Skip to main content
This API is separate from the Samsa REST API. It has its own base URL, takes no API key, and spends no credits — so none of the API reference conventions (bearer auth, scopes, the error envelope, credit accounting) apply to it.
Samsa marks its AI-generated content with machine-readable techniques so it can be detected later. This API is how you read those marks back: upload an image or a video, and it reports what each technique found. It is Samsa’s public detection mechanism under Article 50(2) of the EU AI Act, and it is free for anyone to use — platforms, newsrooms, researchers, regulators, or anyone who has an asset and wants to check it.

Base URL

No Authorization header, no API key, no credits.

Endpoints

How the verdict is decided

The response reports each technique separately, and one top-level detected verdict. The verdict comes from C2PA manifest verification, which is authoritative. Watermark techniques are corroboration only: they can add attribution when no manifest is present, but they never override the C2PA verdict.
Because hosted watermark decode is not yet available, the API reports both watermark techniques as not_checked, never as a false “no watermark”. A not_checked technique was never evaluated — it is not a finding that no watermark is present. See Reading the techniques breakdown.

How detection works

The canonical, per-technique description: algorithm IDs, pinned model artifact hashes, the per-lane soft-binding label mapping, decoders, and trust anchoring. It is Samsa’s public Measure 3.4(b) information for the European Commission and other stakeholders. The same content is available as JSON from GET /v1/public/detect/info.

Retention

Uploads are processed in memory and never retained. They are never persisted and never logged. Only a no-PII audit row — a request reference, a coarse region bucket, and the verdict facts — is recorded. Where a signed result PDF is issued, it stays downloadable for 24 hours.

Service health

GET /v1/public/detect/health returns a minimal status and version payload. It reads no client data and echoes no PII — use it for uptime probes.

Errors

This service does not use the Samsa REST API’s error envelope. Failures return the plain shape below, and you should branch on the HTTP status:
A 503 additionally carries a Retry-After header. Per-endpoint status codes are listed on each endpoint page.

Verify independently

You never have to take Samsa’s word for a C2PA result. The manifest travels with the asset, so any independent validator reads the same evidence.

Content Credentials Verify

Drop the asset into the public C2PA validator and inspect its manifest yourself.

Detection info endpoint

The same technique-by-technique information as JSON, including decoder pointers.