Reads and validates the C2PA manifest embedded in a signed file. Performs full validation: signature check, hash binding, certificate chain, OCSP revocation.

Send the signed file as Content-Type: application/octet-stream in the request body.

const C2PA_URL = "https://c2pa.mirrorstage.net/v1";
const API_KEY = process.env.C2PA_API_KEY!;

interface VerifyResult {
  validation_state: "Invalid" | "Valid" | "Trusted";
  valid: boolean;
  trusted: boolean;
  manifest: Record<string, unknown> | null;
  signer: string | null;
  timestamp: string | null;
  validation_errors: string[];
  validation_warnings: string[];
}

function buildManifest(title: string) {
  return {
    claim_generator: "MirrorStage/1.0",
    title,
    assertions: [
      {
        label: "c2pa.actions",
        data: { actions: [{
          action: "c2pa.created",
          softwareAgent: { name: "MirrorStage", version: "1.0" },
          digitalSourceType: "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
        }] },
      },
      {
        label: "stds.schema-org.CreativeWork",
        data: { "@type": "CreativeWork", author: [{ "@type": "Organization", name: "MirrorStage" }] },
      },
    ],
  };
}

async function signFile(file: Buffer, filename: string, format: string): Promise<Buffer> {
  const form = new FormData();
  form.append("file", new Blob([file]), filename);
  form.append("manifest", JSON.stringify(buildManifest(filename)));
  form.append("format", format);

  const res = await fetch(`${C2PA_URL}/sign`, {
    method: "POST",
    headers: { Authorization: `Bearer ${API_KEY}` },
    body: form,
  });
  if (!res.ok) throw new Error(`Sign failed: ${res.status}`);
  return Buffer.from(await res.arrayBuffer());
}

async function verifyFile(file: Buffer): Promise<VerifyResult> {
  const res = await fetch(`${C2PA_URL}/verify`, {
    method: "POST",
    headers: { Authorization: `Bearer ${API_KEY}`, "Content-Type": "application/octet-stream" },
    body: file,
  });
  if (!res.ok) throw new Error(`Verify failed: ${res.status}`);
  return res.json();
}

import json, os, requests

C2PA_URL = "https://c2pa.mirrorstage.net/v1"
API_KEY = os.environ["C2PA_API_KEY"]
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

def build_manifest(title="Generated Content"):
    return {
        "claim_generator": "MirrorStage/1.0",
        "title": title,
        "assertions": [
            {
                "label": "c2pa.actions",
                "data": {"actions": [{
                    "action": "c2pa.created",
                    "softwareAgent": {"name": "MirrorStage", "version": "1.0"},
                    "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
                }]}
            },
            {
                "label": "stds.schema-org.CreativeWork",
                "data": {"@type": "CreativeWork", "author": [{"@type": "Organization", "name": "MirrorStage"}]}
            }
        ]
    }

def sign_file(file_path: str, fmt: str, title: str = "Generated Content") -> bytes:
    with open(file_path, "rb") as f:
        resp = requests.post(f"{C2PA_URL}/sign", headers=HEADERS,
            files={"file": f}, data={"manifest": json.dumps(build_manifest(title)), "format": fmt})
    resp.raise_for_status()
    return resp.content

def verify_file(file_path: str) -> dict:
    with open(file_path, "rb") as f:
        resp = requests.post(f"{C2PA_URL}/verify",
            headers={**HEADERS, "Content-Type": "application/octet-stream"}, data=f.read())
    resp.raise_for_status()
    return resp.json()  # { validation_state, valid, trusted, manifest, ... }

# Usage
signed = sign_file("photo.jpg", "image/jpeg", "My AI Photo")
open("photo_signed.jpg", "wb").write(signed)
result = verify_file("photo_signed.jpg")
print(f"State: {result['validation_state']}, Trusted: {result['trusted']}")

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

public class C2paClient
{
    private readonly HttpClient _http;
    private const string BaseUrl = "https://c2pa.mirrorstage.net/v1";

    public C2paClient(string apiKey)
    {
        _http = new HttpClient();
        _http.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", apiKey);
    }

    public async Task<byte[]> SignFileAsync(
        string filePath, string format, string title = "Generated Content")
    {
        var manifest = new
        {
            claim_generator = "MirrorStage/1.0",
            title,
            assertions = new object[]
            {
                new {
                    label = "c2pa.actions",
                    data = new { actions = new[] { new {
                        action = "c2pa.created",
                        softwareAgent = new { name = "MirrorStage", version = "1.0" },
                        digitalSourceType = "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
                    } } }
                },
                new {
                    label = "stds.schema-org.CreativeWork",
                    data = (object)new Dictionary<string, object> {
                        ["@type"] = "CreativeWork",
                        ["author"] = new[] { new Dictionary<string, string> {
                            ["@type"] = "Organization", ["name"] = "MirrorStage"
                        } }
                    }
                }
            }
        };

        using var content = new MultipartFormDataContent();
        content.Add(new ByteArrayContent(File.ReadAllBytes(filePath)),
            "file", Path.GetFileName(filePath));
        content.Add(new StringContent(
            JsonSerializer.Serialize(manifest), Encoding.UTF8), "manifest");
        content.Add(new StringContent(format), "format");

        var resp = await _http.PostAsync($"{BaseUrl}/sign", content);
        resp.EnsureSuccessStatusCode();
        return await resp.Content.ReadAsByteArrayAsync();
    }

    public async Task<VerifyResult> VerifyFileAsync(string filePath)
    {
        var bytes = File.ReadAllBytes(filePath);
        var content = new ByteArrayContent(bytes);
        content.Headers.ContentType =
            new MediaTypeHeaderValue("application/octet-stream");

        var resp = await _http.PostAsync($"{BaseUrl}/verify", content);
        resp.EnsureSuccessStatusCode();
        var json = await resp.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<VerifyResult>(json)!;
    }
}

public record VerifyResult(
    string validation_state,
    bool valid,
    bool trusted,
    JsonElement? manifest,
    string? signer,
    string? timestamp,
    string[] validation_errors,
    string[] validation_warnings
);

// Usage
var client = new C2paClient(Environment.GetEnvironmentVariable("C2PA_API_KEY")!);
var signed = await client.SignFileAsync("photo.jpg", "image/jpeg", "My AI Photo");
File.WriteAllBytes("photo_signed.jpg", signed);
var result = await client.VerifyFileAsync("photo_signed.jpg");
Console.WriteLine($"State: {result.validation_state}, Trusted: {result.trusted}");