Provenance Lens
API
Planned HTTP API for programmatic provenance scanning. Review the report schema now and join the waitlist for API access.
For developers
Install the local scanner. It runs offline, reads the same signals as the hosted version, and emits the same JSON report schema.
Evidence, not guessing
Provenance Lens reports only what can be checked: a cryptographically signed manifest, a metadata field, a specific codepoint, a documented provider mechanism. When a signal cannot be checked, it says so. It never converts silence into a verdict.
What a report cannot prove
- A valid signature proves who signed a manifest, not that the manifest's claims are true.
- Metadata is trivially editable. Treat generator fields as an indication, never as proof.
- Hidden Unicode characters have many innocent causes, including ordinary copy-paste.