Flag reference

Codes are a public API contract: never rename one; only add. Removing a code is a breaking change. Fetch the live catalogue with GET /api/v1/document-checks/flags/. The descriptions below are the general definition of each code. The reasons on an actual result describe what was found on that specific document.

​

Provenance: what tool made or touched this file?

​

ai_generated_metadata

The file carries provenance metadata identifying it as the output of a generative AI model. Authentic documents issued by a bank, utility, or employer never carry these markers.

​

ai_generated_embedded_image

A full-page image inside this document carries AI provenance metadata. The document is a wrapper around a generated image rather than an issued file.

​

photoshop_artifact

The file structure contains the Photoshop-private save marker, meaning the image was opened and re-saved in Photoshop rather than delivered as issued.

​

editing_software_detected

The revision history names a tool commonly used to alter existing PDFs. Some legitimate workflows (form filling, e-signing) also leave these traces, so this is corroborating evidence rather than proof on its own.

​

metadata_scrubbed

The document was rebuilt but carries no modification date and no tool signature. Standard enterprise processing always leaves a signature; its absence is consistent with a tool that deliberately erases its traces.

​

Structure: what does the file history say happened?

​

document_rebuilt

The file’s internal structure shows it was taken apart and written back out by an editing or processing tool, rather than saved once by its issuer.

​

incremental_edit

The PDF contains more than one saved revision, meaning content was added or changed after the original was written. The evidence records how many revisions exist and when they were made.

​

empty_shell_revision

The document’s first revision contained no text; everything visible was added in a later edit. This is the signature of filling in a blank template rather than receiving an issued document.

​

Content: do the printed values hang together?

​

font_inconsistency

A small amount of text on the page uses a different font from the rest of the document, the usual result of typing over original content.

​

numeric_font_mismatch

Numeric values are rendered in a font that differs from the surrounding text, which is what an edited amount, date, or balance typically looks like.

​

amount_outlier

A monetary value is a statistical outlier against the other figures on the document. Legitimate outliers are common, so this is context for a reviewer.

​

Template: does it look like other docs from this issuer?

​

template_deviation

The page layout does not match the known-good reference documents we hold for this issuer. Issuers do redesign their templates, so this corroborates other findings rather than standing alone.

​

Visual: does the rendered page show manipulation?

​

visual_tampering

The rendered page shows artifacts of direct image editing: misaligned text, inconsistent background texture, or cloned regions.

​

Authenticity: is this a real document at all?

​

fabricated_document

The document does not resemble a real one of its claimed type. It is missing the structure, formatting, and identifying detail that a genuine issuer would include.