C2PA and CAWG validation status codes
When a C2PA verifier reports a status code, this is what it means. These 13 codes are the stable strings Encypher's open-source verification tools emit. Each links to a page with the full explanation and, where a failure implies one, what to do next.
These codes are the machine-readable form of the system provenance data that the California AI Transparency Act requires a covered provider's detection tool to output.
Failure codes
The check failed. These codes mean the manifest is altered, untrusted, revoked, or absent, and needs action.
- claimSignature.mismatchThe active claim signature does not verify.
- assertion.hashedURI.mismatchA referenced assertion changed or is not the referenced bytes.
- assertion.dataHash.mismatchThe asset bytes do not match the signed data-hash assertion.
- assertion.bmffHash.mismatchThe BMFF boxes do not match the signed box-hash assertion.
- signingCredential.untrustedThe signer does not chain to caller-supplied trust material.
- signingCredential.ocsp.revokedSupplied revocation evidence marks the signer as revoked.
- claim.missingNo readable active C2PA claim is present.
- ingredient.manifest.missingAn ingredient points to a manifest absent from the store.
Success codes
The check passed. These codes confirm a signature, hash, or trust relationship held.
- claimSignature.validatedThe active claim signature is cryptographically valid.
- assertion.hashedURI.matchA claim reference matches the exact assertion bytes.
- assertion.dataHash.matchThe asset bytes match the signed data-hash assertion.
- assertion.bmffHash.matchThe BMFF boxes match the signed box-hash assertion.
- signingCredential.trustedThe signer chains to caller-supplied trust material.