> ## Documentation Index > Fetch the complete documentation index at: https://docs.nvisy.com/llms.txt > Use this file to discover all available pages before exploring further. # Get redaction review > Returns the redaction's review audit: the detection analysis with the reviewer's edits applied and the per-entity redaction outcome recorded. ## OpenAPI ````yaml /api-reference/openapi.json get /workspaces/{workspaceId}/redactions/{redactionId}/review openapi: 3.1.0 info: title: Nvisy API summary: Document detection and redaction platform description: >- Nvisy provides intelligent detection of sensitive content in documents, redaction pipelines, and reviewer workflows. This API enables document upload, detection analysis, redaction, and collaborative review across your workspaces. termsOfService: https://nvisy.com/legal/terms-of-service contact: name: Nvisy Support url: https://nvisy.com email: hello@nvisy.com license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 version: 0.1.0 servers: [] security: [] tags: - name: Health description: Service health checks - name: Capabilities description: Read-only reference data describing this deployment - name: Accounts description: Account management and profile operations - name: Identities description: 'Account sign-in methods: password and linked providers' - name: Avatars description: Public avatar image serving - name: Authentication description: Login, signup, and token management - name: Workspaces description: Workspace creation and management - name: Activities description: Workspace activity log and export - name: Documents description: Document upload, download, and management - name: Analytics description: Aggregate metrics over a workspace's documents - name: Members description: Workspace member management - name: Invites description: Workspace invitation handling - name: API Tokens description: API token management - name: Connections description: External provider connections - name: Connection Syncs description: Connection synchronization runs - name: Providers description: Inference-provider configuration - name: Pipelines description: Redaction pipeline configuration - name: Detections description: Detection analysis and redaction - name: Redactions description: Redactions produced from a detection, with reviewer edits - name: Reviews description: Document reviews, the review queue, and their discussion - name: Policies description: Redaction policy configuration - name: Webhooks description: Webhook configuration - name: Notifications description: Account notification management paths: /workspaces/{workspaceId}/redactions/{redactionId}/review: get: tags: - Redactions summary: Get redaction review description: >- Returns the redaction's review audit: the detection analysis with the reviewer's edits applied and the per-entity redaction outcome recorded. parameters: - in: path name: workspaceId description: Workspace identifier. required: true schema: description: Workspace identifier. type: string format: uuid style: simple - in: path name: redactionId description: Opaque identifier of the redaction. required: true schema: $ref: '#/components/schemas/RedactionId' description: Opaque identifier of the redaction. style: simple responses: '200': description: >- What detection found in one document. Wraps elide's [`Report`] with the things elide does not model: the recognition [`DocumentContext`] the entities were scored against, how the document decoded, and what the pass cost. Reviewer edits are not here. They are the caller's own input, applied to the report before anonymize ([`EditSet::apply`](crate::entity::EditSet::apply)), so an audit carries what analysis found *as amended* rather than the amendments themselves. # Serialization [`Serialize`] but deliberately **not** `Deserialize`: a serialized report tags entity groups by modality *name*, so rebuilding one needs the registry [`Engine`] holds. Read an audit back with [`Engine::deserialize_audit`]. # Schema Generate under the **serialize** contract ([`SchemaSettings::for_serialize`]). `usage` is `skip_serializing_if`, and only that contract marks it optional — `schema_for!` defaults to deserialize and declares it required, so a generated client would reject responses this crate really emits. [`Engine`]: super::Engine [`Engine::deserialize_audit`]: super::Engine::deserialize_audit [`Report`]: elide::Report [`SchemaSettings::for_serialize`]: schemars::generate::SchemaSettings::for_serialize content: application/json: schema: $ref: '#/components/schemas/Audit' '401': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - BearerAuth: [] components: schemas: RedactionId: description: Opaque redaction identifier (redaction_). type: string pattern: >- ^redaction_[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ Audit: description: >- What detection found in one document. Wraps elide's [`Report`] with the things elide does not model: the recognition [`DocumentContext`] the entities were scored against, how the document decoded, and what the pass cost. Reviewer edits are not here. They are the caller's own input, applied to the report before anonymize ([`EditSet::apply`](crate::entity::EditSet::apply)), so an audit carries what analysis found *as amended* rather than the amendments themselves. # Serialization [`Serialize`] but deliberately **not** `Deserialize`: a serialized report tags entity groups by modality *name*, so rebuilding one needs the registry [`Engine`] holds. Read an audit back with [`Engine::deserialize_audit`]. # Schema Generate under the **serialize** contract ([`SchemaSettings::for_serialize`]). `usage` is `skip_serializing_if`, and only that contract marks it optional — `schema_for!` defaults to deserialize and declares it required, so a generated client would reject responses this crate really emits. [`Engine`]: super::Engine [`Engine::deserialize_audit`]: super::Engine::deserialize_audit [`Report`]: elide::Report [`SchemaSettings::for_serialize`]: schemars::generate::SchemaSettings::for_serialize type: object properties: codec: description: |- How this document was decoded when it was analyzed. Carried back so anonymize decodes identically: the entity offsets below are stored against the first decode, and a differently-rendered second one would not line up. allOf: - $ref: '#/components/schemas/CodecParams' context: description: |- What the caller asserted when this document was analyzed: languages, jurisdictions, document tags. Carried back so [`Engine::anonymize`] compiles against the same vocabulary analyze used, and re-decodes under the same codec configuration, without the caller re-passing it. [`Engine::anonymize`]: super::Engine::anonymize allOf: - $ref: '#/components/schemas/DocumentContext' recognition: description: |- The vocabularies this request introduced: labels elide does not ship, and how they were found. Carried back for the same reason [`context`] is. Anonymize compiles its catalog afresh, and a custom label missing from it resolves to nothing — the entity would be detected and then silently not redacted. [`context`]: Audit::context type: array items: $ref: '#/components/schemas/Recognition' report: description: |- The detections: elide's own report, every document and the parts nested in one, each entity carrying its provenance chain. Edit it through [`Report`]'s own API — [`include_part`], [`suppress_part`], [`part_entities`] — for the decisions elide models. [`Report`]: elide::Report [`include_part`]: elide::Report::include_part [`suppress_part`]: elide::Report::suppress_part [`part_entities`]: elide::Report::part_entities allOf: - $ref: '#/components/schemas/Report' usage: description: |- What the analyze pass cost: one entry per recognizer and enricher that ran, each self-identifying by the name the deployment configured it under. Carried here rather than read off the report: elide derives usage during analysis and drops it when a report is rebuilt from the wire, so a host that bills on model spend would lose it on the round trip. allOf: - $ref: '#/components/schemas/UsageReport' required: - report - context - codec - usage ErrorResponse: description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error type: object properties: message: description: User-friendly error message safe for client display. type: string name: description: The error name/type identifier. type: string required: - name - message CodecParams: description: |- How the codec decodes this document. Defaults to the codec's own behaviour, so a caller with no opinion passes [`CodecParams::default`]. type: object properties: rasterMode: description: |- How container formats carrying both a text layer and page images treat OCR. Defaults to [`RasterMode::Auto`], the codec's own behaviour. allOf: - $ref: '#/components/schemas/RasterMode' default: kind: auto DocumentContext: description: |- What a caller asserts about the document being processed. Everything defaults to empty, so a caller asserting nothing passes [`DocumentContext::default`] and lets the recognizers use their own defaults. type: object properties: countries: description: |- Jurisdictions the caller asserts apply. Read by policy predicates that vary by jurisdiction, so a rule can act on a document from one country and not another. type: array items: $ref: '#/components/schemas/CountryCode' languages: description: |- Languages the caller asserts the document is in. Recognizers that take a language hint use it; the language-detection enricher fills the gap when this is empty. allOf: - $ref: '#/components/schemas/Languages' default: [] metadata: description: |- Free-form request context: document tags, request purpose, output audience. See elide's [`ScopeMetadata`]. allOf: - $ref: '#/components/schemas/ScopeMetadata' Recognition: description: |- Labels a request introduces, and how to detect them. The two halves are independent, and only one pairing is an error. A label with no matcher is legitimate: it joins the catalog, a policy may scope it, and a reviewer may add entities under it through [`Edit::Add`]. Nothing detects it automatically — there is no matcher to look for it — which is the point when the label marks something only a human can recognise. A matcher with no label is refused, since it would detect into a vocabulary the catalog never held. [`Edit::Add`]: https://docs.rs/elide-review type: object properties: custom: description: |- Label schemas elide does not ship. Only for labels outside the shipped set: one whose id collides with a builtin is refused, since it would shadow elide's own definition. type: array items: $ref: '#/components/schemas/Label' matchers: description: |- How to detect the labels [`custom`] introduces. Each names a label this request declares. Compiled fresh per request, so a request introducing none costs nothing. [`custom`]: Self::custom type: array items: $ref: '#/components/schemas/CustomMatcher' Report: type: object properties: parts: type: array items: discriminator: propertyName: modality oneOf: - type: object properties: entities: type: array items: $ref: '#/components/schemas/TextEntity' id: type: array items: type: string minItems: 1 modality: type: string const: text required: - id - modality - entities - type: object properties: entities: type: array items: $ref: '#/components/schemas/ImageEntity' id: type: array items: type: string minItems: 1 modality: type: string const: image required: - id - modality - entities - type: object properties: entities: type: array items: $ref: '#/components/schemas/AudioEntity' id: type: array items: type: string minItems: 1 modality: type: string const: audio required: - id - modality - entities - type: object properties: entities: type: array items: $ref: '#/components/schemas/TabularEntity' id: type: array items: type: string minItems: 1 modality: type: string const: tabular required: - id - modality - entities usage: $ref: '#/components/schemas/UsageReport' required: - parts UsageReport: description: >- Every recognizer/enricher's [`Usage`] across a whole document analysis, in the order the components ran (the body first, then each part). type: object properties: entries: description: The per-component usage entries, each self-identifying via its `id`. type: array items: $ref: '#/components/schemas/Usage' required: - entries RasterMode: description: >- Policy for rendering a document's pages to images. [`Auto`] is the default: use the text layer where it exists (redact by deleting glyphs) and render only where it is absent. [`Always`] renders every page regardless of the text layer, for documents whose text is missing, garbled, or a watermark. [`Never`] relies on the text layer only. Serializes with an internal `kind` tag (`{"kind": "auto"}`, `{"kind": "always", "dpi": 300}`, `{"kind": "never"}`). [`Auto`]: RasterMode::Auto [`Always`]: RasterMode::Always [`Never`]: RasterMode::Never oneOf: - description: >- Use the text layer where it exists and render pages only where it is absent. The default. (The text-layer-vs-scanned decision defers to the text path today; per-page rendering of scanned pages lands with OCR.) type: object properties: kind: type: string const: auto required: - kind - description: >- Always render pages to images at the given [`Dpi`], ignoring any text layer. For documents whose text layer is missing, garbled, or a watermark. type: object properties: dpi: description: Resolution to render pages at; [`Dpi::OCR`] (300) is typical. allOf: - $ref: '#/components/schemas/Dpi' kind: type: string const: always required: - kind - dpi - description: 'Never render: rely on the text layer only, even if it is absent.' type: object properties: kind: type: string const: never required: - kind CountryCode: description: |- [ISO 3166-1] country, identified by its code. Wraps [`celes::Country`], a static table entry carrying the numeric, alpha-2, and alpha-3 codes together with the country's name. Because every value comes from that fixed table, a `CountryCode` is always a real, recognised country; there is no way to hold an invalid one. Used to scope region-sensitive recognizers (a phone-number or national-id pattern, say) to the country whose format they target. Serializes as its alpha-2 code (e.g. `"US"`). [ISO 3166-1]: https://www.iso.org/iso-3166-country-codes.html type: string Languages: description: |- List of [`Language`]s resolved for one text scan. Built by a detector (one entry per detected region) or by the caller asserting languages. Carried on a [`RecognizerContext`] so every recognizer and the context enhancer can consult the call's languages. [`RecognizerContext`]: crate::recognition::RecognizerContext type: array items: $ref: '#/components/schemas/Language' ScopeMetadata: description: >- Caller-asserted scope shared across every payload of one analysis. Built once with the `with_*` chain and passed by reference to the analyzer, which borrows it into a fresh [`RecognizerContext`] per payload. It holds only what the *caller* asserts about the analysis as a whole, languages, jurisdictions, document labels, the target catalog, a correlation id, none of which depends on the medium, so one [`Scope`] drives a text, image, or audio analysis alike. Per-medium regions (caller-supplied inclusions and exclusions, which are `M::Location`-typed) live in [`Annotations`], attached to the analyzer of that modality. The per-payload working state (NLP artifacts, detected languages) lives on the context, not here. [`RecognizerContext`]: super::RecognizerContext [`Annotations`]: super::annotation::Annotations Free-form, caller-asserted request context: the *document* it is about and the *request* driving it. Three axes of opaque classification strings elide neither ships nor interprets, a downstream policy layer chooses what `"medical"` or `"fraud_detection"` or `"auditor"` mean. They are read in two places: a recognizer may bias its detection on them (the LLM prompt lists them so the model attends to the right terms), and a scope-aware operator predicate may branch on them at selection time (redact the same document differently per [`audience`]). - [`tags`] classify the *document* (`"medical"`, `"gdpr-request"`). - [`purpose`] is why the request exists (`"fraud_detection"`). - [`audience`] is who the redacted output is for (`"support_agent"`, `"auditor"`), the axis PCI-style "same document, two masks" branches on. [`tags`]: Self::tags [`purpose`]: Self::purpose [`audience`]: Self::audience type: object properties: audience: description: >- Who the redacted output is for (e.g. `"support_agent"`, `"auditor"`). The axis a per-audience redaction branches on: one detected document, selected differently per audience. May hold several. type: array default: [] items: type: string purpose: description: >- The caller-asserted business purpose driving this request (e.g. `"fraud_detection"`, `"gdpr_erasure_request"`). A scope-aware operator predicate may skip or swap a rule based on it; a recognizer may bias detection on it. `None` when the caller asserts no purpose. type: string tags: description: |- Document-level classification tags (e.g. `"medical"`, `"gdpr-request"`). Recognizers may use these to bias their behavior for domain-specific terms; those that don't ignore the field. Named `tags`, not `labels`, to keep "label" reserved for the entity taxonomy ([`LabelRef`]/[`LabelCatalog`]): these classify the *document*, whereas the scope's catalog names the entity *types* to emit. [`LabelRef`]: crate::entity::LabelRef [`LabelCatalog`]: crate::entity::LabelCatalog type: array default: [] items: type: string Label: description: >- Kind of sensitive information: a stable [`id`], per-language [`LabelLocale`]s, an optional [`category`], and zero or more tags. # Identity Labels are identified by [`id`], a stable lowercase `snake_case` string (`"phone_number"`), never localized, and the catalog key that a [`LabelRef`] resolves through. Selectors match by id. Derived equality is *structural*: two labels with the same id but different localizations or tags are not `==`; compare [`id`] for identity. # Localization The display name and description are localized per [`LanguageTag`]. English (`"en"`) is required at construction and is the fallback when a requested locale is absent, so [`localization`] always returns some text, NER and LLM read the analysis language's name and description to prompt the model, keyed by the stable id. # Category and tags [`category`] is the single coarse group a label belongs to (`financial`, `health`, `identity`, …), for organizing detected entities by kind. Built-in labels ship with one; a custom label has none unless set. [`tags`] is a free-form list of *cross-cutting* markers a policy selector matches against, sensitivity flags a label may carry several of (`pii`, `phi`, `pci`, `sad`, `secret`). Distinct from the category: a label has at most one category but any number of tags. Custom labels can ship with zero of either. [`id`]: Label::id [`localization`]: Label::localization [`category`]: Label::category [`tags`]: Label::tags type: object properties: category: $ref: '#/components/schemas/Category' id: type: string localizations: $ref: '#/components/schemas/LocalizedText' tags: type: array items: type: string required: - id - localizations - tags CustomMatcher: description: |- How to detect one caller-authored label. Names a label the same request declares in [`custom`]. A matcher for a shipped built-in is rejected: elide already detects those, and two definitions for one label would race in reconciliation. [`custom`]: super::Recognition::custom type: object properties: confidence: description: |- Score stamped on every match. Defaults to `0.6`. Reconciliation keeps the higher-confidence entity when two detections overlap, so this is what decides whether a custom match beats a built-in one covering the same span. type: number format: float default: 0.6000000238418579 label: description: |- The label this detects, which the request must declare in [`custom`](super::Recognition::custom). allOf: - $ref: '#/components/schemas/LabelRef' name: description: |- Human-readable name, recorded in the audit as the recognizer that found the entity, so a trail distinguishes a caller's matcher from a shipped pattern. type: string oneOf: - description: |- A regular expression over the decoded text. Compiled per request against a size limit. The `regex` crate does not backtrack, so a pathological pattern costs compile time rather than match time. type: object properties: kind: type: string const: pattern pattern: description: The expression, in `regex` crate syntax. type: string required: - kind - pattern - description: |- A literal term list, matched whole-word. For the vocabulary a regex describes badly: client names, internal codenames, a fixed roster of identifiers. type: object properties: kind: type: string const: terms terms: description: The literals to scan for. type: array items: type: string required: - kind - terms required: - label - name TextEntity: description: |- Detected piece of sensitive information within some medium. Generic over the [`Modality`] `M`, which is what makes the model multimodal: a text pipeline yields `Entity`, an audio pipeline `Entity