Verify Document Authenticity with Forensic Analysis

This skill inspects a document for forensic authenticity signals - not a fraud verdict, but a risk band with the evidence behind it - using the Stipple API.

Use it before onboarding a tenant, contractor, or employee from uploaded documents; before paying an invoice that arrived by email; before relying on a bank statement, payslip, or certificate in any workflow; or when reviewing documents in due diligence, claims processing, or loan applications. A low-risk result is not proof of authenticity, and a high-risk result is not proof of fraud - preserve the original bytes and use authoritative issuer verification plus a qualified human reviewer before payment, onboarding, lending, employment, disciplinary, compliance, or legal action.

Input is a document by URL or local file path (PDF, PNG, JPEG, BMP, TIFF). The cache can be checked first by SHA-256, for free:

curl "https://www.stipple.sh/v1/warrants/check?sha256=<hash>"

Verification itself runs as:

curl -X POST https://www.stipple.sh/v1/warrants \
  -F "file=@payslip.pdf" \
  -H "Authorization: Bearer $STIPPLE_API_KEY"

?fresh=true forces re-inspection of a cached document, and ?deep=true runs a more thorough inspection at a higher credit cost. Output carries two independent axes: risk_band (low, medium, or high - does anything look tampered) and inspection_quality (thorough, limited, or poor - could the engine actually see enough to judge). A clean phone photo of a genuine payslip is commonly low risk plus limited quality at once - low coverage is not the same thing as risk. Per-signal evidence covers things like amount/words mismatches, font discontinuity in values, date anomalies, document label integrity, identifier checksums such as ABN, ACN, or TFN, and table arithmetic, each reported as pass, fail, or skipped when a particular signal simply doesn't apply to that document type.

The Stipple API performs the inspection, and identical files are cached by content hash so re-checking the same bytes returns instantly and for free. It pairs with check-identity-pack for a 100-point identity check on identity documents, and with extract-document-data for pulling structured values out once authenticity has already been assessed.

Teams onboarding people, paying invoices, or relying on uploaded documents in a workflow who need a forensic risk signal with the specific evidence behind it, rather than a bare pass or fail with no explanation of what was actually checked and what could not be seen.