gateway, send the image as a binary request body using: `Content-Type: application/octet-stream` Optionally provide: `X-Filename: image.png` Example: ```bash curl --request POST \ --url https://YOUR-RAPIDAPI-HOST/inspect/file \ --header 'Content-Type: application/octet-stream' \ --header 'X-Filename: image.png' \ --header 'X-RapidAPI-Key: YOUR_KEY' \ --header 'X-RapidAPI-Host: YOUR-RAPIDAPI-HOST' \ --data-binary '@image.png' ``` ## Response philosophy Detector status values are explicit: - `detected` - `not_detected` - `unsupported` - `disabled` - `unavailable` - `inconclusive` - `rate_limited` This is intentional: unsupported or unavailable checks are never silently presented as negative evidence. ProvenanceScan is designed for applications that prefer explicit technical evidence over opaque AI-detection scores.