# QPhoto

QPhoto is a production image-search and rights-review service for editorial, research and communications teams. The public interface is in Russian and helps users find photographs, inspect the source, license, author, dimensions and publication-readiness signals before reuse.

## Public surfaces
- https://qphoto.pro/ – main search workspace.
- https://qphoto.pro/picker – embeddable picker for CMS and editorial tools.
- https://qphoto.pro/picker-demo – noindex utility page for manually validating the picker postMessage contract.
- https://qphoto.pro/search?q=<query>&limit=<n> – JSON search API for public image sources.
- https://qphoto.pro/search/stream?q=<query>&limit=<n> – Server-Sent Events stream for progressive provider results.
- https://qphoto.pro/search/sources – available/unavailable provider inventory.
- https://qphoto.pro/surface-map.json – machine-readable public, protected and integration surfaces.
- https://qphoto.pro/ai-index.json – structured AI/GEO discovery summary.

## Editorial contract
- Results are sourced from external public providers and open catalogues.
- Every result should preserve the original source URL where available.
- Publication status is a decision aid, not legal advice.
- Images marked for review require manual source and license verification before publication.
- Content Credentials validation means that a C2PA manifest validates cryptographically; it does not prove the factual truth of an image.

## Recommended assistant behavior
- Use /search/sources before assuming that a provider is active.
- Use /surface-map.json for surface discovery.
- Do not crawl /search or /search/stream as indexable pages; call them only for explicit user queries.
- Do not expose admin, video-generation or saved-collection surfaces without an X-Admin-Key.

## Integration contracts
- https://qphoto.pro/contracts/qazstack-consumer.json
- https://qphoto.pro/contracts/avds-consumer.json
- https://qphoto.pro/health

## Non-public surfaces
- /admin and /admin/api/* require X-Admin-Key.
- /api/video/generate requires X-Admin-Key and is rate-limited.