Content Type Gating

Content type gating extends the existing MIME allowlist into a policy-integrated, category-aware control system. Instead of managing dozens of individual MIME types, admins work with 7 semantic categories and configure allow/block per category. The executable category is hard-blocked by default at the platform level — orgs cannot override this.

Categories

Category	Description	Example types
code	Source code files	.py, .js, .ts, .go, .rs, .java, .c, .cpp, .sh, .ps1; text/x-python, application/javascript
image	Image files	.jpg, .png, .gif, .webp, .svg, .bmp; image/*
video	Video files	.mp4, .mov, .avi, .mkv, .webm; video/*
document	Office/PDF documents	.pdf, .docx, .xlsx, .pptx, .odt; application/pdf, application/vnd.openxmlformats-officedocument.*
archive	Compressed archives	.zip, .tar, .gz, .7z, .rar, .tar.gz; application/zip, application/x-tar
executable	Executable binaries (hard-blocked)	.exe, .dll, .so, .dylib, .bin, .msi, .dmg, .apk; application/x-msdownload, application/x-executable
data	Structured data files	.json, .csv, .xml, .yaml, .parquet; application/json, text/csv, application/xml

How MIME/extension mapping works

Each uploaded file is matched against the category registry in priority order: MIME type first, then file extension.

The registry ships with defaults covering the most common types in each category (as listed above). Admins can add custom MIME types or extensions to any category.

If a file matches neither a MIME type nor extension in the registry, it is classified as unknown and treated as allow by default (unless the org has configured a block-all-unknown policy).

Double extensions (e.g., file.pdf.exe) are evaluated against the final extension only.

Admin UI

Navigate to Admin → Content Type Gating.

The category tree shows all 7 categories with their current allow/block status and member MIME types/extensions.

• Toggle allow/block per category: flip the toggle to change the enforcement action for all files matching that category.
• executable category: shows a lock icon — it is hard-blocked by the platform and cannot be toggled to allow by org admins. The toggle is visible but read-only.
• Add a custom mapping: click the category row → Edit → Add MIME type or Add extension → enter the value → Save.

Policy conditions

Two new conditions are available in policy rules.

content_type — exact MIME type match

Matches files with a specific MIME type.

{
  "name": "Block PDF uploads from contractors",
  "action": "block",
  "message": "PDF uploads are restricted for contractor accounts.",
  "conditions": {
    "content_type": ["application/pdf"],
    "groups": ["contractors"]
  }
}

file_category — category group match

Matches any file in the specified category.

{
  "name": "Block archive uploads org-wide",
  "action": "block",
  "message": "Archive file uploads are not permitted.",
  "conditions": {
    "file_category": ["archive"]
  }
}

Multiple categories use OR logic (any match triggers the rule):

{
  "name": "Alert on code or executable uploads",
  "action": "flag",
  "conditions": {
    "file_category": ["code", "executable"]
  }
}

Hard-blocked categories

The executable category is hard-blocked by default. This is a platform-level control that cannot be overridden by org admins:

• Org admin UI shows the toggle as read-only (locked).
• API attempts to set executable to allow return 403 Forbidden.
• Staff portal can view hard-block status but cannot remove it for the executable category (it is a non-configurable platform default).

Other categories (archive, code) can be hard-blocked by staff for specific orgs via the staff portal if required for regulatory compliance.

API reference

Configuration is managed via the content type gating admin API. Base path: /api/v1/admin/content-type-gating/.

Method	Path	Description
GET	/api/v1/admin/content-type-gating/categories	List all 7 categories with current allow/block status and member types
PUT	/api/v1/admin/content-type-gating/categories/{category}	Update allow/block for a category
GET	/api/v1/admin/content-type-gating/mappings	List all MIME/extension → category mappings
POST	/api/v1/admin/content-type-gating/mappings	Add a custom MIME type or extension to a category
DELETE	/api/v1/admin/content-type-gating/mappings/{id}	Remove a custom mapping

Block image uploads

curl -X PUT https://platform.arbitex.ai/api/v1/admin/content-type-gating/categories/image -H "Authorization: Bearer $ADMIN_TOKEN" -H "Content-Type: application/json" -d '{"action": "block"}'

Add a custom extension to a category

curl -X POST https://platform.arbitex.ai/api/v1/admin/content-type-gating/mappings -H "Authorization: Bearer $ADMIN_TOKEN" -H "Content-Type: application/json" -d '{"category": "code", "extension": ".tf", "description": "Terraform configuration"}'

Staff portal overrides

Staff navigate to Staff → Orgs → {Org} → Content Type Gating.

• Hard-block override: force a category to block for a specific org regardless of org config. Useful for highly regulated orgs where even org admins should not be able to allow code or archive uploads.
• Hard-block overrides are surfaced in the org audit log and can be removed by staff.

See also

• DLP Overview
• Policy Rule Reference
• Content Detection — profanity, language, and code snippet detectors
• Audit Log