AI provenance verification

LeadPass attaches a signed leadpass.ai-provenance.v1 envelope to AI-generated artifacts. You can check one envelope against the exact JSON content it describes with the stateless verification endpoint:

POST /legal/ai-provenance/verify
Content-Type: application/json
Accept: application/json

{
  "envelope": "eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsLi4u",
  "content_json": "{\"summary\":\"The exact original artifact\"}"
}

envelope is the unpadded base64url value from LeadPass's data-ai-provenance metadata. content_json is a string containing the exact artifact as valid JSON; object key order does not matter, but array order, values and types do. The endpoint accepts at most 4 KiB of envelope and 128 KiB of content JSON. Extra request fields are rejected.

A valid response contains only the result and non-content metadata:

{
  "valid": true,
  "scheme": "leadpass.ai-provenance.v1",
  "generated": true,
  "artifact_type": "qualification_report",
  "generated_at": "2026-07-16T10:00:00.000000Z",
  "content_sha256": "8e3a0a1204f1a893be89ee7c3c4249d46284801dcf37e51776c66f85a99814a2"
}

An invalid or altered pair returns "valid": false. The endpoint does not echo the submitted envelope or content and does not write either value to LeadPass's application database, logs or session. Responses carry Cache-Control: no-store; abuse control keeps only a short-lived rate-limit counter derived from a one-way representation of the source IP.

Scope of this proof

This check proves only that LeadPass signed that exact JSON artifact with a LeadPass key and that the signed fields have not changed. It is not a general detector for arbitrary text, a C2PA or IPTC credential, an interoperable watermark, or by itself complete compliance with EU AI Act Article 50. A missing or invalid envelope does not prove that content was or was not generated by AI.