C2PA lookup for providers

C2PA keeps no global log of manifests, and a screenshot strips them. If you register each output's identifiers here, anyone holding a copy can find your signed record again at /lookup, free and without an account.

What you register

A provenance record may carry a c2pa block. It holds identifiers only, never the manifest or the media:

• manifest_digest: sha256:<hex> of the active manifest's JUMBF superbox (the description box and content boxes, not the superbox header; C2PA section 8.4.2.3). It is the same hash an ingredient's activeManifest hashed URI carries.
• manifest_label: the active manifest's urn:c2pa: label.
• instance_id: the claim's instanceID.
• soft_bindings: up to 16 { alg, value } pairs. alg must be on the pinned C2PA soft binding algorithm list (GET /v1/services/supportedAlgorithms); value is the soft binding bytes as base64.

Ingest answers 422 naming the path for an unknown algorithm, an oversized value or any extra field.

Fill it from a file, on your machine

import { readFile } from "node:fs/promises";
import { readC2paManifest, buildC2paBlock } from "@aisourceoftruth/sdk/c2pa";

const bytes = new Uint8Array(await readFile("output.jpg"));
const m = await readC2paManifest(bytes);   // JPEG, PNG or a .c2pa sidecar
console.log(m.validation.state);             // "Valid", "Invalid" or "Unknown"; never "Trusted"
const c2pa = buildC2paBlock(m, { softBindings: [{ alg: "com.adobe.trustmark.Q", value: "<base64>" }] });

Put c2pa in the record body and publish it as usual (POST /v1/records). The reader parses the JUMBF and CBOR locally and checks the claim signature against the certificate in the manifest. It does not ship the C2PA trust list, so it never reports "Trusted"; it also does not check timestamps or revocation. Add the soft binding your own watermarking step produced if the manifest does not already carry it.

How people find you

• GET /lookup?sha256=<hash>: exact bytes.
• GET /lookup?c2pa_manifest=sha256:<hex> or the urn:c2pa label: the manifest.
• GET /lookup?soft_binding_alg=<alg>&value=<base64>: a watermark or fingerprint a detector read.
• GET /v1/matches/byBinding?alg=<alg>&value=<base64>: the C2PA Soft Binding Resolution API query shape.

Every answer lists every matching record, oldest first, with its publisher and signing key, and says basis: "value supplied by caller". The registry runs no watermark or fingerprint detection and never says whether content is AI-generated.

Rules this may help with

The EU's final Code of Practice on marking and labelling AI-generated content asks providers for more than one layer of marking and for detection tools third parties can use. California's SB 942 asks covered providers to offer a free detection tool. A public lookup may be part of how a provider answers either. Whether it meets them is for you and your counsel; the registry claims compliance for no one.