---
title: "Get one photo from your registry, with its receipts"
method: GET
path: "/v2/photos/{sha256}"
tags: ["Registry"]
---

# Get one photo from your registry, with its receipts

`GET /v2/photos/{sha256}`

## Request

- Base URL: `https://api.phototology.com`
- URL: `https://api.phototology.com/v2/photos/{sha256}`
- Auth: HTTP bearer

Returns this account's registry record for one photo by SHA-256: the lens projection, the stored signed receipts (newest first, at most 10), the `credentials` report, `firstSeenAt` (the moment we first analyzed it on this account) and `lastAnalyzedAt`. Free, no credits charged.

Every receipt names this URL in `payload.registry.url`. A valid signature proves we issued a receipt; this endpoint, called with the API key of the account the receipt was issued to (Bearer required), says whether we kept the analysis. A photo never analyzed on this account returns `404 PHOTO_NOT_IN_REGISTRY`.

`credentials` is the Content Credentials report stored when this photo was analyzed (without the raw manifest), or, when nothing was read, the full `unread` report: `status: "unread"`, `aiGenerated`, `signer`, `captureDevice`, `signedAt` and `trustList` null, `assertions` empty. Every report carries the same `note`: missing credentials mean no provenance was attached, not that the image is fake.

## Path parameters

- `sha256` string, required: SHA-256 of the image bytes, 64 hex characters.

## Response `200`

The photo record, its receipts and its credentials report.

- object
  - `object` 'photo', required
  - `photo` object, required
    - `sha256` string, required
    - `pHash` string, required
    - `dHash` string, required
    - `firstAnalyzedAt` string, required
    - `lastAnalyzedAt` string, required
    - `totalCreditsSpent` integer, required
    - `analyzeCallCount` integer, required
    - `lenses` object, required
    - `pixelsSha256` string
    - `pdq` object
      - `hash` string, required
      - `quality` integer, required
      - `variants` string[], required
    - `iscc` string
  - `receipts` object[], required
    - `payload` object, required
      - `type` 'phototology.receipt', required
      - `version` 1, required
      - `id` string, required
      - `livemode` boolean, required
      - `issuer` 'https://phototology.com', required
      - `keyId` string, required
      - `subject` object, required
        - `bytesSha256` string, required
        - `pixelsSha256` string
        - `pHash` string, required
        - `dHash` string, required
        - `pdq` object
          - `hash` string, required
          - `quality` number, required
        - `iscc` string
      - `analysis` object, required
        - `requestId` string, required
        - `lenses` object[], required
          - `id` string, required
          - `version` string, required
          - `outputSha256` string, required
        - `provider` string, required
        - `model` string, nullable, required
        - `modelVersion` string, nullable, required
        - `outputSha256` string, required
        - `analyzedAt` string, required
      - `firstSeenAt` string, required
      - `credentials` object, required
        - `status` string, required
      - `registry` object, required
        - `url` string, required
    - `signature` string, required
    - `timestamp` object, required
      - `status` 'ok' | 'pending' | 'unavailable', required
      - `tsa` string
      - `token` string
      - `time` string
  - `credentials` object, required
    - `status` 'none' | 'invalid' | 'valid' | 'trusted' | 'unread', required
    - `aiGenerated` boolean, nullable, required
    - `signer` object, nullable, required
      - `name` string, required
      - `issuer` string, required
    - `captureDevice` string, nullable, required
    - `signedAt` string, nullable, required
    - `trustList` 'c2pa' | 'legacy', nullable, required
    - `assertions` string[], required
    - `note` string, required
  - `firstSeenAt` string, required
  - `lastAnalyzedAt` string, required

## Other responses

- `400`: The path is not a 64-character hex SHA-256.
- `401`: Missing or invalid API key, or a key with no account.
- `404`: `PHOTO_NOT_IN_REGISTRY`: this account has never analyzed the photo.

---

[API](https://skmtc.dev/phototology/apis/phototology-api.md) · [All operations](https://skmtc.dev/phototology/apis/phototology-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phototology/apis/phototology-api/revisions/3cb0fc707b63?raw)