API

Metadata processing over HTTP

The same engine that powers the website, available as a versioned API. Multipart in, JSON or the processed file out.

Endpoints

POST/api/v1/analyzeRead every metadata field in a file.
POST/api/v1/cleanRemove metadata and verify the result.
POST/api/v1/editWrite or delete individual fields.
POST/api/v1/apply-profileApply a device metadata profile.

Machine-readable description: /api/v1/openapi.json

A first request

curl -X POST https://your-domain/api/v1/clean \
  -H "Authorization: Bearer nmd_live_..." \
  -F "file=@photo.jpg" \
  -F "mode=full" \
  -F "response=json"

{
  "verified": true,
  "before": { "fields": 31, "removable": 26, "gps": true },
  "after":  { "fields": 5,  "removable": 0,  "gps": false },
  "removed": [ { "key": "camera.make", "label": "Make" } ],
  "notes": [ "The compressed image data was copied unchanged." ]
}

Access and volume

API access is included from Pro upwards. Each key is metered against your plan’s monthly allowance, and every response carries the remaining quota in its headers so you can back off before being refused.

API allowance by plan
Plan	Calls per month	Keys	Max file size
Pro	2,000	3	4.29 MB
Business	50,000	20	4.29 MB
Enterprise	Agreed with you	Custom	4.29 MB

See pricing for the full comparison, or talk to us about higher volume.

Frequently asked questions

Do you store the files I send to the API?

No. A file exists in the memory of the process handling one request and is released with the response. Nothing is written to disk, so there is no temporary file to clean up and no retention window to trust.

How is the API authenticated?

With an API key, sent as "Authorization: Bearer <key>" or "X-API-Key: <key>". Keys are shown once at creation and stored only as a SHA-256 hash, so a database disclosure yields no usable credentials.

What happens when I exceed my quota?

You receive a 429 with a machine-readable code, the used and allowed counts, and a Retry-After header. Every successful response also carries X-RateLimit-Remaining, so you can slow down before hitting the wall.

Is the API versioned?

Yes. All public endpoints live under /api/v1/ and its response shapes will not change under you. The unversioned /api/ routes are internal to the web application and carry no compatibility promise — do not build against them.

Which formats does the API support?

The API accepts every format the engine reads, which the formats page lists in full: images, video, audio and PDF. Cleaning and editing work for all of those except WebM, which can be cleaned but not edited. An unsupported operation returns 422 rather than silently doing nothing.