Verify any FairAudit output yourself

What the mark is

A small JSON object attached to each output: who generated it, with which model, when, and a SHA-256 fingerprint of the exact content. All of it is signed with Ed25519. This is the detectability the EU AI Act asks for under Article 50(2), applied to ourselves. Article 50(2) applies from 2 August 2026 to systems placed on the market from that date, and from 2 December 2026 to systems already on the market.

Chat answers carry the mark on the response. JSON, CSV and Markdown exports embed it. PDF reports carry it in their XMP metadata, together with the exact source text it signs.

Two ways to verify

Ask the public endpoint

No tools needed. Send the marking and the exact content it marks:

POST https://fairaudit-api.fly.dev/api/marking/verify
Content-Type: application/json
{ "marking": <the marking object>, "content": "<the exact text it marks>" }

The answer is { "verified": true, "detail": "ok" } if the output is genuine. Otherwise it is false with a reason: sha_mismatch, bad_signature, unsigned or malformed.

Recompute it yourself

1. content_sha256 must equal the SHA-256 of the exact content.
2. Rebuild the signed payload: the marking without the fields signed, signature, reason and key_id, serialised as canonical JSON (keys sorted, separators (",", ":"), UTF-8, no extra whitespace).
3. Verify the base64 signature over those bytes with the public key.

A changed model name, timestamp or character of content breaks step 1 or step 3. Every field of the declaration is inside the signature, so nothing can be relabelled.

The public key

The key is served live, so it stays current if we rotate it: https://fairaudit-api.fly.dev/api/marking/public-key. The verify tool shows the same key and cross-checks the two. Each marking names the key that signed it, and old keys stay published so old marks stay verifiable.

Limits, stated

• A marking with signed: false still declares the output as AI-generated. Only the cryptographic proof is missing.
• Free-form text copied out of a marked answer cannot carry the mark. That is a property of text, not a gap we are hiding.
• A valid mark tells you the text came from FairAudit and was not altered. It does not tell you the text is right. For that, read the article it cites.