Document integrity checks

The job

A new customer uploads a photo of their driving licence and a PDF bank statement during onboarding. Before you accept them, you want to know whether either was edited, generated by AI, or is not what its file type claims, and send anything suspicious to a reviewer. This example shows the two decisions that are yours to make: which checks to run for each document, and how to route on the result. For the request and polling basics, see the Forensics quickstart.

Sample input

licence-front.jpg, a 3 MB JPEG photo of the front of a driving licence taken on a phone.
statement-2026-09.pdf, a 4-page PDF bank statement used as proof of address.

Both are already stored in your workspace. If you only need integrity checks, upload them with storageOnly: true so they skip OCR and extraction; see Upload options. To run all 19 checks as the file arrives instead, see Two ways to run it.

Steps

Choose checks for each document

A check that doesn’t fit the file reports skip, so pick the ones that can find something in this kind of document:

Document	`spec_filter`	Why
Photo of an ID	`copy_move`, `ai_gen_detection`, `web_presence`, `magic_byte`	Cloned regions, a generated image, a photo lifted from the web, or a file that isn’t really a JPEG.
PDF statement	`ai_pdf_detection`, `producer_divergence`, `revision_history`, `magic_byte`	A generated PDF, pages from different producers, or later edits.

See Detectors for every key.

Python

import os, time, requests

BASE = "https://api.orion.file.ai/prod/v1"
HEADERS = {"x-api-key": os.environ["FILEAI_API_KEY"]}

CHECKS = {
    "image/jpeg": ["copy_move", "ai_gen_detection", "web_presence", "magic_byte"],
    "application/pdf": ["ai_pdf_detection", "producer_divergence", "revision_history", "magic_byte"],
}

Start a run and wait for it

Python

def check(file_id, mime_type):
    run = requests.post(
        f"{BASE}/forensics",
        headers=HEADERS,
        json={"file_id": file_id, "spec_filter": CHECKS[mime_type]},
    )
    run.raise_for_status()
    run_id = run.json()["run_id"]

    while True:
        result = requests.get(f"{BASE}/forensics/runs/{run_id}", headers=HEADERS).json()
        if result["status"] in ("complete", "error"):
            return result
        time.sleep(5)

web_presence can take up to about 180 seconds. A run still queued or running after about 6 minutes is stuck; see Retry a stuck run.

Route on each check's status

Python

def route(file_id, result):
    statuses = {key: r["status"] for key, r in result.get("forensics", {}).items()}

    if result["status"] == "error" or "error" in statuses.values():
        retry_later(file_id)          # a check or the run failed
    elif "issue" in statuses.values():
        send_to_reviewer(file_id, [k for k, s in statuses.items() if s == "issue"])
    else:
        accept(file_id)               # every check reported none or skip

for file_id, mime_type in [(licence_id, "image/jpeg"), (statement_id, "application/pdf")]:
    route(file_id, check(file_id, mime_type))

Result

Illustrative: shape from the API reference. Fields beyond status and value vary by check.

GET /v1/forensics/runs/{run_id}

{
  "run_id": "eebb50fee5b1",
  "file_id": "665f1c2e8a1b4c0012ab9911",
  "spec_filter": ["copy_move", "ai_gen_detection", "web_presence", "magic_byte"],
  "status": "complete",
  "created_at": "2026-09-25T02:14:00.000Z",
  "forensics": {
    "copy_move": { "status": "issue" },
    "ai_gen_detection": { "status": "none", "value": "AI-generated: false" },
    "web_presence": { "status": "none", "value": "Web presence: false", "web_presence": false },
    "magic_byte": { "status": "none" }
  }
}

Here copy_move found cloned regions, so the licence goes to a reviewer even though the other checks are clear.

What it shows

Choose checks per document type. An image and a PDF need different checks; spec_filter is required, so a check added later never changes what your integration runs.
Route on each check’s status, not the run’s. A complete run can still contain an issue.
For web_presence, a missing web_presence boolean means no conclusion, not “not found”.

Delete the run with DELETE /v1/forensics/runs/{run_id} once you have stored the outcome. The file is not affected.

Next steps

Detectors and results

All nineteen checks, statuses and errors.

Forensics quickstart

The shortest path to a first run, in cURL, Python and Node.

Run fileForensics from your assistant

run_file_forensics and related MCP tools.

Uploads

Upload options, including storageOnly.

Get started

Products

Build

Go live

Document integrity checks

The job

Sample input

Steps

Result

What it shows

Next steps

Detectors and results

Forensics quickstart

Run fileForensics from your assistant

Uploads

​The job

​Sample input

​Steps

​Result

​What it shows

​Next steps

Detectors and results

Forensics quickstart

Run fileForensics from your assistant

Uploads

The job

Sample input

Steps

Result

What it shows

Next steps