Image DLP API

The Image DLP API provides endpoints for managing OCR-based image scanning configuration and retrieving scan statistics. Use these endpoints to enable image scanning, select the OCR provider, tune file size limits and timeouts, and monitor OCR activity across your organization.

For the admin guide covering the image DLP pipeline, supported formats, audit events, and outpost deployment, see Image DLP Admin Guide.

Authentication

All endpoints require authentication via Bearer token with admin role:

Authorization: Bearer <admin-api-key>

Base URL: https://gateway.arbitex.ai

Configuration

Get OCR configuration

Method	Path	Auth	Description
`GET`	`/api/v1/admin/image-ocr/config`	Bearer (admin)	Retrieve current OCR configuration for the org

Returns the current OCR settings for the authenticated user’s organization.

Example:

curl -s https://gateway.arbitex.ai/api/v1/admin/image-ocr/config \
  -H "Authorization: Bearer $ADMIN_TOKEN"

Response (200 OK):

{
  "enabled": false,
  "provider": "azure",
  "max_file_size_mb": 20,
  "timeout_seconds": 30
}

Response fields:

Field	Type	Description
`enabled`	boolean	Whether OCR-based image scanning is active for the org
`provider`	string	OCR backend: `"azure"` (Azure AI Vision) or `"tesseract"` (local engine)
`max_file_size_mb`	integer	Maximum file size in MB for OCR processing; larger files are skipped
`timeout_seconds`	integer	Per-file OCR timeout; files exceeding this are quarantined pending review

Update OCR configuration

Method	Path	Auth	Description
`PUT`	`/api/v1/admin/image-ocr/config`	Bearer (admin)	Update OCR configuration for the org

Updates one or more OCR settings. All fields are optional — only include fields you want to change. Omitted fields retain their current values.

Request body:

Field	Type	Required	Description
`enabled`	boolean	No	Enable or disable OCR-based image scanning
`provider`	string	No	`"azure"` or `"tesseract"`
`max_file_size_mb`	integer	No	Maximum file size in MB (range: 1–100)
`timeout_seconds`	integer	No	Per-file timeout in seconds (range: 5–120)

Example — enable OCR with Tesseract:

curl -s -X PUT https://gateway.arbitex.ai/api/v1/admin/image-ocr/config \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "provider": "tesseract"
  }'

Response (200 OK):

{
  "enabled": true,
  "provider": "tesseract",
  "max_file_size_mb": 20,
  "timeout_seconds": 30
}

The response returns the full configuration after the update is applied.

Example — adjust file size limit and timeout:

curl -s -X PUT https://gateway.arbitex.ai/api/v1/admin/image-ocr/config \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "max_file_size_mb": 50,
    "timeout_seconds": 60
  }'

Response (200 OK):

{
  "enabled": true,
  "provider": "tesseract",
  "max_file_size_mb": 50,
  "timeout_seconds": 60
}

Statistics

Get OCR scan statistics

Method	Path	Auth	Description
`GET`	`/api/v1/admin/image-ocr/stats`	Bearer (admin)	Retrieve OCR scan statistics for the org

Returns aggregate scan metrics for the current day, last 7 days, and last 30 days.

Example:

curl -s https://gateway.arbitex.ai/api/v1/admin/image-ocr/stats \
  -H "Authorization: Bearer $ADMIN_TOKEN"

Response (200 OK):

{
  "last_24h": {
    "period": "24h",
    "total_scans": 142,
    "total_text_extracted_chars": 843269,
    "total_findings": 3,
    "avg_latency_ms": 1240
  },
  "last_7d": {
    "period": "7d",
    "total_scans": 1038,
    "total_text_extracted_chars": 6218400,
    "total_findings": 23,
    "avg_latency_ms": 1180
  },
  "last_30d": {
    "period": "30d",
    "total_scans": 4215,
    "total_text_extracted_chars": 25104820,
    "total_findings": 87,
    "avg_latency_ms": 1210
  }
}

Response fields:

The response contains three period entries: last_24h, last_7d, and last_30d. Each entry has the same structure:

Field	Type	Description
`period`	string	Time window identifier (`"24h"`, `"7d"`, `"30d"`)
`total_scans`	integer	Total OCR scans completed in the period
`total_text_extracted_chars`	integer	Cumulative characters of text extracted via OCR
`total_findings`	integer	Total DLP findings from OCR-extracted text
`avg_latency_ms`	integer	Average OCR processing time per file in milliseconds

File Upload with OCR

Image OCR does not have a separate upload endpoint. When image_ocr_enabled is true, the existing file attachment endpoint automatically triggers OCR for image files:

Method	Path	Auth	Description
`POST`	`/api/attachments/upload`	Bearer (user or admin)	Upload a file attachment; OCR runs automatically for images

When the uploaded file has an image MIME type (image/png, image/jpeg, image/tiff, image/bmp, image/webp) or is an image-only PDF, and image_ocr_enabled is true, the platform extracts text via OCR and passes it through the 5-tier DLP pipeline. No additional parameters are required to trigger OCR — it is automatic based on MIME type and the org configuration.

Error Codes

Status	Code	Description
`400`	`invalid_config`	Invalid configuration value (e.g., unknown provider, file size out of range, timeout out of range)
`403`	`forbidden`	Authenticated user does not have admin role
`404`	`org_not_found`	Organization not found for the authenticated token

Example error response:

{
  "error": {
    "code": "invalid_config",
    "message": "provider must be 'azure' or 'tesseract'",
    "field": "provider"
  }
}

Validation rules:

Field	Constraint
`provider`	Must be `"azure"` or `"tesseract"`
`max_file_size_mb`	Integer, range 1–100
`timeout_seconds`	Integer, range 5–120