GenAI provider offers no provenance verification tool, or one that exposes personal information

Ship a free public endpoint and API that reads your latent provenance from uploaded or linked media and returns only system provenance data.

Add a verification route (for example POST /v1/provenance/verify) and publish it as an API: accept a file upload or a URL, read the embedded C2PA manifest or watermark with the library the generation path signs with (c2pa.Reader, c2pa-node, c2patool, the watermark decoder), and answer whether your GenAI system created or altered the content from the claim generator, actions and signature. Build the response from an allowlist of system provenance fields; drop identity assertions (cawg.identity), author or creator fields, and EXIF owner and location unless a stored consent record of the person they concern covers them. Process the upload in memory or a temporary file and delete it; require no sign-in or personal data, and use rate limits or abuse checks instead. Link the tool from the generation interface; a compatible third-party verifier linked there is an alternative.

Where it goes: 1 application source code, 6 API calls and integrations, 9 AI output handling, 14 user-facing text.

What reviewers look for: a public route and API spec entry that reads provenance from an upload or a URL; an allowlist of system provenance fields between the parsed manifest and the response, with personal fields only behind a consent check; no auth dependency or login decorator on the route; no persistent write of the submitted file; a link to the tool, or to a third-party verifier, in the generation interface.

@app.post('/v1/images')
def generate(req: Prompt):
    png = sign_with_c2pa(render(req.prompt))
    return Response(png, media_type='image/png')
# no way to check a file against our disclosures

SYSTEM_FIELDS = ('claim_generator', 'claim_generator_info', 'signature_info', 'validation_status')

@app.post('/v1/provenance/verify')            # public, free, documented in openapi.json
async def verify(file: UploadFile | None = None, url: str | None = None):
    data = await file.read() if file else fetch_media(url)   # in memory; nothing stored
    try:
        store = json.loads(c2pa.Reader(sniff_mime(data), io.BytesIO(data)).json())
    except Exception:
        return {'ours': False, 'provenance': None}
    active = store['manifests'][store['active_manifest']]
    actions = [a for a in active.get('assertions', []) if a['label'].startswith('c2pa.actions')]
    return {'ours': is_our_generator(active),   # created or altered by our system
            'provenance': {**{k: active.get(k) for k in SYSTEM_FIELDS}, 'actions': actions}}
    # identity, author and EXIF assertions are never echoed unless consented_fields(active) lists them

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.