Signing API

One POST stamps media with a C2PA Content Credential plus the standards you select—identity, API, and audit trail without a DAM.

New to Content Credentials? What is C2PA? C2PA is the base envelope; IPTC, EXIF, CAWG, PLUS, and XMP are optional claims inside it.

POST

/api/v1/sign

Multipart file plus optional standards fields. Add ?manifest=sidecar for a zip of the unmodified asset and a detached .c2pa manifest.

Bearer krsd_*

Request

# One POST = C2PA Content Credential + selected standards
curl -X POST "https://api.krusade.dev/api/v1/sign" \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -F "author=Jane Doe" \
  -F "standards=iptc,training_mining,plus" \
  -F 'iptc={"creator":["Jane Doe"]}' \
  -F 'training_mining={"entries":{"cawg.ai_generative_training":{"use":"notAllowed"}}}' \
  -F 'plus={"license":"CC-BY"}' \
  -o photo.signed.jpg

# Sidecar: leave the asset unmodified; download zip (asset + .c2pa)
curl -X POST "https://api.krusade.dev/api/v1/sign?manifest=sidecar" \
  -H "Authorization: Bearer krsd_your_key_here" \
  -F "[email protected]" \
  -F "title=Agency cutdown" \
  -o clip.c2pa.zip

OpenAPI: docs/openapi.yaml · Machine-readable error code on every failure.

Form fields

file

binary (required)

Asset to stamp. JPEG, PNG, WebP, AVIF, TIFF, GIF, MP4, MOV, MP3, WAV, FLAC. 64 MB cap.

standards

string

Comma-separated selector (e.g. iptc,training_mining). Empty → all applicable fields. Unknown name → 400.

author

string

Author → stds.schema-org.CreativeWork assertion.

title

string

Manifest title (defaults from filename).

iptc / exif / xmp

JSON string

Opaque JSON objects for IPTC, EXIF, and XMP assertions. Malformed JSON → 400.

training_mining

JSON string

CAWG AI training / data-mining preferences (cawg.training-mining).

plus

JSON string

Licensing payload (com.krusade.license).

web3

JSON string

Web3 provenance (com.krusade.web3).

cawg_identity

"true"

Opt-in signer name/email assertion. Off by default.

ingredient

binary

Optional parent asset ingested as a parentOf ingredient.

Sidecar response

With ?manifest=sidecar, the API returns application/zip containing the original file (bytes unchanged) and <name>.c2pa. Verify with an optional manifest part on /api/v1/verify.

Errors

Errors follow RFC 7807 problem+json shape with a machine-readable code field (plus detail and req_id).

400

bad_request

Missing file, unknown standards name, or malformed standards JSON (iptc/exif/…). Detail explains which field failed.

402

insufficient_credits

Included/free signs exhausted and credit balance is zero. Failed signs are never charged.

415

validation_failed

Unsupported or undetectable media type for signing (e.g. HEIC, plain text, unknown container).

Example (402)

{
  "type": "about:blank",
  "title": "Payment Required",
  "status": 402,
  "detail": "included signs used and no credits — purchase credits to continue signing",
  "code": "insufficient_credits",
  "req_id": "req_01hxyz"
}

← Developer Guide What is C2PA?Try it in the browser →