# RedactTool: current capability contract

RedactTool 1.3.0. Configure your service base URL and Bearer key.

## Supported inputs and output
PDF (including scans), DOCX, XLSX, TXT, MD. 20 MiB upload cap.
PDF output is rasterized, without a searchable text layer.
DOCX/XLSX retain their format; complex layouts are not universally certified.
Modes: blackout or placeholder (singular). Placeholders are per job.
No exposed restoration mapping or cross-job identity guarantee.
Automatic detection may miss information, particularly handwriting.

## REST lifecycle
Authorization: Bearer API_KEY on every /v1 request.
POST /v1/files: multipart file, bounded upload. Returns file_id.
POST /v1/redactions: JSON file_id, mode; Idempotency-Key header (8–100 word/hyphen characters; ASCII recommended).
Returns job with id, status, stage, done, total, error, mode, redactions, download_url.
GET /v1/redactions/{id}: poll queued/running to completed/failed.
GET /v1/redactions/{id}/file: authenticated download after completed.
Reuse creation key only with the same file and mode. Persist IDs.
A local timeout does not cancel remote processing. No cancellation endpoint.
No webhook, no public download URL, no remote URL import.

## Authentication, limits and data
Current keys are session-bound, up to 24h. New key revokes previous key.
Current trial: global queue 12; per session 2 active / 20 daily jobs.
No permanent API credentials or deployed billing assumed.
Terminal jobs and associated files are eligible for cleanup after 24h. An independent worker checks every 60 seconds; failures are retried. Active jobs and files referenced by active/newer jobs are retained.
Files are processed only on servers managed by RedactTool, using its proprietary redaction engine and dedicated processing pipeline.
Production confidential uploads need verified HTTPS transport.
Do not put credentials in URLs, client-side bundles or prompts.
No SOC2/HIPAA/zero-retention/zero-miss claim is made. Submitted documents are not used for model training. Inference is self-hosted; document content is not sent to third-party LLM APIs.

## MCP
POST /mcp: stateless Streamable HTTP JSON-RPC, Bearer header.
Protocol 2025-03-26. initialize, initialized notification, ping, tools/list, tools/call.
No SSE or OAuth. Client must support custom Bearer header.
First upload bytes via REST. Tools: redact_file(file_id,mode,request_id), get_result(job_id).
Tool response content[].text contains the JSON job. Check result.isError.
Download via REST with same owner key when completed.

## Documentation
- [Quickstart](quickstart.md)
- [API](api.md)
- [MCP](mcp.md)
- [OpenAPI](../../openapi.json)
- [Tool schemas](../../mcp-tools.json)
- [Python example](../examples/redact.py)