Remote Manifests

While manifests are typically embedded directly within an asset, the C2PA specification allows for them to be hosted externally and linked from the asset's metadata. This is known as a remote manifest store.

Why use remote manifests?

• Large Manifests: Can offload very large or complex provenance histories from the asset itself.
• Dynamic Updates: Allows for certain types of updates without modifying the original asset file (though this is an advanced and rare use case).

By default, the QueCloud API does not attempt to fetch remote manifests for security and performance reasons. You must explicitly enable this behavior on a per-request basis.

Enabling Remote Manifest Fetching

To allow the verifier to fetch remote manifests, set allow_remote_manifests to true in your /v1/verify request body.

{
  "asset": {
    "bucket": "your-bucket",
    "key": "asset-with-remote-manifest.jpg"
  },
  "allow_remote_manifests": true
}

Security Considerations

• allow_insecure_remote_http: By default, the service will only fetch manifests from secure https URLs. If you must fetch from an insecure http URL, you can set allow_insecure_remote_http to true, but this is strongly discouraged as it exposes the process to man-in-the-middle attacks.