Get a forensics run

GET

forensics

runs

{run_id}

Get a forensics run

curl --request GET \
  --url https://api.orion.file.ai/prod/v1/forensics/runs/{run_id} \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.orion.file.ai/prod/v1/forensics/runs/{run_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "run_id": "<string>",
  "file_id": "<string>",
  "spec_filter": [
    "web_presence"
  ],
  "status": "queued",
  "created_at": "2023-11-07T05:31:56Z",
  "forensics": {
    "web_presence": {
      "status": "none",
      "value": "Web presence: true",
      "web_presence": true,
      "layer1": {
        "reason": "PNG has an Apple iDOT chunk, typical of local ImageIO writes.",
        "likely_web": true,
        "likelihood_pct": 50
      },
      "layer2": {
        "checked": true,
        "reason": "<string>",
        "exact_matches": [
          {
            "url": "<string>",
            "title": "<string>",
            "source": "eBay",
            "thumbnail": "<string>",
            "image": "<string>",
            "kind": "page",
            "verified": true
          }
        ],
        "orange_matches": [
          {}
        ],
        "hash_verified_matches": [
          {}
        ],
        "leads": [
          {}
        ],
        "web_presence": true
      }
    },
    "ai_gen_detection": {},
    "ai_text_detection": {},
    "copy_move": {},
    "exact_duplicate": {},
    "provenance_credentials": {},
    "generation_toolchain": {},
    "producer_divergence": {},
    "encryption_permissions": {},
    "active_content": {},
    "digital_signature": {},
    "attachments": {},
    "revision_history": {},
    "magic_byte": {},
    "polyglot": {},
    "trailing_data": {},
    "entropy": {},
    "ai_pdf_detection": {},
    "ai_office_detection": {},
    "heatmap": {},
    "document_integrity_decisions": {}
  },
  "catalog_version": "fm-59@2026-08",
  "checks": {},
  "mapping": {
    "layout_parse": {}
  }
}

Request · Response · Guide: fileForensics

More details

status is queued or running while in progress, complete or error once terminal.

Authorizations

x-api-key

string

header

required

API key for authentication

Path Parameters

run_id

string

required

The run to fetch.

Response

The run.

run_id

string

required

file_id

string

required

spec_filter

enum<string>[]

required

Available options:

web_presence,

ai_gen_detection,

ai_text_detection,

copy_move,

exact_duplicate,

provenance_credentials,

generation_toolchain,

producer_divergence,

encryption_permissions,

active_content,

digital_signature,

attachments,

revision_history,

magic_byte,

polyglot,

trailing_data,

entropy,

ai_pdf_detection,

ai_office_detection,

heatmap,

document_integrity_decisions,

layout_parse

status

enum<string>

required

queued and running are in progress; complete and error are terminal.

Available options:

queued,

running,

complete,

error

created_at

string<date-time>

required

forensics

object

required

Results keyed by spec_filter entry. Empty until the first detector reports; a key appears once its detector has finished.

Show child attributes

catalog_version

string

Example:

"fm-59@2026-08"

checks

object

FileMap checks category (FileChecks). Present when upstream produced checks; keys are detector names with internal timing fields stripped.

mapping

object

FileMap mapping category. layout_parse carries FileElements (bboxes) when requested upstream (e.g. product upload).

Show child attributes

Get a forensics run

curl --request GET \
  --url https://api.orion.file.ai/prod/v1/forensics/runs/{run_id} \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.orion.file.ai/prod/v1/forensics/runs/{run_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "run_id": "<string>",
  "file_id": "<string>",
  "spec_filter": [
    "web_presence"
  ],
  "status": "queued",
  "created_at": "2023-11-07T05:31:56Z",
  "forensics": {
    "web_presence": {
      "status": "none",
      "value": "Web presence: true",
      "web_presence": true,
      "layer1": {
        "reason": "PNG has an Apple iDOT chunk, typical of local ImageIO writes.",
        "likely_web": true,
        "likelihood_pct": 50
      },
      "layer2": {
        "checked": true,
        "reason": "<string>",
        "exact_matches": [
          {
            "url": "<string>",
            "title": "<string>",
            "source": "eBay",
            "thumbnail": "<string>",
            "image": "<string>",
            "kind": "page",
            "verified": true
          }
        ],
        "orange_matches": [
          {}
        ],
        "hash_verified_matches": [
          {}
        ],
        "leads": [
          {}
        ],
        "web_presence": true
      }
    },
    "ai_gen_detection": {},
    "ai_text_detection": {},
    "copy_move": {},
    "exact_duplicate": {},
    "provenance_credentials": {},
    "generation_toolchain": {},
    "producer_divergence": {},
    "encryption_permissions": {},
    "active_content": {},
    "digital_signature": {},
    "attachments": {},
    "revision_history": {},
    "magic_byte": {},
    "polyglot": {},
    "trailing_data": {},
    "entropy": {},
    "ai_pdf_detection": {},
    "ai_office_detection": {},
    "heatmap": {},
    "document_integrity_decisions": {}
  },
  "catalog_version": "fm-59@2026-08",
  "checks": {},
  "mapping": {
    "layout_parse": {}
  }
}

Get started

Endpoints

Authorizations

Path Parameters

Response