Documentation
How Wakemark works
The parts that do not change when an endpoint changes: what happens to your provider keys, what happens to your generated bytes, what Wakemark can prove about them afterwards, and what it deliberately does not claim.
What Wakemark is, and what it is not
The control plane for generative media: one API over many providers, with an append-only ledger, byte-exact custody, and provenance. And the things it deliberately is not.
KeysBYOK: your provider keys stay yours
Bring your own provider keys. What envelope encryption means here, what binds a secret to one tenant, and exactly what Wakemark can and cannot see.
StorageCustody: byte-exact storage and what the digest proves
Every stored output is the provider's bytes, unmodified, with a SHA-256 recorded at write time. What that proves, what it does not, and what a sidecar contains.
ProvenanceProvenance and C2PA: four states, no fifth
Wakemark preserves the marks providers embed and reports what it finds in four honest states. Why “not inspected” is an unknown and never renders as a pass.
StorageStorage connectors: platform storage and your own bucket
Generated bytes can land in Wakemark's storage or in your own S3-compatible bucket. What changes when they are yours — and what does not.
LifecycleRetention: what a deadline deletes, and what a tombstone keeps
Two independent scopes, inputs and outputs. What a purge actually removes from the ledger and the projections, and what deliberately survives it.
EU AI ActArticle 50: what the audit export contains
The audit export is a report derived from the ledger. What it contains, what it deliberately does not attest, and why the logging layer is supplementary only.
TrustVerification: checking a record without an account
How a third party checks an asset's digest, model and provenance chain — and what each level of the signal ladder actually establishes.
Live surfaces
These answer questions the prose cannot, because the answers change: what exists right now, and what is healthy right now.
What has shipped and whether it affects you, with the defects behind the corrections.
Model catalogueEvery model Wakemark can route to, with capabilities and the date a real run last verified each one.
Provider integrationsThe providers behind one API, and how cross-provider failover picks the next candidate.
Verify an assetCheck a digest, a model and a provenance chain — the public verifier.
Provider healthCircuit-breaker state per provider and capability, from real traffic rather than synthetic probes.
The WakeLonger engineering writing on how the ledger, custody and provenance are built.
The API reference is not here yet
Not an oversight. The API changed materially in the days before this page shipped — a job metering emitter moved, endpoints were added for the billing portal, feature interest and credential testing, a field was removed from the credentials response, and the audit export gained fields. A reference written by hand today would be wrong within a week, and a wrong reference is worse than a missing one.
openapi.yaml is maintained as the contract and will generate the reference. Until then the two client SDKs mirror it by hand, and the endpoints they call are the endpoints that exist.