fileForensics

fileForensics checks the original file for signs of editing, AI generation, reuse and hidden content, and reports a verdict per check. Use it on ID scans, bank statements, claim evidence and any file where a forgery costs money.

Two ways to run it

At upload

Add FILE_FORENSICS to enabledProducts on POST /v1/files/upload. All 19 checks run once the file is stored.Use it alone with storageOnly: true, or together with FILE_SCOUT to extract and check the same file.

On a stored file

Call POST /v1/forensics with the file’s file_id and the checks you want in spec_filter, then poll the run.Use it to check files you uploaded earlier, or to run only some checks.

At upload, fileForensics only

curl -X POST "$FILEAI_BASE_URL/files/upload" \
  -H "x-api-key: $FILEAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fileName": "bank-statement.pdf",
    "fileType": "application/pdf",
    "enabledProducts": ["FILE_FORENSICS"],
    "storageOnly": true
  }'

Here FILEAI_BASE_URL is https://api.orion.file.ai/prod/v1, or your regional host. enabledProducts works only on the single upload route and needs a workspace enabled for these products; see Upload options for the rules. An upload-time run starts only for a valid file that isn’t a duplicate (password-protected Office files are skipped), and is skipped if the file already has a live run. Read the result with GET /v1/forensics/files/{file_id}, which returns the newest run for the file. If you later start another run with POST /v1/forensics, that run becomes the newest.

What it checks

19 checks, grouped by what they catch:

Group	Checks
Editing	Cloned regions, revision history, different producers across pages
AI generation	AI-generated images, PDFs and Office files (a text check is listed but not yet active)
Reuse	Exact duplicates, appearance on the web
File structure	File signature, polyglot files, trailing data, entropy, active content, attachments, encryption
Provenance	Content credentials (C2PA), digital signatures, creation tools

Each check reports none, issue, skip or error. See Detectors for every key and what it returns.

How the checks add up

All checks start together. A run starts every requested check on the file at the same time, and results appear as each one finishes.
Each check reports on its own. There is no single overall score: a run can be complete and still contain an issue.
Your code makes the call. Most teams route a file to review when any check reports issue, and treat skip (the check doesn’t apply to this file type) as neutral. For a set of related files, such as a claim pack, combine the results across files; see Insurance claim evidence pack.

How usage is counted

fileForensics is metered at one unit per completed run started at upload, whatever the number of checks. Runs that end in error, fail or are cancelled are not charged. For plans and prices, see Billing.

Next steps

Run a check

Check a stored file and read the verdict in five minutes.

KYC example

Choose checks per file and route on the result.

Detectors and results

Every check, status and error.

Run it from your assistant

The MCP server’s fileForensics tools.

Get started

Products

Build

Go live

Two ways to run it

At upload

On a stored file

What it checks

How the checks add up

How usage is counted

Next steps

Run a check

KYC example

Detectors and results

Run it from your assistant

​Two ways to run it

At upload

On a stored file

​What it checks

​How the checks add up

​How usage is counted

​Next steps

Run a check

KYC example

Detectors and results

Run it from your assistant

Two ways to run it

What it checks

How the checks add up

How usage is counted

Next steps