Verify Document Authenticity with Forensic Analysis

Document Authenticity Signals inspects PDFs and images for evidence of tampering or forgery through the Stipple API. The result is a risk band supported by signals, rather than a fraud determination. The skill keeps forensic risk separate from how thoroughly the document could be inspected, so a low-coverage image does not automatically become a high-risk document. It is Apache-2.0 licensed.

Checks can examine agreement between amounts written in words and figures, font discontinuities around values, date anomalies, document-label integrity, identifier checksums, and table arithmetic. Recognized payslips, invoices, and bank statements receive type-specific checks. Unrecognized document types receive generic checks, and the report should make that distinction clear.

Use the workflow before relying on documents during tenant, contractor, or employee onboarding, invoice payment, due diligence, claims processing, or loan applications. It accepts a document URL or local file path in PDF, PNG, JPEG, BMP, or TIFF form.

Uploading sends the document to a hosted third party. Obtain explicit approval, minimize personal and confidential material, and confirm current retention, residency, access, and deletion terms first. Preserve the original bytes so the evidence and any later verification refer to the same file.

A low-risk result does not prove authenticity, and a high-risk result does not prove fraud. Sophisticated tampering can be missed; harmless editing, scanning, compression, or templates can trigger signals. Before payment, onboarding, lending, employment, disciplinary, compliance, or legal decisions, combine authoritative issuer verification with a qualified human reviewer. This workflow measures forensic integrity rather than authorship style.

The document is the primary input. If its SHA-256 is available, an optional cache check determines whether the same bytes have already been inspected:

curl "https://www.stipple.sh/v1/warrants/check?sha256=<hash>"

Verification submits the file to the warrants endpoint. A fresh inspection can be forced with fresh=true; deep=true requests a more thorough inspection using more credits. Identical files are cached by content hash and can return a previous inspection without another full analysis.

The response includes risk_band values of low, medium, or high and inspection_quality values of thorough, limited, or poor. Read both independently. A clean phone photograph can have low risk and limited quality: limited coverage concerns visibility, not a finding of fraud. Show per-signal evidence for flags and distinguish passed checks from skipped checks. The output also includes a recommended action such as review before action.

Stipple provides an anonymous tier with a shared weekly allowance and a free-key option. Authenticated submissions use the provider's bearer-key mechanism. For identity documents, the workflow pairs integrity inspection with a separate identity-check endpoint. For extracting document fields, it points to the extract-document-data skill. Authorship-style questions require the separate text-detection workflow instead of document forensics.