generated: '2026-08-06'
method: searched
source: https://docs.activefence.com/openapi.json
docs: https://docs.activefence.com/index.html
summary: >-
  Plain REST over JSON, one API-key header, no versioned negotiation beyond the URI path prefix.
  The defining convention is the sync/async split: the same payload can be sent to a synchronous
  path (/sync/v3/...) that blocks and returns the analysis inline, or to an asynchronous path
  (/v3/...) that returns only a tracking response_id and later POSTs the analysis to a
  customer-registered callback_url. There is no pagination, no cursoring, no field expansion and
  no idempotency contract anywhere in the published surface.
authentication:
  style: api-key-header
  header: af-api-key
  scheme_name: API Key
  applied: globally via a root-level security requirement
  issuance: >-
    Keys are generated in the platform console under Account Settings > DATA MANAGEMENT >
    Alice API Keys. The key value is shown once and cannot be retrieved again.
  rotation: >-
    Regenerating a key overrides the current one, but the old key stays valid for a further 12
    hours to allow a rolling cutover. Deleting a key rejects its requests immediately.
  self_service_api: true
  self_service_api_note: >-
    Key lifecycle is itself exposed over the API — POST /v3/apikeys, GET /v3/apikeys,
    DELETE /v3/apikeys/{id}.
  see: authentication/activefence-authentication.yml
idempotency:
  supported: false
  evidence: >-
    No Idempotency-Key header, no idempotency parameter, and no idempotency language appears
    anywhere in the OpenAPI document or its embedded guide (0 matches for /idempoten/i across
    120KB of spec). Retrying a content-submission POST creates a new analysis with a new
    response_id.
pagination:
  supported: partial
  style: page-number
  scope: >-
    Only ONE operation paginates — GET /redteam/assessments/ (WonderBuild). It is not a
    provider-wide convention: GET /v3/apikeys, the other collection-returning operation,
    declares no pagination parameters at all and returns an unbounded list.
  request_params:
  - {name: page, in: query, type: integer, minimum: 1, description: Page number}
  - {name: limit, in: query, type: integer, minimum: 1, maximum: 100, default: 20, description: Results per page}
  - {name: sort, in: query, enum: [createdAt, lastUpdatedAt, name, status]}
  - {name: order, in: query, enum: [asc, desc]}
  response_envelope:
    data: array of results
    pagination: object carrying the page state
  filtering:
    note: >-
      The same operation is the only one with a filter surface — search, applicationIds,
      applicationNames, status (enum: ready, pending, in_progress, generating_report,
      completed, failed), createdBy, dateFrom, dateTo (ISO 8601).
  source_operation: openapi/activefence-alice-api-openapi.yml#get-assessments
versioning:
  scheme: uri-path
  current: v3
  note: >-
    Version is carried in the path. Three prefixes coexist and are not uniform — /v3/ for
    ActiveFamily content, users, collections, flags and API keys; /sync/v3/ for the synchronous
    variants of text, bulk text and image; /v1/ for the WonderFence evaluate endpoint; and an
    unversioned /redteam/ prefix for WonderBuild assessments.
  spec_version: 3.0.0
  see: lifecycle/activefence-lifecycle.yml
async_model:
  synchronous_paths: [/sync/v3/content/text, /sync/v3/content/bulk/text, /sync/v3/content/image]
  asynchronous_paths:
  - /v3/content/text
  - /v3/content/image
  - /v3/content/video
  - /v3/content/audio
  - /v3/users/upsert
  - '/v3/collections/{collection_type}'
  ack_shape: >-
    An async 200 returns {response_id, analyzed_violations[]}. analyzed_violations lists the
    violation types that WILL be analyzed for this submission, based on the account's
    configuration and the media type. An empty analyzed_violations array means no callback
    will ever be sent for that request.
  callback_url:
    field: callback_url
    description: Customer-hosted URL that Alice POSTs the completed analysis to.
  callback_auth:
    field: callback_key_name
    description: >-
      Names a key defined in the platform's Auth Management section. That key is injected into
      the header or query params of the callback request so the receiver can authenticate it.
  correlation: >-
    Every callback for a request carries the same response_id returned by the acknowledgement,
    so results can be joined back to the submission.
  see: asyncapi/activefence-webhooks.yml
tracing:
  request_id_field: response_id
  location: response body
  description: >-
    Tracking ID generated by the platform on receipt of any request. Used for support tracing and
    to correlate asynchronous callbacks with their originating submission. This is a body field,
    not a response header — the API declares no tracing headers.
rate_limiting:
  default: 50 requests per second per project
  scope: project
  increase: by request to the account manager
  over_limit_status: 429
  signalling_headers: none_documented
  note: >-
    The published guide states the limit and the 429 behavior but documents no RateLimit-* or
    Retry-After response headers, so a client cannot read remaining budget from the response.
error_envelope:
  format: vendor-json
  rfc9457: false
  content_type: application/json
  shape:
    statusCode: number
    error: string
    message: string
    params.body.source: string
    params.body.keys: array of string
    params.body.message: string
  see: errors/activefence-problem-types.yml
scoring_semantics:
  risk_score:
    range: 0.1 - 1
    meaning: probability the item violates a given violation type
    threshold: a score is only returned for a violation type when it exceeds 0.1
    ui_representation: rendered 0-100 in the ActiveOS console as a single aggregated score
  violation_type_naming: >-
    Dotted category.subtype keys, e.g. abusive_or_harmful.hate_speech,
    prompt_injection.general, privacy_violation.PII, self_harm.general,
    unauthorised_sales.weapons, deny_topics.financial_advice.
  detection_type:
    values: [manual]
    meaning: >-
      Only present when the decision was made by a human reviewer in the console rather than by
      a model.
latency_benchmarks:
  measured: server-side, excluding network latency
  source: https://docs.activefence.com/index.html
  values:
  - {media: text, p50: 100ms, p90: 250ms}
  - {media: image, p50: 1s, p90: 5s}
  - {media: video-1min, p50: 10s, p90: 15s}
  - {media: video-5min, p50: 1m, p90: 1.5m}
  - {media: video-30min, p50: 3m, p90: 3.5m}
  - {media: audio-30sec, p50: 6s, p90: 8s}
  - {media: audio-60sec, p50: 8s, p90: 11s}
  - {media: audio-30min, p50: 15m, p90: 20m}
content_types:
  request: [application/json, multipart/form-data]
  response: [application/json, application/xml]
  note: >-
    The synchronous responses declare application/xml and multipart/form-data alongside JSON;
    the asynchronous responses declare JSON only.