Verify PDFs from any agent or backend

Create an API key in the Developers section, then submit the file as multipart/form-data with the API-KEY header. You get a document_id back immediately; poll for that document_id until status leaves "processing", then read fraud_risk and warnings from the JSON. No SDK is required, any HTTP client works.

Any computer-generated PDF: bank statements, payslips, tax returns (including W-2s, 1099s and the 1040), invoices and similar financial documents, where accuracy is around 99%. It does not verify scanned documents, photos, screenshots or identity documents such as passports. Send the original PDF rather than a scan or a print-to-PDF copy, so the metadata and structural signals the analysis relies on stay intact.

Each verdict maps to one action. A trusted or low fraud_risk means accept: the document looks authentic. medium means review: a person should check the flagged warnings before accepting (the dashboard shows this band as Needs Attention). high means reject: the PDF shows strong forgery or tampering signals. A password-protected or corrupted document is unverifiable. Ask the sender for an intact, unlocked file and re-submit.

Log into your account at secure.verifypdf.com and open the Developers section. Create a key and send it as the API-KEY header on every request. Document verification API access is available on the Professional and Corporate plans; quota and prepaid balances apply exactly as they do for the dashboard.

Not reliably. A general AI assistant can read the text in a PDF, but it cannot inspect the metadata, document structure and editing traces that reveal tampering, so it will guess. Give the agent the VerifyPDF skill instead: it submits the file to the forensic API and returns a trust_score, a fraud_risk label and an accept, review or reject recommendation the agent can act on.

Because MCP is the wrong transport for a document. A tool call (including MCP) takes model-generated JSON as its input, so a local PDF has to be inlined as a ~50,000-character base64 string that models routinely truncate mid-stream, and a corrupted fragment produces a meaningless verdict. A direct multipart POST sends the raw bytes intact. Any agent that can run a shell or make an HTTP request (Claude Code, Cursor, a Python or Node script) should call the REST API directly, or use the AI agent skill that wraps it.

Yes. Assign a webhook URL to your API key in the Developers section at secure.verifypdf.com. When a document finishes analysis, VerifyPDF POSTs the structured result to that URL with an X-Webhook-Signature header (an HMAC-SHA256 of the raw body keyed with your webhook secret) plus an X-Webhook-Auth header, so you can verify every call is genuine. Webhook URLs must be HTTPS and cannot target private or internal networks.

Yes. Use the public upload form or the interactive demo for a quick smoke test. Direct API access is shown inside the authenticated product once you create an API key.