Detect AI-generated media
at API speed.
Forensic-grade image and video analysis. One signed request - a verdict with its full evidence chain and cryptographic provenance.
What the API does
One endpoint. Every modality.
A single signed POST returns a verdict, confidence, and structured evidence - for images, video, and provenance-bearing media.
Image detection
Diffusion, GAN, and hybrid generators across JPEG, PNG, WebP, HEIC, AVIF - including phone-screenshot edge cases.
Video detection
Multi-frame consensus on MP4, MOV, WebM, MKV. Sub-second short-circuit when metadata makes the verdict obvious.
C2PA provenance
Inspect Content Credentials before running the model. Cryptographic AI-origin proof short-circuits the pipeline.
Metadata forensics
EXIF, container, and codec signals scored against a human/AI rubric - saves model spend on obvious cases.
Idempotent by design
Every call accepts an Idempotency-Key. Retry safely on network blips - you’re never charged twice.
Evidence chain
Every verdict ships with a structured chain of reasons (metadata layer + visual layer) for your own audit logs.
Request shape
One signed POST. Standard JSON back.
Your server signs the request body locally with HMAC-SHA256. Your secret never leaves your infrastructure. Full signing examples ship in the docs after you’re onboarded.
POST /v1/analyze Host: api.fauxlens.com X-FauxLens-Key: fxl_live_•••••••• X-FauxLens-Timestamp: 1779227480 X-FauxLens-Content-SHA256: 7b4f7c…0e44a3 X-FauxLens-Signature: a6f1c2…d4e9 Idempotency-Key: 5dca7b22-4b71-4a3f-b612-… Content-Type: multipart/form-data (image or video bytes)
{
"data": {
"summary": "Likely Authentic",
"confidence_score": 0.95,
"is_short_circuited": false,
"evidence_chain": [
{
"layer": "Metadata Check",
"status": "warning",
"label": "Origin Check",
"detail": "Origin could not be established from the file."
},
{
"layer": "Visual Context",
"status": "passed",
"label": "Visual Inspection",
"detail": "No visual anomalies detected."
}
],
"short_id": "KEZeCDCn"
},
"request_id": "req_206f63d4-e43b-4412-b2b8-b9fcf894955c",
"credits_remaining": 1953,
"idempotent_replay": false
}summary takes one of four values: No AI Detected · Likely Authentic · Likely AI-Generated · AI-Generated. The evidence_chain is structured for direct embedding in your own audit logs - every verdict ships with the layer-by-layer reasoning that produced it.
Security & abuse protection
Production-grade by default.
Every connection is signed, rate-limited, and auditable. Optional IP allowlists per credential add a second line of defense.
HMAC-SHA256 signing
Your secret stays on your server. Each request is signed with the timestamp, method, path, and body hash - preventing tampering and replay attacks.
- SHA-256
- No raw secrets in transit
- Replay protection: 300s window
Per-key rate limits
Every credential gets its own budget. Default limit 60 req/min, with response headers (X-RateLimit-Limit, Remaining, Reset, Retry-After) on every call.
- Sliding-window counter
- Higher limits on request
- Backoff-friendly headers
IP allowlists
Optional CIDR whitelist scoped per credential. Combine with key rotation for production safety. Refunds on pipeline failure are automatic and idempotent.
- Per-credential CIDRs
- Key rotation in dashboard
- Auto-refund on failure
Already using the Developer API? Your keys keep working. Moving to a volume just moves your billing.
Volumes
Pay once. Use until you don’t.
Prepaid enterprise credits that never expire, one enterprise credit per API call. Same forensic engine at every volume. Tell us the volume you need and we will invoice you directly.
Swipe to compare volumes →
Every application starts with a 50-credit sandbox, approved within 24 h, for evaluation only.
Common questions
Answers before you ask.
One enterprise credit pays for one API call. It is a separate unit from self-serve credits, where a call costs 10 credits. Enterprise credits come in prepaid, invoiced volumes of 2,000, 10,000 or 25,000 and never expire.
Paid and sandbox credits never expire. They sit on your account until you spend them.
You are never charged for a failed scan. If our pipeline crashes, times out, or returns "Analysis Failed", we automatically refund the credit. Refunds are idempotent - retrying a failed request won’t double-credit you.
No. Media is held only for the lifetime of the request, then deleted. The media itself is never stored. We keep the verdict and evidence chain for 24 hours for caching and safe retries, plus a billing record with the request ID and file name. We are GDPR-friendly by design.
The default limit is 60 requests/minute per credential. Need more? Tell us your peak in the application form and we’ll raise the ceiling before you go live.
From your dashboard, click "Revoke" on the compromised credential and "New key" to issue a fresh pair. Revocation is instant: any new request with the old key gets a 401. Requests already in progress finish normally.
Ready to integrate?
Request a sandbox and get 50 free enterprise credits within 24 hours, or tell us the volume you need. Production keys follow once your invoice is paid.