> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepdub.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Content Credentials (C2PA)

> How Deepdub discloses AI involvement in delivered media, and how to verify it

Deepdub embeds [C2PA](https://c2pa.org) Content Credentials into Managed Dub media
deliverables. A Content Credential is a cryptographically signed manifest carried
inside the file itself, recording that the audio was produced with AI and which
parts of the asset that applies to.

This gives you a machine-readable disclosure you can carry downstream — useful when
a broadcaster, platform, or regulator asks you to evidence how a dubbed asset was
made. Transparency obligations such as the EU AI Act's Article 50 are the usual
reason customers ask for it.

<Note>
  Content Credentials apply to **Managed Dub** deliverables only. Audio returned by the
  TTS REST and WebSocket APIs does not carry them — those formats are streamed and
  often headerless, with nowhere to put a manifest.
</Note>

## Which deliverables carry credentials

| Deliverable                                              | Content Credentials                     |
| -------------------------------------------------------- | --------------------------------------- |
| Dubbed video (`MP4` export)                              | Yes                                     |
| Dubbed audio (`WAV` export)                              | Yes                                     |
| Subtitles and transcripts (SRT, WebVTT, SDH, transcript) | No — text files cannot carry a manifest |
| AAF and WAV-ZIP packages                                 | No                                      |

Signing happens automatically as part of export. There is no request field to turn it
on or off, and it does not change the media itself — only metadata is added.

<Warning>
  Treat credentials as best-effort rather than guaranteed. If signing fails, Deepdub
  delivers the file unsigned rather than failing your job, so a delivered file **may**
  carry credentials but is not certain to. Verify a file rather than assuming.
</Warning>

## What the manifest says

A Deepdub manifest identifies the signer as `Deepdub Provenance Service` and carries
two assertions:

* **`c2pa.actions`** — the standard C2PA disclosure of what happened to the asset.
  The `digitalSourceType` records that the result contains AI-generated media.
* **`com.deepdub.provenance`** — a Deepdub assertion carrying the classification,
  the affected components, and an asset reference.

### Classification

| Value                   | Meaning                                  |
| ----------------------- | ---------------------------------------- |
| `original`              | No AI involvement                        |
| `ai_assisted`           | AI used to enhance human-created content |
| `partially_ai_modified` | Part of the asset is AI generated        |
| `fully_ai_generated`    | The asset is entirely AI generated       |

Dubbing deliverables are classified `partially_ai_modified`: the dialogue audio is
synthesized, while the picture and the rest of the mix are not.

### Components

`components` narrows the classification to the parts of the asset it applies to —
for a dubbed asset typically `audio` and `voice`, plus `video` for an MP4 export.
Other possible values are `transcript`, `subtitles`, `image`, and `lip_region`.

Only stable identifiers go into the embedded manifest. Your account identifiers,
project structure, and the model versions used are **not** written into the file.

## Verifying a file

Upload the delivered file to `POST /provenance/verify`:

```bash theme={null}
curl -X POST https://dubbing.deepdub.app/provenance/verify \
  -H "x-api-key: $DEEPDUB_API_KEY" \
  -F "file=@dubbed-episode-01.mp4"
```

```json theme={null}
{
  "verified": true,
  "provider": "Deepdub",
  "classification": "partially_ai_modified",
  "components": ["audio", "voice"],
  "signature_valid": true,
  "c2pa_present": true,
  "detail": "Valid"
}
```

Read the two booleans together: `c2pa_present` tells you whether the file carried a
manifest, and `verified` whether its signature validated. A file with no credentials
returns `c2pa_present: false` and `detail: "No C2PA manifest found"` rather than an
error, since an unsigned file is a legitimate answer.

The check runs on the bytes you upload, so it works on a renamed or relocated copy.

<Note>
  `watermark_detected` and `watermark_confidence` are reserved for a future signal and
  are always `false` and `null` today. `created_at` is likewise not yet populated.
</Note>

### Verifying with third-party tools

The manifest is standard C2PA, so tools such as
[c2patool](https://github.com/contentauth/c2pa-rs) and
[Content Credentials Verify](https://contentcredentials.org/verify) will read it and
show the assertions correctly.

<Warning>
  Deepdub currently signs with its own certificate, which is not yet on the public C2PA
  trust list. Third-party verifiers therefore read the manifest correctly but report the
  signer as **untrusted**. That reflects trust-list enrollment, not a problem with the
  file. Use `POST /provenance/verify` for an authoritative answer in the meantime.
</Warning>

## Limits

* **Re-encoding strips credentials.** Transcoding, remuxing, or re-rendering a
  delivered file discards the manifest, because the signature covers the original
  bytes. Sign-off workflows should verify the file Deepdub delivered, and re-verify
  any copy that has been through another tool.
* **Managed Dub is served from a single region** (`https://dubbing.deepdub.app`),
  so provenance follows the same footprint.