> ## Documentation Index
> Fetch the complete documentation index at: https://docs.watchdoc.sphinxhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Flag reference

> The closed set of flag codes v1 can emit.

Codes are a public API contract: never rename one; only add. Removing a code is a breaking
change.

Fetch the live catalogue with `GET /api/v1/document-checks/flags/`.

<Note>
  Each flag on a result carries a `reasons` array holding the individual observations that
  produced it. Flag codes are closed and stable. Branch on them. Reason codes are an open set
  that grows as detectors improve. Read them; don't switch on them. See
  [Result model](/result-model#flags-and-reasons).
</Note>

The descriptions below are the general definition of each code. The reasons on an actual result
describe what was found on that specific document.

## Provenance: what tool made or touched this file?

| Code                          | Severity | Title                                |
| ----------------------------- | -------- | ------------------------------------ |
| `ai_generated_metadata`       | `high`   | Generated by an AI tool              |
| `ai_generated_embedded_image` | `high`   | Contains an AI-generated page image  |
| `photoshop_artifact`          | `high`   | Saved by Adobe Photoshop             |
| `editing_software_detected`   | `medium` | Touched by document editing software |
| `metadata_scrubbed`           | `medium` | Editing traces removed               |

### `ai_generated_metadata`

The file carries provenance metadata identifying it as the output of a generative AI model. Authentic documents issued by a bank, utility, or employer never carry these markers.

### `ai_generated_embedded_image`

A full-page image inside this document carries AI provenance metadata. The document is a wrapper around a generated image rather than an issued file.

### `photoshop_artifact`

The file structure contains the Photoshop-private save marker, meaning the image was opened and re-saved in Photoshop rather than delivered as issued.

### `editing_software_detected`

The revision history names a tool commonly used to alter existing PDFs. Some legitimate workflows (form filling, e-signing) also leave these traces, so this is corroborating evidence rather than proof on its own.

### `metadata_scrubbed`

The document was rebuilt but carries no modification date and no tool signature. Standard enterprise processing always leaves a signature; its absence is consistent with a tool that deliberately erases its traces.

## Structure: what does the file history say happened?

| Code                   | Severity | Title                                          |
| ---------------------- | -------- | ---------------------------------------------- |
| `document_rebuilt`     | `medium` | Rebuilt after original creation                |
| `incremental_edit`     | `medium` | Content changed after the document was created |
| `empty_shell_revision` | `high`   | Text added to an empty template                |

### `document_rebuilt`

The file's internal structure shows it was taken apart and written back out by an editing or processing tool, rather than saved once by its issuer.

### `incremental_edit`

The PDF contains more than one saved revision, meaning content was added or changed after the original was written. The evidence records how many revisions exist and when they were made.

### `empty_shell_revision`

The document's first revision contained no text; everything visible was added in a later edit. This is the signature of filling in a blank template rather than receiving an issued document.

## Content: do the printed values hang together?

| Code                    | Severity | Title                                             |
| ----------------------- | -------- | ------------------------------------------------- |
| `font_inconsistency`    | `medium` | Text set in an inconsistent font                  |
| `numeric_font_mismatch` | `medium` | Figures set in a different font                   |
| `amount_outlier`        | `low`    | Amount inconsistent with the rest of the document |

### `font_inconsistency`

A small amount of text on the page uses a different font from the rest of the document, the usual result of typing over original content.

### `numeric_font_mismatch`

Numeric values are rendered in a font that differs from the surrounding text, which is what an edited amount, date, or balance typically looks like.

### `amount_outlier`

A monetary value is a statistical outlier against the other figures on the document. Legitimate outliers are common, so this is context for a reviewer.

## Template: does it look like other docs from this issuer?

| Code                 | Severity | Title                                       |
| -------------------- | -------- | ------------------------------------------- |
| `template_deviation` | `medium` | Layout differs from this issuer's documents |

### `template_deviation`

The page layout does not match the known-good reference documents we hold for this issuer. Issuers do redesign their templates, so this corroborates other findings rather than standing alone.

## Visual: does the rendered page show manipulation?

| Code               | Severity | Title                         |
| ------------------ | -------- | ----------------------------- |
| `visual_tampering` | `high`   | Visible signs of manipulation |

### `visual_tampering`

The rendered page shows artifacts of direct image editing: misaligned text, inconsistent background texture, or cloned regions.

## Authenticity: is this a real document at all?

| Code                  | Severity | Title                         |
| --------------------- | -------- | ----------------------------- |
| `fabricated_document` | `high`   | Not a genuine issued document |

### `fabricated_document`

The document does not resemble a real one of its claimed type. It is missing the structure, formatting, and identifying detail that a genuine issuer would include.