One API call returns a rights bundle for AI-era audio: a content fingerprint,
a provenance verdict, a scoped commercial-use license, the exact
contains_ai value platforms expect, and a priority timestamp.
SHA-256 over the file, plus an RFC 3161 timestamp from a public TSA, so there is a dated record that this exact audio existed before someone else claimed it.
We read C2PA content credentials out of the file and cross-check against the generator's own public detector. No guesswork, no "trust me."
all, partly, none, unknown — the DDEX and CSV enum, ready to hand to YouTube, Spotify or a distributor.
A scoped commercial-use grant derived from the generator's terms, explicitly labelled as a contract rather than a copyright claim. Because AI output does not carry copyright.
Generated audio broke the paperwork, and nobody rebuilt the paperwork.
| What changed | Why it breaks you |
|---|---|
| Output is free and infinite | Supply stopped being scarce. If your platform's value was hosting and surfacing audio, there is no longer a scarce thing to distribute. |
| Copyright does not attach | The US Copyright Office is explicit: prompts alone do not provide sufficient control, and purely AI-generated material carries no copyright. You cannot register it, so you cannot enforce it, so you get claimed by people who did register something. |
| Terms are conditional and time-bound | Commercial use typically attaches only to a download obtained while subscribed, under the tier you held at that moment. Six months later nobody can prove what you held. |
| Disclosure is now mandatory | Platforms require an AI disclosure value for the audio, in their own enum, in their own delivery format. Miss it and you get labeled, flagged, or monetarily penalized. |
| False claims are structural | Two creators can generate near-identical tracks from similar prompts. A fingerprinting system that cannot tell them apart will claim one against the other, and the one without a dated record loses. |
Every one of those is a records problem, not a music problem. Records are cheap to fix — if someone bothers to keep them.
One call. Everything below comes back in a single JSON response.
# POST /api/v1/manifest # {"audio_url":"https://.../track.mp3","generator":"suno","tier_evidence":"pro"} { "id": "7f3c…", "audio": { "sha256": "9c1f…", "fingerprintAlgorithm": "sha256", "bytes": 4821337 }, "provenance": { "verdict": "verified_suno", "manifestPresent": true, "detector": "suno-public-c2pa-detect" }, "license": { "scope": "commercial-use-granted", "basis": "suno pro-tier terms grant commercial use for permitted downloads", "confidence": "asserted-with-receipt", "copyrightNote": "This manifest conveys a contractual license, not a copyright determination." }, "disclosure": { "contains_ai": "all", "youtube": { "disclose": true, "label": "all" }, "ddex": { "contains_ai": "all" } }, "priority": { "format": "RFC3161", "granted": true, "timestamp": "Nov 1 01:49:08 2026 GMT", "tsa": "Free TSA (freetsa.org)" }, "verification": { "publicUrl": "https://audiodistro.com/m/7f3c…" } }
The manifest is honest about what it knows. It separates what was independently verified from what was asserted by the caller, and it says plainly that a contractual license is not copyright.
Paste a public URL to an AI-generated track. We will fetch it, read its content credentials, timestamp it, and hand back the bundle. Nothing is stored beyond the manifest itself.
Try a track you generated with Suno to see the provenance path light up.
— press "Build the bundle" —
Pick the number you would actually pay. There is no wrong answer and no checkout — this tells us whether to keep building.
We are onboarding a small number of people for the first version.