The investigation object
Attributes
id string
The unique identifier of the investigation.
type string
The question the investigation answers. Currently identity: is this person who they claim to be?
status enum
Where the investigation is in its run.
queued
Accepted and waiting for a worker.
running
The agent is gathering and checking. activity fills in as it goes.
completed
The report is ready.
failed
The run could not finish. error is set and nothing is billed.
user string (optional)
The external ID of the account under investigation, when one was attached.
directions string (optional)
What you asked the agent to pay attention to.
decision_rules object (optional)
The meanings you set for accept, review, reject or inconclusive on this investigation. Decisions you did not set keep their defaults.
inputs object
What you supplied: claims as key-value pairs, urls, text, and profile_capture when the profile was captured from a signed-in browser (see create an investigation).
attachments array
The images you supplied, each with id (f1, f2 and so on), kind (profile_photo, screenshot, document or other), provided_by (operator or subject), an optional note, content_type and size. The image bytes are not returned.
Once the agent has read an image, examination holds what it saw: observed_kind (person_photo, screenshot, document or other), matches_label, a description, the identity-bearing text_visible with document numbers and dates of birth withheld, findings as claim, value and confidence rows, concerns, and the activity_id that evidence rows cite. For a photograph of a person it also carries the authenticity check: label, synthetic_score from 0 (real) to 1 (synthetic), reverse_image_matches and the media_activity_id of that check.
report object (optional)
Present once the investigation is completed. Read it top down: the decision first, the fixed indicators next, the evidence rows after that, and the long-form details last.
report.decision enum
accept when the person is who they claim and nothing material contradicts the claims. review when the signals are mixed or thin and a human or a step-up check should follow. reject when the identity is fabricated or impersonated. inconclusive when not enough reachable evidence exists to decide. Those are the defaults; decision_rules on the request replaces the meaning of any of them for that investigation.
report.verdict string
One sentence a reviewer can repeat.
report.confidence number
How sure the agent is of the decision given the evidence it reached, from 0 to 1.
report.summary string
What the record is, the load-bearing claim, what was found and what it means.
report.indicators array
A fixed list per type, always in the same order, each with key, status (pass, warn, flag or na) and a one-line note. For identity the keys are account_age, recent_changes, id_verification, work_verification, footprint, network, content, photo, consistency, template, public_record, session_location, network_anonymity, device_sharing and contact_age.
report.evidence array
One row per fact that moved the decision: claim, expected (what a genuine subject would show), observed (what was found), source (the activity entry it came from), bears_on and status. Every row cites a recorded activity; rows that did not are dropped before the report is stored.
report.details string
The long-form assessment, claim by claim, for a reviewer who wants the reasoning.
report.recommendation string
The next action, such as accept, hold for a live check, ask for a capture of the profile's verification panel, or decline.
activity array
Everything the agent did, in order: id (what evidence rows cite), at, step (for example rupt_history, planning, sweeping_open_sources, examining_media), the tool and input when a tool ran, a one-line summary, and duration_ms. The first entries are always the intake, the Rupt history, one reading_attachment per image, and the plan.
usage object (optional)
steps, tool_calls and duration_ms for the run.
error string (optional)
investigation_failed when the status is failed.
createdAt date
When the investigation was created.
startedAt date (optional)
When a worker picked it up.
completedAt date (optional)
When it completed or failed.
{
"id": "67160f3e1c9d440012a8b1f4",
"type": "identity",
"status": "completed",
"user": "expert_48213",
"directions": "Applicant for an AI infrastructure expert call. Check the career claims and whether the profile is part of a ring.",
"inputs": {
"claims": {
"name": "Rowan Castellanos",
"title": "AI infrastructure advisor",
"employers": "OpenAI 2021 to 2025, NVIDIA 2016 to 2021",
"location": "Austin, Texas",
"linkedin": "https://www.linkedin.com/in/rowan-castellanos"
},
"urls": ["https://www.linkedin.com/in/rowan-castellanos"]
},
"attachments": [
{
"id": "f1",
"kind": "screenshot",
"provided_by": "operator",
"note": "About this member panel, captured by our screening team",
"content_type": "image/png",
"size": 184322,
"examination": {
"activity_id": "a3",
"observed_kind": "screenshot",
"matches_label": true,
"description": "LinkedIn's About this member panel for Rowan Castellanos.",
"text_visible": "Rowan Castellanos. Joined May 2026. Verified with a government ID issued in India. Name last changed May 2026.",
"findings": [
{ "claim": "account created", "value": "May 2026, five months before the application", "confidence": 0.95 },
{ "claim": "government ID issuing country", "value": "India, which differs from the claimed residence in Texas", "confidence": 0.9 }
],
"concerns": []
}
}
],
"report": {
"decision": "reject",
"verdict": "The profile is a fabricated identity built on a template, not a former OpenAI engineer.",
"confidence": 0.88,
"summary": "The claims rest on a profile created five months ago and verified with a government ID issued outside the claimed country. No publication, talk, filing or company page places the person at either employer. The account signed up through a hosting network and shares a device with two other applicants whose profiles follow the same build.",
"indicators": [
{ "key": "account_age", "status": "flag", "note": "Profile created five months ago." },
{ "key": "recent_changes", "status": "flag", "note": "Photo and contact details changed within the last six months." },
{ "key": "id_verification", "status": "flag", "note": "Government ID issued in a different country from the claimed residence." },
{ "key": "work_verification", "status": "na", "note": "No work email verification on the profile." },
{ "key": "footprint", "status": "flag", "note": "No trace of the claimed career outside the profile." },
{ "key": "network", "status": "warn", "note": "Suggested profiles are students unrelated to the field." },
{ "key": "content", "status": "flag", "note": "Bullet lists read as machine-written, with a leftover assistant prompt." },
{ "key": "photo", "status": "pass", "note": "Real photograph, no reverse image matches." },
{ "key": "consistency", "status": "warn", "note": "Degree dates overlap the first employer by a year." },
{ "key": "template", "status": "flag", "note": "Same build as two linked applicants." },
{ "key": "public_record", "status": "na", "note": "Nothing bears on it." },
{ "key": "session_location", "status": "flag", "note": "Sessions from a different country than the claimed residence." },
{ "key": "network_anonymity", "status": "flag", "note": "Signup through a hosting network." },
{ "key": "device_sharing", "status": "flag", "note": "Device shared with two other applicant accounts." },
{ "key": "contact_age", "status": "warn", "note": "Webmail address registered recently; VoIP number." }
],
"evidence": [
{
"claim": "Worked at OpenAI from 2021 to 2025",
"expected": "Talks, posts, co-authored papers or a company page naming the person",
"observed": "No result across people, news and general searches",
"source": "a5",
"bears_on": "footprint",
"status": "flag"
},
{
"claim": "Based in Austin, Texas",
"expected": "Sessions from Texas on a residential network",
"observed": "Eleven sessions from another country, all through a hosting network",
"source": "a2",
"bears_on": "session_location",
"status": "flag"
}
],
"details": "### What the record is\nA profile created five months ago ...",
"recommendation": "Decline the application. If the operator wants to be certain, ask for a live video call before any booking."
},
"activity": [
{ "id": "a1", "at": "2026-10-21T18:02:11.000Z", "step": "intake", "summary": "identity investigation of expert_48213: 5 claims, 1 urls, no text, directions given" },
{ "id": "a2", "at": "2026-10-21T18:02:12.000Z", "step": "rupt_history", "summary": "Hosting network on 11 of 11 evaluations; 2 linked accounts; 1 verified identity document" },
{ "id": "a3", "at": "2026-10-21T18:02:13.000Z", "step": "reading_attachment", "input": "{\"attachment\":\"f1\",\"kind\":\"screenshot\",\"provided_by\":\"operator\"}", "summary": "f1 read as screenshot: LinkedIn's About this member panel for Rowan Castellanos. (2 findings, 0 concerns)", "duration_ms": 6210 },
{ "id": "a4", "at": "2026-10-21T18:02:19.000Z", "step": "planning", "summary": "11 claims, 9 checkable" },
{ "id": "a5", "at": "2026-10-21T18:02:31.000Z", "step": "sweeping_open_sources", "tool": "web_search", "input": "{\"query\":\"Rowan Castellanos OpenAI\",\"category\":\"people\"}", "summary": "0 results for \"Rowan Castellanos OpenAI\" (people)", "duration_ms": 1840 }
],
"usage": { "steps": 9, "tool_calls": 11, "duration_ms": 94120 },
"createdAt": "2026-10-21T18:02:10.000Z",
"startedAt": "2026-10-21T18:02:11.000Z",
"completedAt": "2026-10-21T18:03:45.000Z"
}