C2PA Sora 2 Integration: Marking Video Output

Definition: The Original Pictures Sora 2 integration signs generated video output and preserves OpenAI's existing manifest as a c2pa.ingredient, adding identity and a watermark for marking obligations.

TL;DR: Sora 2, launched 30 September 2025, ships C2PA plus an invisible watermark. Re-signing through Original Pictures preserves OpenAI's manifest as an ingredient and adds your platform identity and a TrustMark layer, covering Article 50 across frames.

Preserve the upstream manifest

Sora 2 output already carries a C2PA manifest and a watermark. Rather than discard that, the integration preserves it as an ingredient and appends your manifest, so the chain shows both OpenAI's generation and your platform's signing.

Add identity and a watermark

Your re-signing attaches a CAWG identity assertion naming your platform, a TrustMark watermark as an additional soft-binding layer, and an immutable signing receipt for the audit trail, which the upstream manifest does not provide.

Marking obligations

For platforms wrapping Sora 2, this satisfies Article 50(2) marking at your API boundary while crediting the upstream generator, the clean way to handle layered provenance on AI video.

The incident behind this

Sora 2's launch on 30 September 2025 with C2PA and an invisible watermark, per OpenAI's system card, set the expectation that AI video ships with provenance, which downstream platforms must preserve and extend.

Implementation

import hashlib, os, uuid, requests

API = "https://dev-api.originalpictures.com"
AUTH = {"Authorization": f"Bearer {os.environ['OP_API_KEY']}"}

def call(path, body, idempotent=False):
    headers = {**AUTH, "Idempotency-Key": str(uuid.uuid4())} if idempotent else AUTH
    r = requests.post(API + path, json=body, headers=headers, timeout=30)
    r.raise_for_status()
    return r.json()

data = open("sora2-output.mp4", "rb").read()
up = call("/v1/uploads", {"byte_length": len(data), "sha256": hashlib.sha256(data).hexdigest(),
                          "declared_media_type": "video/mp4", "mode": "single"})
# Storage URL: send exactly the issued headers, never the API key.
requests.put(up["upload"]["url"], data=data, headers=up["upload"]["headers"],
             timeout=600).raise_for_status()
call(f"/v1/uploads/{up['upload_id']}/complete", {}, idempotent=True)
# Signing keeps OpenAI's existing manifest as the parent ingredient.
job = call("/v1/sign", {"asset_id": up["asset_id"],
                        "recipe_id": "rcp_system_watermark_then_sign"}, idempotent=True)
# 202: poll GET /v1/jobs/{job_id} until state is completed

FAQ

Does re-signing remove OpenAI's manifest?

No. Signing keeps OpenAI's manifest as a c2pa.ingredient automatically and your manifest is appended.

Where Original Pictures stands today

Original Pictures ships three things today: a Sign API, a Verify API, and the SDKs that wrap them (not yet published to npm or PyPI). One POST /v1/sign with the watermark-then-sign recipe attaches a C2PA-format manifest and an invisible TrustMark watermark, with RFC 3161 timestamp evidence recorded alongside the signature. Any C2PA-aware validator can read the manifest without calling us.

Two things are on the near roadmap, and we name them as roadmap, not as shipped: C2PA Conformance Program recognition (target Q3 2026, until then our manifests use the published C2PA v2.2 format and any C2PA-aware validator can read them, but third-party validators will show our signer as not-yet-listed), and a consumer capture app (Q3 2026). We do not sell a capture SDK, and we do not claim Trust-List membership we do not yet hold.

Bottom line: Re-sign Sora 2 output with preserved ingredients, your identity, and a watermark, covering Article 50 while crediting the upstream generator.

Original Pictures is progressing through the C2PA Conformance Program; our signing certificate is not yet on the official C2PA Trust List. Target: Q3 2026. We will not describe ourselves as "C2PA-certified" until it is true.

Original Pictures provides content-provenance infrastructure. It does not by itself constitute legal compliance with the EU AI Act or any other regime; compliance depends on how you deploy it, your disclosures, and your governance. Figures are drawn from public reporting, verify against primary sources before citing in regulated materials. Nothing here is legal advice.

Last verified 2026-05-25. Author: Mahdi Kazempour, Founder, Original Pictures.