API quickstart

One endpoint, one JSON report. Key to first call in about a minute.

POST /api/v1/inspect takes a document or an image and returns structural fraud-risk signals as JSON. Everything else (auth behaviours, /compare, issuer baselines, the report schema, error codes and limits) is in the API reference.

1. Get a key, or skip it

Drop the Authorization line below and it still works. Create an account: email and password, no card. Free key immediately, 50 documents a month, shown once. 

curl -s https://tamperlens.com/api/v1/auth/signup \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"a-long-enough-password"}'

# -> {"user":{…},"apiKey":{"plaintext":"tl_…","plan":"free","quota":50}}

2. Inspect a document

curl -s https://tamperlens.com/api/v1/inspect \
  -H "Authorization: Bearer tl_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -F [email protected]

PDFs, Office documents and images, up to 10 MB. A raw body works instead of multipart, and the key is optional, without one you are rate limited by IP rather than metered.

3. Read the report

{
  "summary": { "riskScore": 95, "riskBand": "high", "signalCount": 2 },
  "signals": [
    { "id": "incremental-updates", "severity": "high", "title": "…", "evidence": {…} }
  ]
}
  • summary.riskBand is the routing decision: low under 30, elevated 30-69, high 70 and up. high is reserved for reports carrying a high-severity signal, so weak findings cannot pile up into it.
  • signals[].id and severity, stable family ids. Branch on these when one family matters more to your flow than the single score does.
  • signals[].evidence: store it. Small, no document content, and it is what a human reviewer needs.

Tamperlens reports risk signals, not authenticity verdicts. Signals can have benign causes; combine them with your own decision logic.

Next

  • API reference Auth behaviours, request forms, /compare, issuer baselines, verdict policy, the annotated report, error codes, limits.
  • For agents (MCP) Screen the document before your agent reads it: three MCP tools, and the injection surface we classify.
  • OpenAPI reference Machine-readable spec and a try-it-out console for every endpoint.
  • Fraud signals field guide Every signal family, its evidence keys, its benign causes, its severity rules.
  • Pricing Plans, quotas and what counts as one document.