Origin check

Check without telling us what you asked

The same registry, queried k-anonymously — for a marketplace that would rather not send us the content hashes of what its users upload.

Send the first 5 characters of a hash, get back every fingerprint we hold that starts with them, and match the rest locally.

Hashes are computed exactly as for the lookup endpoint, and the same caveat applies: a hit is definitive, a miss is not a negative. See the Origin check guide.

GET/origin/range/{prefix}

Path parameters

prefixstringrequired

The first characters of a canonical content hash, lowercase hexadecimal.

Response · 200

Every fingerprint sharing that prefix.

prefixstringrequired

The prefix, lowercased.

suffixesarray of objectrequired

The remainder of each matching hash. Concatenate the prefix to compare.

suffixstringrequired

The hash with the prefix removed.

formstringrequired

Which canonicalisation produced it.

Options: png, json, bytes

kindstringrequired

What sort of asset it was.

Options: texture, model, font, sound

firstSeenstringrequired

ISO 8601.

Error codes

Branch on error.code, never on the message.

invalid_request400

Something in the body or query is wrong. message says what.

rate_limited429

Too many requests. message says how long to wait; see Rate limits.