Media Signing API

The Media Signing API signs a supported media file and embeds a C2PA-compliant manifest. The response includes the signed file as Base64 data and a JSON-encoded manifest store that your application can inspect.

Overview

Use the API to sign supported media files with a C2PA-compliant manifest. The resulting Content Credentials provide tamper-evident provenance information that helps a viewer verify who signed the content, which actions were declared, and whether the signed asset has changed.

The API also supports S/MIME Baseline Requirements (BR) certificates for CAWG identity assertions. A CAWG identity assertion adds verifiable creator, publisher, or contributor identity information to the Content Credentials. Please note that CAWG identity assertion signing is supported only in the production environment.

For an application integration that uses the native Media Signing Library, see Media Signing Library API integration.

You can use the API to:

• Generate and embed a minimal C2PA manifest.

• Add signing metadata and supported user-declared actions.

• Disclose AI-assisted creation and record AI training or data-use permissions.

• Include available EXIF metadata, a digital source type, and an external reference.

• Add a CAWG identity assertion by using an S/MIME BR certificate credential.

Prerequisites

Before making your first request, make sure you have:

• A DigiCert ONE account with Content Trust Manager enabled.

• Your Content Trust Manager account ID.

• One request-authentication method: an API key or a client authentication certificate for mutual TLS (mTLS).

• Credentials created in the same production (one.digicert.com) or demo environment (demo.one.digicert.com) as the endpoint you call.

• A supported media file.

• For CAWG identity assertion signing, an S/MIME BR certificate credential and its credential ID, PIN, and OTP when your credential policy requires one.

Client authentication certificate

Use a client authentication certificate when your integration authenticates with mTLS. The certificate is presented during the TLS handshake; an API key is not sent on an mTLS request.

Create a client authentication certificate

• Sign in to DigiCert ONE.

• Select the user icon, select Admin profile, and then select Client authentication certificates.

• Select Create client authentication certificate.

• Enter a unique nickname using letters, numbers, spaces, dashes, or underscores.

• Select an end date and optionally record it in your certificate-rotation process.

• Select AES for Encryption.

• Select SHA256 for Signature hash algorithm.

• Select Generate certificate.

• Copy the certificate password and store it securely, such as in your organization’s secrets-management system. You cannot retrieve the password later.

• Download the certificate and store it securely. You cannot download the same certificate again.

Configure the certificate in Postman

• Open Settings > Certificates.

• Set Host to clientauth.one.digicert.com for production, or clientauth.demo.one.digicert.com for demo. Enter only the hostname (do not include https:// or the API path).

• Set Port to 443.

• Upload your client authentication certificate to the PFX file field and enter its password in Passphrase.

API key

Use an API key when your integration does not use mTLS. Send the key in the x-api-key header and use the API-key endpoint. Do not attach a client authentication certificate to the same request.

Create or copy an API key

• Sign in to Content Trust Manager in the environment your integration will call.

• Select the user icon, and then select Admin profile.

• Scroll to API Keys.

• Generate a key or copy an existing key for your integration.

• Store the API key securely, such as in your organization’s secrets-management system. Do not commit it to source control or include it in a shared Postman collection.

Authentication

Environment scope API keys, account IDs, and client certificates must belong to the selected environment. A missing, invalid, expired, or environment-mismatched API key returns HTTP 401 with error wrong_token and error_description Invalid session.

Do not send browser cookies The API does not require a Cookie header. Remove copied browser cookies from curl commands, Postman requests, and application code.

Endpoints

For the demo environment, use the corresponding demo.one.digicert.com or

clientauth.demo.one.digicert.com host. Keep the path unchanged and use demo-issued credentials.

Request parameters

Send a POST request as multipart/form-data. Add each body parameter as a separate form field.

Headers

Body

Boolean values Send lowercase true or false. The service accepts some aliases for some fields, but relying on aliases such as TRUE, 1, or yes makes integrations less portable. An unrecognized Boolean value returns HTTP 400.

Supported media types

The file field accepts these documented media types. Send an accurate MIME type and make sure the file bytes match the declared type.

Manifest behavior

Generate a minimal manifest

When you submit accountId, role, and file without optional metadata, the API generates and embeds a minimal C2PA-compliant manifest.

Add signing metadata

Send optional signing metadata as separate multipart fields. The API combines the values with a system-managed action based on the input state.

User-defined manifest actions

Use additionalActions to declare transformations performed on the asset. Send the value as a JSON object encoded in one multipart text field, not as an array of action objects. For more details, see Request parameters.

Optional fields for each action

Timestamp format Always send a valid ISO 8601 timestamp, such as 2026-08-19T12:30:00Z.

Correct additionalActions JSON object

{
  "c2pa.edited": {
    "software": "Example Editor",
    "version": "1.0",
    "time": "2026-08-19T12:30:00Z"
  },
  "c2pa.resized": {
    "time": "2026-08-19T12:31:00Z"
  }
}

Incorrect: do not send an array

[
  {
    "action": "c2pa.edited",
    "software": "Example Editor",
    "version": "1.0"
  }
]

Corresponding user-declared actions in the manifest

[
  {
    "action": "c2pa.edited",
    "softwareAgent": "Example Editor/1.0",
    "when": "2026-08-19T12:30:00Z"
  },
  {
    "action": "c2pa.resized",
    "when": "2026-08-19T12:31:00Z"
  }
]

Reserved actions Do not send c2pa.created or c2pa.opened in additionalActions. The API manages those actions. Unknown or reserved action keys return HTTP 400.

allActionsIncluded

The API always emits allActionsIncluded in the c2pa.actions.v2 assertion. The value is true when the generated manifest contains an accepted additionalActions action or when createdWithAi successfully changes a new c2pa.created action to an AI-created action. The value is true when the manifest contains only the default c2pa.opened or non-AI c2pa.created action.

Existing signed media For a file that already has Content Credentials, createdWithAi=true does not add c2pa.created and does not, by itself, make allActionsIncluded true.

AI usage and permissions

AI creation disclosure

Set createdWithAi=true only for new content created with AI. Use it with isNewCreation=true on content that does not already contain Content Credentials. The c2pa.created action uses this exact digital source type when createdWithAi is set to true:

http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia

For that action, the AI-derived (createdWithAi=true) digital source type takes precedence over the request-level digitalSourceType. If the file already has Content Credentials, the API records c2pa.opened and ignores the creation disclosure.

AI training and data-use permissions

The permission fields aiInference, generativeAiTraining, dataMiningAndAnalytics, and nonGenerativeAiTraining are case-sensitive. Each accepts allowed, prohibited, or constrained.

Orphan ConstraintsInfo values If the parent permission is omitted, allowed, or prohibited, the API accepts but ignores a supplied ConstraintsInfo value. It emits constraint_info only when the parent permission is constrained.

EXIF metadata ingestion

For a media file that contains EXIF metadata, set includeExifMetadata=true. The API extracts available metadata and embeds it in a c2pa.metadata assertion. If the source file contains no EXIF data, the signed manifest might not contain c2pa.metadata.

External references

Use externalReferenceUri and externalReferenceContentType together to add a c2pa.external-reference assertion.

• externalReferenceUri must be an accepted absolute URI with a scheme, such as https://www.example.com/resource.

• externalReferenceContentType must be an IANA media type, such as application/json or text/html.

• The API validates the values but does not access or fetch the referenced resource during signing.

• If you send a content type without a URI, the API ignores it and does not emit an externalReference assertion.

CAWG identity assertion signing

Use the CAWG signing flow when Content Credentials must include verifiable creator, publisher, sponsor, editor, producer, translator, or contributor identity information. Obtain an S/MIME BR certificate credential before sending the request. Check References to learn more about ordering an S/MIME BR certificate. Please note that CAWG identity assertion signing is supported only in the production environment.

Examples

API key authentication

Minimal production request

curl --location 'https://one.digicert.com/documentmanager/api/c2pa/v1/sign' \
  --header 'Accept: application/json' \
  --header "x-api-key: ${DIGICERT_API_KEY}" \
  --form "accountId=${DIGICERT_ACCOUNT_ID}" \
  --form 'role=publisher' \
  --form 'file=@/absolute/path/to/sample.jpg'

mTLS authentication

Minimal production request with a client certificate

curl --location 'https://clientauth.one.digicert.com/documentmanager/api/c2pa/v1/sign' \
  --cert-type P12 \
  --cert "/secure/path/client-auth.p12:${DIGICERT_CERT_PASSPHRASE}" \
  --header 'Accept: application/json' \
  --form "accountId=${DIGICERT_ACCOUNT_ID}" \
  --form 'role=publisher' \
  --form 'file=@/absolute/path/to/sample.jpg'

Signing metadata

AI-created image with permissions and an edit action

curl --location 'https://one.digicert.com/documentmanager/api/c2pa/v1/sign' \
  --header 'Accept: application/json' \
  --header "x-api-key: ${DIGICERT_API_KEY}" \
  --form "accountId=${DIGICERT_ACCOUNT_ID}" \
  --form 'role=creator' \
  --form 'file=@/absolute/path/to/new-image.jpg' \
  --form 'isNewCreation=true' \
  --form 'createdWithAi=true' \
  --form 'generativeAiTraining=constrained' \
  --form 'generativeAiTrainingConstraintsInfo=Permitted only for internal evaluation.' \
  --form 'additionalActions={"c2pa.edited":{"software":"Example Editor","version":"1.0"}}'

S/MIME signing for a CAWG identity assertion

CAWG signing with an S/MIME credential

curl --location 'https://one.digicert.com/documentmanager/api/c2pa/v1/sign' \
  --header 'Accept: application/json' \
  --header "x-api-key: ${DIGICERT_API_KEY}" \
  --form "credentialId=${DIGICERT_CREDENTIAL_ID}" \
  --form "pin=${DIGICERT_CREDENTIAL_PIN}" \
  --form "otp=${DIGICERT_OTP}" \
  --form "accountId=${DIGICERT_ACCOUNT_ID}" \
  --form 'role=publisher' \
  --form 'file=@/absolute/path/to/image.jpg'

OTP is conditional Remove the otp line when the selected credential flow does not require SCAL 2 OTP authentication. By default, OTP is not required.

Decode the signed media

macOS or Linux

Save the API response as response.json, and then decode the encoded_signed_content field to create the signed media file.

jq -r '.encoded_signed_content' response.json | base64 --decode > signed-output.jpg

Response parameters

Success response shape

{
  "file_name": "signed-sample.jpg",
  "mime_type": "image/jpeg",
  "encoded_signed_content": "<base64-data>",
  "manifest_store": "{\"active_manifest\":\"<manifest-id>\",\"manifests\":{}}"
}

Errors and troubleshooting

HTTP response codes

401 response

{
  "error": "wrong_token",
  "error_description": "Invalid session."
}

429 response

{
  "error": "invalid_request",
  "error_description": "Too many requests. Please retry later."
}

Troubleshooting tips

Authentication failure: Confirm that you selected the correct host for the authentication method and environment.

• For API key authentication, confirm that x-api-key is present and the key and account ID belong to the endpoint environment.

• For mTLS, confirm the Postman certificate Host contains only the hostname, Port is 443, and the PFX passphrase is correct.

• For CAWG signing, confirm that credentialId identifies the intended S/MIME BR certificate, pin is present, and otp is included only when required.

File error: Confirm the file path exists and the file uses a supported media type.

Role error: Send one documented lowercase role.

additionalActions error: Send a JSON object encoded as one form field. Use only c2pa.edited, c2pa.resized, and c2pa.filtered.

AI training and data-use permissions error: Use lowercase allowed, prohibited, or constrained. If constrained, send the matching non-empty ConstraintsInfo field.

External-reference error: Send an accepted absolute URI together with a valid IANA media type.

Unexpected c2pa.opened: Check whether the input already contains Content Credentials. Existing provenance takes precedence over isNewCreation=true.

Multipart error: Remove a manually set Content-Type header and allow your HTTP client to generate the boundary.

References

• Media Signing API: OpenAPI reference.
• S/MIME BR certificate setup: Get an S/MIME BR certificate.
• Digital Source Type vocabulary: IPTC NewsCodes.