Skip to main content
GET
Get file analysis details
Retrieve comprehensive analysis results for a specific file, including signed download URLs for the original file, thumbnail, PDF analysis report, and detailed logs.

Permission

You can get the analysis of a file you uploaded, or of any file in your organisation if you have organisation_files:read; otherwise the API returns 404. Shared cases, if enabled for your organisation, also give you reach to every case and file. See Permissions and API Keys.

Analysis Engines

The Veridox platform runs multiple analysis engines to provide a complete forensic view:
  • Context Analysis: Extracts metadata and classifies the document type.
  • Image Metadata: Analyses EXIF/JFIF data for indicators of tampering or source verification.
  • Tampering Detection: Uses advanced computer vision to identify pixel-level anomalies and digital edits.
  • AI Summary: Provides a high-level, human-readable summary of the combined findings.

Highlights

The highlights field contains a plain list of key findings summarising the most significant indicators from the analysis. It is omitted from the response when the analysis did not produce any highlights.

Module Evidence

Each entry in analysis_results.modules reports its findings together with the evidence supporting them:
  • findings — structured findings, each with an alert_type, a severity (Informational, Low, Medium, or High), a description, a severity_justification, an evidence list, and evidence_refs.
  • search_evidence (object or null) — the search and grounding queries run for the module, with their results and any failures.
  • verification_evidence (object or null) — checks run against an authoritative registry or API for the module.
A finding’s evidence_refs are IDs that resolve back into that module’s own evidence: q1.1 matches a result_id in search_evidence.results, and v1 matches a check_id in verification_evidence.checks. full_analysis.search_evidence_summary and full_analysis.verification_evidence_summary roll the same evidence up across modules, keyed by module_id.

Verification Evidence

Verification checks run only when your organisation’s verification setting is on for that analysis. An analysis run with the setting off has no checks: each module’s verification_evidence is null or has an empty checks list, full_analysis.verification_evidence_summary is null, and no finding carries a v reference. Search evidence is unaffected. A result keeps the evidence it was produced with after the setting changes, so read each result’s evidence fields rather than inferring them from the current setting. Findings under results carry no evidence_refs of their own. See Tracing a finding back to its evidence for how to get from one to its sources, and for the cases where that lookup does not resolve.
On an analysis from the current engine these keys are always present, though search_evidence_summary, verification_evidence_summary and a query’s answer may each be null. An analysis produced by an earlier version of the engine has both summaries set to null and an empty modules_run, and carries no analysis_results.modules array, so check for that array before reading it.

Best Practices

  1. URL Expiration: Download URLs for assets (original file, PDF report, logs) are time-limited for security. Ensure you download or display them promptly after retrieval.
  2. Wait for Completion: This endpoint provides the most value after a file’s analysis_status has reached settled.
  3. Security: Never expose the signed download URLs in client-side code or public environments.

Authorizations

x-api-key
string
header
required

Path Parameters

fileId
string
required

File ID

Response

File analysis retrieved successfully

file_id
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
case_id
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
label
string | null
required
mime_type
string | null
required
file_download_url
string<uri> | null
required
file_download_url_expires_at
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
thumbnail_url
string<uri> | null
required
pdf_report_url
string<uri> | null
required
log_output_url
string<uri> | null
required
ela_overlay_url
string<uri> | null
required
reverse_search
object | null
required
file_info
object | null
required
analysis_status
enum<string>
required
Available options:
waiting_for_upload,
processing,
triaged,
settled
analysis_outcome
enum<string> | null
required
Available options:
success,
failed,
triage_expired
current_analysis_phase
string | null
required
current_risk_score
string | null
required
analysis_results
object | null
required
case_context_at_analysis
string | null
required
user_risk_confirmations
object[]
required
created_at
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
uploaded_at
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
analysis_completed_at
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
highlights
string[]
caveats
object[]
team_id
string<uuid>
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
team_name
string