Changelog

All notable changes to the Audact Platform API are documented in this file.

[Unreleased]

⚠️ Breaking — C2PA manifests are now really signed (generator 2.0.0)

• Removed C2PAManifest.signature (the HMAC hex). The manifest is now a real C2PA 2.x content credential: a .c2pa JUMBF manifest store whose claim is signed ES256 (COSE, ECDSA P-256) with an X.509 certificate chain, hard-bound (c2pa.hash.data) to the call recording, or — when there is no recording — to the call's signed Article 50 JSON export. signature_algorithm is "ES256". Anything that read .signature must download the manifest store and asset and verify them with c2patool <asset> --external-manifest <file>.c2pa.

• New fields on the POST /v1/calls/{call_id}/c2pa summary: manifest_id; asset (kind recording|evidence_export, media_type, sha256, url); manifest_store (media_type application/c2pa, sha256, url); signing_credential (subject, issuer, serial, not_before, not_after, fingerprint_sha256, trust self_signed|ca_issued). The url fields are relative API paths that need the same Bearer token — they are not presigned URLs. assertions gains c2pa.hash.data after com.audact.compliance and c2pa.actions.

• New endpoints:

  • GET /v1/calls/{call_id}/c2pa — list a call's manifests, newest first (listC2PAManifests). Items are a subset of the POST summary (no claim/assertions; signer fingerprint/trust only).
  • GET /v1/calls/{call_id}/c2pa/{manifest_id}/manifest.c2pa — the stored manifest store, streamed 200 application/c2pa (getC2PAManifestStore).
  • GET /v1/calls/{call_id}/c2pa/{manifest_id}/asset — the bound asset (getC2PAAsset): evidence_export assets are streamed 200; recording assets answer 302 to a presigned S3 URL valid 15 minutes (fetch it without the Authorization header). A recording deleted since issuance is 410 c2pa_artefact_gone.
  • GET /v1/c2pa/trust-anchor — public; the self-signed root at the top of the current signing chain (Audact's root while self-signed, the CA's root after a CA chain is imported) (getC2PATrustAnchor).

• POST /v1/calls/{call_id}/c2pa issues a new credential on every call and appends a C2PA_MANIFEST_ISSUED event to the call's (append-only) evidence chain. Send an Idempotency-Key header so retries replay the original response.

• Errors: 503 c2pa_signing_unavailable (no signing credential — there is no fallback), 503 c2pa_storage_unavailable, 404 for an unknown or another tenant's call/manifest (identical), 410 c2pa_artefact_gone, 400 for a malformed list cursor.

• Sidecar, not embedded: the .c2pa store is stored next to the asset in S3 and downloaded separately. Issuance is not on the Validator path.

• Verification: download asset + .c2pa, then c2patool <asset> --external-manifest <file>.c2pa, optionally followed by trust --trust_anchors <pem> with the PEM from GET /v1/c2pa/trust-anchor. Verification needs no API access after download.

• Validity tied to the signer certificate: RFC 3161 timestamps are not yet included, so a manifest verifies only while its signer certificate is valid. There is no revocation mechanism (no CRL/OCSP) in this release.