Photo verification API
Verify and certify photos at the moment of capture. One call creates a request, your user takes the photo in their phone browser, and you read a verdict.
By Tiago Palladino, Rial · Updated October 2026A verdict on every photo
Most photo checks happen after the fact: a file arrives, and a model guesses whether it was edited. The Rial API works the other way around. You create a verification, the person takes the photo through Rial, and each photo is checked as it is taken: the device, the location and time, signs of AI generation, and whether the camera is pointed at a screen.
What comes back is a verdict you can branch on, the checks that tripped, and a C2PA credential on the photo.
Two calls to your first verdict
Create an API key in the dashboard (Settings, API). Create a verification and send the capture_url to the person. No app and no account: it opens in their phone browser.
curl https://api.rial.io/v1/verifications \
-H "Authorization: Bearer $RIAL_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "max_captures": 1 }'
{ "id": "vfy_01H...", "capture_url": "https://verify.rial.io/v/...", "status": "pending" }curl https://api.rial.io/v1/verifications/vfy_01H... \
-H "Authorization: Bearer $RIAL_API_KEY"
{
"status": "completed",
"verdict": { "rial": true, "signals": [] }
}Branch on rial. When it is false, signals says why: screen_detected, ai_detected or found_online. Pass a webhook_url when you create the verification and Rial posts verification.completed to you instead of you polling.
import { createRial } from '@rial/sdk';
const rial = createRial({ apiKey: process.env.RIAL_API_KEY });
const verification = await rial.verifications.create({
steps: [
{
key: 'front',
label: 'Front',
type: 'image',
description: 'Please take a photo of the front of your car',
expectedObject: '2021 Toyota Corolla',
},
],
metadata: { claimId: 'CLM-9912' },
});
// send verification.captureUrl to the customer, then:
const result = await rial.verifications.waitFor(verification.id);
if (result.verdict?.rial) approve(result);
else review(result, result.verdict?.signals); // e.g. ['screen_detected']What a photo of a screen returns
We pointed a phone at a screen that showed a photo of an air conditioner and took the picture through a Rial link. The object was right, so the object check matched. The photo was still a photo of a screen, and the API said so:
{
"status": "completed",
"verdict": { "rial": false, "signals": ["screen_detected"] },
"object_match": { "status": "match" }
}This is the case detection tools miss most often: the file is a genuine camera capture, with fresh metadata. Only a check at capture time can tell that the camera was looking at a screen.
What is checked, and how to ask for more
Always, on every photo
Is this a photo of a screen? Does it look AI-generated? Reported as screen_detected and ai_detected.
When you describe the photo
Send expected_object or context and Rial checks the photo shows it. Reported as object_match.
When you ask for condition
Send condition_aspects, such as paint or bumper, and each one is scored from 0 to 10 with a one-line reason.
When you send a place
Send expected_location and Rial checks the photo was taken there, with the distance in meters.
Link, SDK or CLI
Capture link
Opens in any phone browser with nothing to install. Carries device attestation and a C2PA credential. Valid for one week by default, adjustable per request.
iOS and Android SDKs
Capture inside your own app. They sign each photo with the phone’s secure hardware, work offline and resume if the app is killed. Access within 24 hours of a request to developers@rial.io.
Templates
Publish a set of steps once and get a permanent link, or mint a single-use link per customer from it.
CLI
Create templates and verifications from your terminal with the rial CLI.
Use it from an agent
Rial runs an MCP server at mcp.rial.io, listed in the official MCP registry as io.rial/mcp. Connect it and an agent can build templates, send links and read verdicts in plain language. Agents can also buy photo credits on their own, under a monthly cap.
{
"mcpServers": {
"rial": {
"type": "http",
"url": "https://mcp.rial.io/mcp",
"headers": { "Authorization": "Bearer rk_secret_..." }
}
}
}Pay per photo
The first 5 photos are free. After that, packs of 50, 250 or 1000 photos cost US$10, US$50 or US$200. That is US$0.20 per photo, with no monthly minimum and no sales call.
Capture verification, detection and KYC
| Approach | What it answers | What it cannot answer |
|---|---|---|
| Identity verification (KYC) | Does this face match this ID? | Whether a photo of a car or a house is real |
| Detection after upload | How likely is this file to be AI-generated? | Where and when the photo was taken |
| Capture verification | Was this photo taken live, here and now, of a real scene? | Anything about photos taken outside the flow |
Common questions
Is a photo verification API the same as identity verification (KYC)?
No. Identity verification checks that a face matches an ID document. A photo verification API checks the photo itself: that it was taken live, on a real device, at a place and time, and that it is not a photo of a screen or an AI-generated image.
Can someone fool it with a photo of a screen?
Every photo is checked for recapture. A photo of a screen comes back with rial: false and the signal screen_detected, as in the real response on this page.
Does the user have to install an app?
No. The capture_url opens in the phone browser. The iOS and Android SDKs are for capture inside your own app, and add a signature from the phone’s secure hardware.
Does Rial produce C2PA Content Credentials?
Yes. Every live capture comes with a C2PA credential that compatible viewers can read.
How much does it cost, and is there a free trial?
The first 5 photos are free. After that, packs of 50, 250 or 1000 photos cost US$10, US$50 or US$200, which is US$0.20 per photo, with no monthly minimum.
Can I check photos I already have?
Yes, with an audit. It reports signs of AI generation and whether the image is already online. It cannot prove where or when the photo was taken, so it returns signals, not a certified verdict.