Validate C2PA

In the previous doc, Understand C2PA, we explored the core structures within a C2PA validation report, focusing on key objects essential for understanding how C2PA works. However, the validation report contains additional objects that we did not cover yet. This follow-up is here to guide you through those remaining elements, ensuring a comprehensive understanding of the entire report.

If building your own visualization isn't on your to-do list, our Content Credentials display tool does the heavy lifting for you. It interprets the validation report, presenting the information in a consumer-friendly format so you can focus on what matters most.

You can also learn about the verification function on each of our platforms:

• Android
• iOS
• CLI
• C2PA library

Certificate chain

The certificate chain is included in the validation report to ensure that the digital signature on the content credentials is trustworthy. This chain links the individual certificate used to sign the content (the "leaf" certificate) back to a trusted root certificate authority (CA). To verify that a certificate is valid, it must be part of a chain that leads to a trusted root CA. The validator checks this chain against managed lists of trusted certificates, which are either provided by the C2PA or configured by the user, to confirm the authenticity of the signer.

Active manifest

In the validation report, is_active is a boolean that tells you whether that manifest is the latest one. In a case where there are multiple manifests, earlier ones will all be FALSE. In many Content Credentials displays, the signer and software used in the latest, active manifest are given prominent placement, while other manifests require additional clicks to view.

Validation statuses

The validation statuses object includes codes that describe whether specific parts of a manifest passed or failed validation. Each code is accompanied by a success indicator: true if the code reflects success, or false if it reflects failure.

Below is a table that explains some of the validation status codes and what they mean when content credentials are found to be invalid. When not covered below, the explanation is that the content credentials are invalid because someone or something changed this file in an unexpected way.

AI determination

Determines the presence of AI for your convenience.

{
  "ai": {
          "is_ai_generated": false,
    			"is_ai_edited": false,
   				 "contains_ai": false,
        }
}

This assessment is provided individually for each manifest and is derived from the included C2PA information.