C2PA marking API

Mark AI-generated images in a machine-readable way, as required by EU AI Act Article 50(2). Send an image, receive the same image back with an embedded C2PA Content Credentials manifest whose c2pa.actions assertion declares digitalSourceType = trainedAlgorithmicMedia (the IPTC code for AI-generated media).

Endpoint

POST https://aiact.zalize.com/api/c2pa/sign

Auth: Authorization: Bearer aiact_… — your API key is on the dashboard after signing in. Requires a Growth (2,000 images/mo) or Agency (20,000 images/mo) plan.
Body: the raw image bytes. Content-Type must be image/jpeg, image/png or image/webp. Max 15 MB.
Response: the signed image (same format). The X-C2PA-Usage header reports used/limit for the current month.
Errors: JSON with an error field — 401 (bad key), 403 (plan without API access), 413 (too large), 415 (unsupported type), 422 (unreadable image), 429 (quota exhausted).

Example

curl -X POST https://aiact.zalize.com/api/c2pa/sign \
  -H "Authorization: Bearer aiact_YOUR_API_KEY" \
  -H "Content-Type: image/jpeg" \
  --data-binary @image.jpg \
  -o signed.jpg

Verify the result

# Inspect the embedded manifest with the official c2patool
c2patool signed.jpg

# or online: https://contentcredentials.org/verify

Manifests are currently signed with our own certificate chain. They are cryptographically valid and readable by any C2PA tool, but verifiers that check the C2PA public trust list will show the signer as “unknown” until our CA-issued signing certificate is live.

Need higher volume? See plans or contact us.