fileForensics runs 55 checks on the original file for signs of editing, AI generation, reuse and hidden content, and reports each result. Use it on ID scans, bank statements, claim evidence and any file where a forgery costs money.

photo_4.jpg$0.05 per run

→ 4 of 55 checks · 1 flagged, so send the file to review

​
Start here

Quickstart

Check a stored file and read the result in five minutes.

Try the Sandbox

See every check on the Developer Portal, with no code.

API reference

Start, poll, retry and delete runs.

​
How it works

1

Start a run

At upload, or later on a stored file. See Turn it on.
2

All checks start together

Every requested check runs on the original file at the same time, and results appear as each one finishes.
3

Each check reports on its own

There is no overall score, so a complete run can still contain an issue.
4

Your code makes the call

Most teams send a file to review on any issue, and treat skip (the check doesn’t apply to this file) as neutral. For related files, such as a claim pack, combine the results; see Insurance claim evidence pack.

​
What’s included

55 checks in three layers: The 20 forensic checks, grouped by what they catch: Each forensic check reports one of these statuses: Each integrity question answers signal, no_signal or insufficient_evidence, and an overall decision combines them. A signal is something to look at, not a fraud verdict. When the integrity questions aren’t enabled, document_integrity_decisions reports skip with a note that it is disabled. See Checks & results for every key.

​
Turn it on

At upload

Add FILE_FORENSICS to enabledProducts on POST /v1/files/upload. All 55 checks run once the file is stored.Use it alone with storageOnly: true, or with FILE_SCOUT to extract and check the same file.

On a stored file

Call POST /v1/forensics with the file’s file_id and the forensic checks you want in spec_filter, then poll the run. The 18 file checks come with every run that includes a forensic check.Use it to check files you uploaded earlier, or to run only some checks.
At upload, fileForensics only
Here FILEAI_BASE_URL is https://api.orion.file.ai/prod/v1, or your regional host. enabledProducts works only on the single upload route and needs a workspace enabled for these products; see Upload options. An upload-time run starts only for a valid file that isn’t a duplicate and has no live run. Password-protected Office files are skipped. Read the result with GET /v1/forensics/files/{file_id}, which returns the file’s newest run. A later POST /v1/forensics run becomes the newest for the file.

​
Pricing

fileForensics costs $0.05 per completed run, whatever the number of checks. A run started at upload is charged once it completes; runs that end in error, fail or are cancelled aren’t charged. See Billing.

​
Next steps

Checks & results

Every check, status and error.

Claim evidence pack example

Nine files checked at once, turned into one decision.

KYC checks

Choose checks per file and route on the result.

Run it from your assistant

The MCP server’s fileForensics tools.