AI-Manipulated ID Photo Detection API

Why this matters now

26 October 2026. The Peninsula reported a Qatar Radio interview (Al Shurta Maak, “Police With You”) in which First Lieutenant Engineer Ali Hassan Al Sayed, an officer in the Ministry of Interior’s Civil Systems Section, described a new way to update a Qatar ID (QID) photograph. When someone starts a Metrash or MOI transaction that needs a photo, the system checks the photo already on file. If an update is required, the person gets a QR code, goes to an approved studio, and the studio uploads a new photo through a dedicated page on the Ministry’s website. He said the photos must meet ICAO and ISO standards, and that the Ministry will use automated checks and human review. He also said photographs manipulated with artificial intelligence will be rejected immediately when those checks detect them. Studios submit their name, location, and hours, and the Ministry will list them on Metrash and the MOI site. They need a QR scanner.

The Peninsula article does not state a fee, publish the studio list, or give a calendar launch date. Al Sayed said the service will first reach a limited group of users so the Ministry can gather feedback from applicants and studios, then expand. The article also cites a 25 October announcement that technical preparations were complete and that the official launch follows once remaining technical and logistical requirements are checked with studio owners. Al-Sharq reported the same interview. This page summarizes those reports. It is not an MOI notice, and IDPhoto.ai is not part of the service.

Qatar is one example of a wider shift. Governments and ID issuers are starting to reject AI-altered photos. A studio, a photo app, a pharmacy counter, an HR or badge system, or a visa platform that uploads first and finds out later pays for the retake. The useful check happens before the file leaves your system.

Who it is for

• Approved photo studios and studio software. Including studios preparing for a flow like Qatar’s QID upload, where the studio scans a QR code and sends the file to the issuer.
• Passport and visa photo apps and kiosks. Stop a filtered or generated portrait before you create a file the applicant will submit.
• Print shops and pharmacies with a photo counter. The same counter that already prints a passport photo can refuse a file that should be reshot.
• HR, badge, and student-ID platforms. A staff or student portrait that was generated or heavily reshaped is a bad record, even when a plain background is allowed.
• Visa and immigration service platforms. Catch the problem while the client is still in the appointment, not after the consulate returns the application.
• KYC and onboarding teams. A screening result next to the portrait you already store, with a JSON record of why the file was held.

What you get back

These are planned capabilities for early access. They are not measured accuracy figures, and the field names can change before a public reference is published. We are not publishing a detection rate.

Planned signals:

• Fully AI-generated face. The face appears synthesized rather than photographed.
• AI face swap, reshaping, or beauty filters. A different face pasted in, or a filter that changes features.
• AI background replacement or inpainting. A generated or painted background, as distinct from a plain specification color.
• Upscaling or heavy retouching. Detail that looks reconstructed, or retouching heavy enough to change the likeness.
• Missing or stripped provenance. Camera metadata is gone, or C2PA content credentials are absent or removed. Missing metadata is a signal, not proof of editing.

An optional heatmap marks regions the check found suspect, so a reviewer can see where to look. It is an aid. It is not pixel-level proof. Optional ICAO and ISO checks can ride along: send a specCode from the existing specification catalog and the response can include the same photo issue codes the Passport Photo API already returns for pose, expression, glasses, light, and framing. Those codes answer a different question from manipulation. A photo can be unedited and still fail a head-size rule.

Allowed processing and disallowed manipulation

A plain background, a crop, and a resize to the document size are the usual compliant steps. The background removal API and the Passport Photo API do that work. A US or UK passport still needs an unedited likeness: those rules reject a digitally altered person even when the background is plain. Employee badges and some internal IDs allow more correction. The Fix Passport Photo API page says where an edit is refused.

The planned policy id is yours to configure. A Qatar QID upload, a US passport flow, and a staff badge do not have to score the same file the same way. A plain specification background can be treated as allowed processing. A generated face, a face swap, or a beauty filter that changes the likeness can be treated as disallowed. You decide what your product does with pass, review, and reject. The API does not file the photo with an issuer, and it does not approve a studio.

How a call is shaped

One REST call: your backend POSTs the image and reads JSON. Keep the key and secret on that server. Do not put them in a browser, a kiosk page, or a mobile binary. The sample below is the planned early-access contract. The host is a placeholder. Do not send it to the live photo API hosts. Path, fields, and policy ids are issued with access and can change.

curl -sS -X POST "https://EARLY_ACCESS_HOST/v2/detectManipulatedPhoto" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "YOUR_API_KEY",
    "apiSecret": "YOUR_API_SECRET",
    "imageBase64": "data:image/jpeg;base64,...",
    "policy": "issuer-strict",
    "specCode": "us-passport",
    "includeHeatmap": true,
    "includeCompliance": true
  }'

An example response. The numbers illustrate the shape. They are not a measured result, and they are not an accuracy claim.

{
  "requestId": "req_example",
  "verdict": "review",
  "score": 0.62,
  "policy": "issuer-strict",
  "signals": [
    {
      "code": "AI_FACE_RESHAPE",
      "severity": "review",
      "detail": "Possible reshape or beauty filter on the face."
    },
    {
      "code": "PROVENANCE_MISSING",
      "severity": "info",
      "detail": "No C2PA manifest and no camera metadata."
    }
  ],
  "heatmap": {
    "format": "PNG",
    "outputType": "IMAGE_BASE64",
    "output": "..."
  },
  "compliance": {
    "specCode": "us-passport",
    "issues": []
  },
  "checkedAt": "2026-11-02T18:00:00Z"
}

The JSON is the audit record: request id, verdict, score, signals, policy, and time. Store it next to the submission in your own system. A webhook can POST that same JSON when you do not want to wait on the request, including when a batch finishes. Batch mode accepts a set of portraits instead of one. Both are part of early access. Email support@idphoto.ai to turn them on. There is no self-serve switch in the dashboard yet.

Photos are not training data

Photos sent to this API are not used to train models. Retention is set on the account and includes auto-delete, so we do not have to keep a copy after you have the JSON and, if you asked for it, the heatmap. The data privacy notes for the existing photo APIs already describe two choices: take the file back as Base64 and store nothing on our side, or use a temporary link. Early access follows that same choice. Transmission is encrypted. Do not log the secret or the portrait.

Where it sits next to the photo APIs

1. The camera, booth, or upload page captures one color portrait.
2. Your server calls detection with the policy for that destination.
3. On review or reject, show a retake. Do not upload the file to the issuer.
4. On pass, continue. If the product also needs a sized JPEG, call the Passport Photo API with the spec code. Read issue codes. A pass on manipulation does not clear a pose or lighting failure.
5. Keep the detection JSON with the order, the employee record, or the application. That is the trail if someone asks why a file was refused.

FAQ