InputGate API docs

Welcome to the InputGate API. This documentation covers everything you need to integrate AI-powered inbound filtering into your forms, emails, automations, webhooks, and AI workflows.

InputGate sits between your inbound traffic and your systems — analyzing content in real time, scoring risk, and returning structured results you can act on immediately. You send form fields as a flexible fields object, and InputGate produces a single combined score across all of them.

Base URL

What you get back

Every request returns a concise JSON object. The score and recommendation are yours to act on — InputGate never blocks anything on your behalf.

Up in 5 minutes.

Get InputGate running with a single API call. No SDK, no configuration file, no complicated setup. If you can make an HTTP request, you're ready.

Step 1 — Get your API key

Sign up at inputgate.cloud, navigate to Settings → API keys, and generate your first key. Keep it secret — treat it like a password.

Step 2 — Send your first request

POST your form data to /v1/check. Use the fields object for all text inputs — include an email key inside it if the form has one. Pass client_ip and domain at the top level for best accuracy. Add a short context string to calibrate the AI to your specific use case.

const response = await fetch("https://api.inputgate.cloud/v1/check", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${'{'}YOUR_API_KEY{'}'}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    fields: {
      email:   "user@example.com",
      name:    "Free Moneymaker",
      message: "Buy cheap meds online! Click here now!!!"
    },
    client_ip: "203.0.113.42",
    domain:    "myapp.com",
    context:   "Contact form on a B2B SaaS landing page",
    retention: "flagged_only"
  })
});

const result = await response.json();
console.log(result);

import requests

response = requests.post(
    "https://api.inputgate.cloud/v1/check",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    json={
        "fields": {
            "email":   "user@example.com",
            "name":    "Free Moneymaker",
            "message": "Buy cheap meds online! Click here now!!!"
        },
        "client_ip": "203.0.113.42",
        "domain":    "myapp.com",
        "context":   "Newsletter signup form for a cooking blog",
        "retention": "flagged_only"
    }
)

result = response.json()
print(result)

curl -X POST https://api.inputgate.cloud/v1/check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "email":   "user@example.com",
      "name":    "Free Moneymaker",
      "message": "Buy cheap meds online! Click here now!!!"
    },
    "client_ip": "203.0.113.42",
    "domain":    "myapp.com",
    "context":   "Job application form on a recruitment platform",
    "retention": "flagged_only"
  }'

$response = file_get_contents('https://api.inputgate.cloud/v1/check', false,
  stream_context_create(['http' => [
    'method' => 'POST',
    'header' => "Authorization: Bearer YOUR_API_KEY\r\nContent-Type: application/json\r\n",
    'content' => json_encode([
      'fields' => [
        'email'   => 'user@example.com',
        'name'    => 'Free Moneymaker',
        'message' => 'Buy cheap meds online! Click here now!!!'
      ],
      'client_ip' => '203.0.113.42',
      'domain'    => 'myapp.com',
      'context'   => 'User feedback form on a mobile productivity app',
      'retention' => 'flagged_only'
    ])
  ]])
);

$result = json_decode($response, true);
var_dump($result);

Step 3 — Handle the response

{
  "spam_score":  94,
  "is_spam":     true,
  "user_reason": "Aggressive promotional language with urgency triggers",
  "latency_ms":  340,
  "request_id":  "ig_req_a1b2c3d4e5f6"
}

API authentication

InputGate uses Bearer token authentication. Include your API key in the Authorization header on every request.

Authorization: Bearer ig_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Key types

Rate limits

Quotas are counted per user account across all API keys, on a calendar-month basis. Exceeding the limit returns a 429 Too Many Requests response.

Limits by plan

Privacy by design

InputGate is built to be GDPR-friendly out of the box. The endpoint accepts personal data (form fields, IP address) only to perform spam analysis on your behalf — it is never used for any other purpose, never sold, never used to train models.

What we store, and for how long

How to handle sensitive forms

For forms collecting health data, government IDs, financial details, or any other special-category data under GDPR Art. 9, pass retention: "none". InputGate will analyse the submission in-memory and discard the fields and IP immediately — only the anonymised quota row remains.

{
  "fields":    { "message": "…sensitive content…" },
  "client_ip": "203.0.113.42",
  "domain":    "clinic.example.com",
  "retention": "none"      // fields + IP discarded immediately after scoring
}

Compliance posture

Check content

The core endpoint. Pass any number of textual form fields as a fields object, and InputGate returns a single combined risk assessment across all of them in real time.

Request parameters

Full example

const response = await fetch("https://api.inputgate.cloud/v1/check", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${'{'}process.env.INPUTGATE_API_KEY{'}'}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    fields: {
      email:   req.body.email,
      name:    req.body.name,
      message: req.body.message
    },
    client_ip:        req.ip,
    domain:           "myapp.com",
    source:           "contact_form",
    retention:        "flagged_only",
    needLanguages:    ["en"],
    blockedLanguages: ["ru", "ar"],
    allowedCountries: ["US", "GB", "CA"]
  })
});

const { is_spam, spam_score, user_reason } = await response.json();
if (spam_score > 75) {
  return res.status(400).json({ error: "Submission blocked." });
}

import requests, os

res = requests.post(
    "https://api.inputgate.cloud/v1/check",
    headers={
        "Authorization": f"Bearer {os.environ['INPUTGATE_API_KEY']}",
        "Content-Type": "application/json"
    },
    json={
        "fields": {
            "email":   form_data["email"],
            "message": form_data["message"]
        },
        "client_ip":        request.remote_addr,
        "domain":           "myapp.com",
        "source":           "contact_form",
        "retention":        "flagged_only",
        "needLanguages":    ["en"],
        "blockedLanguages": ["ru", "ar"],
        "allowedCountries": ["US", "GB", "CA"]
    }
).json()

if res["spam_score"] > 75:
    raise ValueError("Submission blocked")

curl -X POST https://api.inputgate.cloud/v1/check \
  -H "Authorization: Bearer $INPUTGATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "email":   "jane@example.com",
      "message": "Hello, I am interested in your services."
    },
    "client_ip":        "203.0.113.42",
    "domain":           "myapp.com",
    "source":           "contact_form",
    "retention":        "flagged_only",
    "needLanguages":    ["en"],
    "blockedLanguages": ["ru", "ar"],
    "allowedCountries": ["US", "GB", "CA"]
  }'

$payload = json_encode([
  'fields' => [
    'email'   => $_POST['email'],
    'message' => $_POST['message']
  ],
  'client_ip'        => $_SERVER['REMOTE_ADDR'],
  'domain'           => 'myapp.com',
  'source'           => 'contact_form',
  'retention'        => 'flagged_only',
  'needLanguages'    => ['en'],
  'blockedLanguages' => ['ru', 'ar'],
  'allowedCountries' => ['US', 'GB', 'CA']
]);

$ctx = stream_context_create(['http' => [
  'method'  => 'POST',
  'header'  => "Authorization: Bearer " . getenv('INPUTGATE_API_KEY') . "\r\nContent-Type: application/json\r\n",
  'content' => $payload
]]);

$result = json_decode(file_get_contents('https://api.inputgate.cloud/v1/check', false, $ctx), true);

if ($result['spam_score'] > 75) {
  http_response_code(400);
  exit('Submission blocked.');
}

Erase data

Self-serve GDPR Art. 17 erasure. Deletes every log row tied to a given client_ip across all API keys under your account. Idempotent — returns the number of rows deleted plus an audit-trail entry.

Request parameters

Example

curl -X POST https://api.inputgate.cloud/v1/erasure \
  -H "Authorization: Bearer $INPUTGATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"client_ip": "203.0.113.42"}'

{
  "deleted":    12,
  "client_ip":  "203.0.113.42",
  "request_id": "ig_req_8f9f39db48fe"
}

Response fields

Every successful call returns a JSON object with the following fields. All fields are always present — no optional keys in the response.

Error codes

InputGate uses standard HTTP status codes. Errors include a JSON body with error and message fields.

{
  "error":      "invalid_api_key",
  "message":    "The API key provided is invalid or has been revoked.",
  "request_id": "ig_req_a1b2c3d4"
}

Use cases

InputGate fits anywhere inbound data enters your stack. Here are the most common integration patterns.

Platform integrations

InputGate works with any platform that can make an HTTP request. Below are step-by-step patterns for the most common tools.

Make (Integromat)

Add an HTTP → Make a request module between your trigger and your action. Set Method to POST, URL to https://api.inputgate.cloud/v1/check, and add your Authorization header. Map the content field from your trigger data. Use a Router module to branch on is_spam.

Zapier

Use a Webhooks by Zapier → POST action step. Set the URL, add headers, and map your data fields. Then add a Filter step that only continues if is_spam equals false.

n8n

Use the HTTP Request node with Method POST and JSON body. Connect it to an IF node that checks {{ $json["is_spam"] }}. Route the false branch to your downstream action.

API keys & billing

Manage your API keys and billing from the InputGate dashboard at inputgate.cloud/dashboard.

Managing API keys

You can create multiple API keys — for example, one per environment (development, staging, production) or one per integration. Each key can be revoked independently without affecting others.

Monitoring usage

The dashboard shows real-time usage metrics: total requests, spam detection rate, top sources, and a timeline of checks. Use source parameter tagging to break down usage by integration point.

Plans