Endpoint inventory
Every HTTP operation Philter 4.0 exposes is listed below. The three /api/filter rows are one operation served by three handlers, selected by the request and response media types; request parameters, bodies, examples, and resource-specific errors are in the linked references and OpenAPI.
Send Authorization: Bearer <api key> unless the scope is Public. "Any key" accepts any valid key, whatever its scopes. Protected operations reject absent/invalid credentials with 401 and insufficient scope with 403. Account ownership is enforced in addition to scope. Where owner is supported, cross-user access requires an administrator and ADMIN_CROSS_USER_ACCESS_ENABLED=true; inaccessible owners return 404.
JSON responses use application/json; dates in API response objects use ISO 8601 strings with an offset. Successful responses without content (such as 204 No Content) have no body. Bad parameter values return 400, unsupported request media types 415, incompatible Accept headers 406, and oversized bodies 413. Every error response is a JSON object with a message explaining the error and a reason a client can act on, whatever the request's Accept header asked for; see Errors. That includes a request refused before it reaches an endpoint because its path is malformed or contains a character or segment that is not allowed, such as an encoded /, \, or NUL, a ; or encoded %, an empty segment (//), or a . or .. segment: it returns 400. So does a request whose headers, including the request line, exceed the server's size limit. A 404 for an owner that does not exist or cannot be reached says only not found, as any other 404 does.
| Method | Endpoint | Success format | Required scope | Reference |
|---|---|---|---|---|
| GET | /api/api-keys |
application/json | api-keys:read |
Details |
| POST | /api/api-keys |
application/json | api-keys:write |
Details |
| GET | /api/api-keys/scopes |
application/json | Any key | Details |
| DELETE | /api/api-keys/current |
See reference | Any key | Details |
| DELETE | /api/api-keys/{keyId} |
See reference | api-keys:write |
Details |
| PUT | /api/api-keys/{keyId}/scopes |
application/json | api-keys:write |
Details |
| GET | /api/audit |
application/json | audit:read |
Details |
| GET | /api/audit/export |
text/csv | audit:read |
Details |
| GET | /api/contexts |
application/json | contexts:read |
Details |
| POST | /api/contexts |
application/json | contexts:write |
Details |
| DELETE | /api/contexts/{name} |
See reference | contexts:write |
Details |
| GET | /api/contexts/{name} |
application/json | contexts:read |
Details |
| PATCH | /api/contexts/{name} |
application/json | contexts:write |
Details |
| DELETE | /api/contexts/{name}/entries |
See reference | contexts:write |
Details |
| GET | /api/contexts/{name}/entries |
application/json | contexts:read |
Details |
| GET | /api/contexts/{name}/entries/export |
application/json | contexts:read |
Details |
| POST | /api/contexts/{name}/entries/import |
application/json | contexts:write |
Details |
| DELETE | /api/contexts/{name}/entries/{entryId} |
See reference | contexts:write |
Details |
| GET | /api/documents |
application/json | documents:read |
Details |
| DELETE | /api/documents/{documentId} |
See reference | documents:write |
Details |
| GET | /api/documents/{documentId} |
See reference | documents:read |
Details |
| GET | /api/documents/{documentId}/status |
application/json | documents:read |
Details |
| POST | /api/explain |
application/json | redact |
Details |
| POST | /api/filter |
application/pdf | redact |
Details |
| POST | /api/filter |
application/zip | redact |
Details |
| POST | /api/filter |
text/plain | redact |
Details |
| GET | /api/health |
application/json | Public |
Details |
| GET | /api/holds |
application/json | holds:read |
Details |
| POST | /api/holds |
application/json | holds:write |
Details |
| DELETE | /api/holds/{reference} |
See reference | holds:write |
Details |
| GET | /api/holds/{reference} |
application/json | holds:read |
Details |
| DELETE | /api/ledger |
application/json | ledger:delete |
Details |
| GET | /api/ledger |
application/json | ledger:read |
Details |
| DELETE | /api/ledger/{documentId} |
See reference | ledger:delete |
Details |
| GET | /api/ledger/{documentId} |
application/json | ledger:read |
Details |
| GET | /api/ledger/{documentId}/export |
application/json | ledger:export |
Details |
| GET | /api/ledger/{documentId}/valid |
application/json | ledger:read |
Details |
| GET | /api/limits |
application/json | Any key | Details |
| GET | /api/lists |
application/json | lists:read |
Details |
| DELETE | /api/lists/{name} |
See reference | lists:write |
Details |
| GET | /api/lists/{name} |
application/json | lists:read |
Details |
| POST | /api/lists/{name} |
application/json | lists:write |
Details |
| PUT | /api/lists/{name} |
application/json | lists:write |
Details |
| GET | /api/models |
application/json | policies:read |
Details |
| GET | /api/models/{modelName} |
application/json | policies:read |
Details |
| GET | /api/pii-counts |
application/json | pii-counts:read |
Details |
| GET | /api/policies |
application/json | policies:read |
Details |
| POST | /api/policies |
See reference | policies:write |
Details |
| POST | /api/policies/compile |
application/json | policies:read |
Details |
| GET | /api/policies/templates/{templateName} |
application/json | policies:read |
Details |
| DELETE | /api/policies/{policyName} |
See reference | policies:write |
Details |
| GET | /api/policies/{policyName} |
application/json | policies:read |
Details |
| PUT | /api/policies/{policyName} |
See reference | policies:write |
Details |
| POST | /api/policies/{policyName}/copy |
application/json | policies:write |
Details |
| GET | /api/policies/{policyName}/details |
application/json | policies:read |
Details |
| PUT | /api/policies/{policyName}/details |
application/json | policies:write |
Details |
| GET | /api/policies/{policyName}/diff |
application/json | policies:read |
Details |
| POST | /api/policies/{policyName}/rollback |
application/json | policies:write |
Details |
| GET | /api/policies/{policyName}/versions |
application/json | policies:read |
Details |
| GET | /api/policies/{policyName}/versions/{revision} |
application/json | policies:read |
Details |
| GET | /api/redact-lists |
application/json | lists:read |
Details |
| POST | /api/redact-lists |
See reference | lists:write |
Details |
| PUT | /api/redact-lists |
See reference | lists:write |
Details |
| GET | /api/redact-lists/{list} |
application/json | lists:read |
Details |
| PUT | /api/redact-lists/{list} |
application/json | lists:write |
Details |
| GET | /api/settings |
application/json | settings:read |
Details |
| PATCH | /api/settings |
application/json | settings:write |
Details |
| POST | /api/reidentify |
application/json | reidentify |
Details |
| POST | /api/reidentify/text |
application/json | reidentify |
Details |
| GET | /api/sign-in |
application/json | Public |
Details |
| POST | /api/sign-in |
application/json | Public |
Details |
| POST | /api/sign-in/mfa |
application/json | Public |
Details |
| GET | /api/signing-key |
application/json | Public |
Details |
| GET | /api/signing-key/{keyId} |
application/json | Public |
Details |
| POST | /api/signing-key/regenerate |
application/json | signing:write |
Details |
| GET | /api/users |
application/json | users:read |
Details |
| POST | /api/users |
application/json | users:write |
Details |
| GET | /api/users/me |
application/json | users:read |
Details |
| POST | /api/users/me/mfa |
application/json | users:write |
Details |
| POST | /api/users/me/mfa/confirm |
application/json | users:write |
Details |
| POST | /api/users/me/mfa/remove |
application/json | users:write |
Details |
| PUT | /api/users/me/password |
application/json | users:write |
Details |
| DELETE | /api/users/me/session-keys |
application/json | api-keys:write |
Details |
| GET | /api/users/{username} |
application/json | users:read |
Details |
| GET | /api/users/{username}/api-keys |
application/json | api-keys:read |
Details |
| POST | /api/users/{username}/api-keys |
application/json | api-keys:write |
Details |
| POST | /api/users/{username}/deactivate |
application/json | users:write |
Details |
| PUT | /api/users/{username}/email |
application/json | users:write |
Details |
| DELETE | /api/users/{username}/mfa |
See reference | users:write |
Details |
| POST | /api/users/{username}/mfa/unlock |
application/json | users:write |
Details |
| PUT | /api/users/{username}/password |
application/json | users:write |
Details |
| POST | /api/users/{username}/reactivate |
application/json | users:write |
Details |
| POST | /api/users/{username}/sign-in/unlock |
application/json | users:write |
Details |
| DELETE | /api/users/{username}/session-keys |
application/json | api-keys:write |
Details |
| PUT | /api/users/{username}/role |
application/json | users:write |
Details |
| DELETE | /api/webhook |
See reference | webhooks:write |
Details |
| GET | /api/webhook |
application/json | webhooks:read |
Details |
| PUT | /api/webhook |
application/json | webhooks:write |
Details |
| GET | /api/webhook/deliveries |
application/json | webhooks:read |
Details |
| POST | /api/webhook/test |
application/json | webhooks:write |
Details |
PDF async acceptance returns application/json with status 202, regardless of the selected download format. A ZIP result contains redacted.pdf. Health is a liveness response, not a dependency-readiness probe. Webhooks are outbound notifications; they are documented separately and are not inbound API routes.