The Copyleaks Authenticity API scans source code the same way it scans text. You submit a code file to the same Submit File endpoint you already use for documents, Copyleaks compares it against billions of online sources, and your server is notified via webhooks when the results are ready. There is no separate endpoint, plan, or feature flag for code. If you can scan a .txt file, you can scan a .py file. The only difference is the file extension you send. Teams use code scans to:
  • Confirm that proprietary code has not appeared in public repositories, forums, or documentation sites.
  • Check that contributed or outsourced code was not copied from other sources, to stay on the right side of licensing agreements.
  • Review programming assignments for academic integrity.
This guide walks you through submitting a code file, tuning the scan for source code, and exporting the results.

Get started

1

Before you begin

Before you start, ensure you have the following:
2

Installation

Choose your preferred method for making API calls.
HTTP needs no installation - call the API with any standard HTTP client, or import our Postman collection for a quicker start.
3

Login

To perform a scan, we first need to generate an access token. For that, we will use the login endpoint. The API key can be found on the Copyleaks API Dashboard.Upon successful authentication, you will receive a token that must be attached to subsequent API calls via the Authorization: Bearer <TOKEN> header. This token remains valid for 48 hours.
Response
Save this token. It is valid for 48 hours and can be reused for subsequent API calls.
4

Submit the code file for scanning

Use the Submit File Endpoint to send the file for analysis. The request is identical to a text submission: the file content goes in base64, the file name goes in filename, and the scan settings go in properties. We suggest you provide a unique scanId for each submission, for example one derived from the file path.
The extension in filename tells Copyleaks how to read the file, so use the real extension of your source file (for example main.py, App.java, or server.js). Supported source code extensions:ts, py, go, cs, c, h, idc, cpp, hpp, c++, h++, cc, hh, java, js, swift, rb, pl, php, sh, m, scala, cssSource code files can be up to 3 MB each. See the full technical specifications for all input limits.
For testing, set "sandbox": true. Sandbox mode is free and returns mock results.
What is Base64 Encoding?Base64 converts binary files into text strings so they can be sent via JSON. All programming languages have built-in Base64 encoding functions, see the code examples below for your language.
AI Content Detection is not supported for source code files, so keep aiGeneratedText.detect at its default (false) and don’t expect an AI detection result for code. Plagiarism detection is not affected. See the release notes from December 16, 2025 for details.
5

Wait for the completion webhook

The scan can take some time. Once it’s complete, Copyleaks sends a completed webhook to the status URL you provided. It contains a summary of the scan: an overall score, and one entry per source where the code was found, each with a result ID you will use in the next step.Matches are grouped by where they came from:
  • results.internet - public web pages, including code hosting sites, forums, and documentation.
  • results.database - documents in the Copyleaks Shared Data Hub.
  • results.repositories - your own Private Cloud Hub repositories, if you scanned against any.
A trimmed example for a code file that was found on a public repository:
Completed webhook (trimmed)
An empty results section with an aggregatedScore of 0 means none of the code was found in the sources you scanned against.
6

Export detailed results

After the completed webhook arrives, use the export endpoint to retrieve the detailed plagiarism results using the result IDs you received in the completion webhook. Each result contains the character positions of every matched range in your file and in the source, which you can map back to line numbers or feed into the Copyleaks report.We will also export the Crawled Version. The crawledVersion webhook contains the text version of the submitted file as Copyleaks processed it. This can later be used in order to display the report.In addition, you should also specify a completionWebhook to receive notifications when the export is ready.
7

Summary

You have successfully submitted a source code file for plagiarism detection and exported the results. You can now handle the results in your application, highlight the matched lines for your users, or take further actions based on the findings.

Tune the scan for source code

The defaults work for most code scans. These settings are the ones teams most often adjust:
  • Where to look. scanning.internet (on by default) covers public web sources. Add scanning.repositories to also compare against your own codebase in a Private Cloud Hub, which is how you check new code against everything your organization already indexed.
  • Keep proprietary code private. By default, indexing.copyleaksDb is false, so your file is not added to the Shared Data Hub and other Copyleaks users can never match against it. Leave it that way for proprietary code. If you don’t want the file kept for comparison against your own future submissions either, set scanning.copyleaksDb.includeMySubmissions to false.
  • Cut down on noise. Source files share a lot of boilerplate, such as import blocks, license headers, and common idioms. Use filters.minCopiedWords to hide results below a minimum match size, and sensitivityLevel (1 is fastest, 5 is most thorough) to control how deep the scan goes. See Detection Levels for how identical, minor-change, and paraphrase matching can be toggled individually.
  • Ignore sources you own. If your own public sites show up as matches, exclude them with filters.domains together with filters.domainsMode set to 1.
All properties are documented on the Submit File reference.

Frequently asked questions

No. Source code goes through the same Submit File endpoint as text and documents, uses the same properties, and is billed with the same plagiarism credits. The file extension in filename is all that tells Copyleaks it is code.
Files with these extensions are accepted: ts, py, go, cs, c, h, idc, cpp, hpp, c++, h++, cc, hh, java, js, swift, rb, pl, php, sh, m, scala, css. The full list is in the technical specifications.
Each submission is one file, and archives such as .zip are not supported. To scan a repository, loop over the source files and submit each one with its own scanId. A path-based ID such as repo-src-utils-main-py makes it easy to map results back to files.
Yes. Index your existing files into a Private Cloud Hub repository, then scan new files against it with scanning.repositories. Matches from your repository come back in results.repositories in the completed webhook.
Only if you set indexing.copyleaksDb to true, which adds the file to the Shared Data Hub. It is false by default, so a normal scan does not share your code with anyone.
No. AI Content Detection for source code was deprecated on December 16, 2025 and is no longer supported on the submit endpoints. Plagiarism detection for code is unaffected. See the release notes for details.
The same way as for text: every 250 words, or part of that, counts as one page. See technical specifications for the full breakdown.
Yes. Set "sandbox": true in the submission properties. Sandbox mode is free and returns mock results, so you can wire up the flow before going live.

Next steps

Webhooks Overview

Learn how to securely receive and process notifications from Copyleaks.

Viewing Scan Results

Understand the scan result format and how to display it to your users.

Data Hubs

Compare code against your own private repositories or the Shared Data Hub.

Submit File Reference

Every property you can set on a scan, with request and response examples.