Check Artifact

POST

api

artifact

cURL

curl --request POST \
  --url https://eu.whitecircle.com/api/artifact \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'whitecircle-version: <whitecircle-version>' \
  --data '
{
  "content": {
    "kind": "<string>",
    "data": "<string>",
    "mime_type": "<string>",
    "name": "<string>",
    "url": "<string>"
  },
  "deployment_id": "<string>",
  "external_artifact_id": "<string>",
  "external_session_id": "<string>",
  "internal_session_id": "<string>",
  "metadata": {},
  "role": "<string>",
  "span_id": "<string>",
  "trace_id": "<string>"
}
'

import requests

url = "https://eu.whitecircle.com/api/artifact"

payload = {
    "content": {
        "kind": "<string>",
        "data": "<string>",
        "mime_type": "<string>",
        "name": "<string>",
        "url": "<string>"
    },
    "deployment_id": "<string>",
    "external_artifact_id": "<string>",
    "external_session_id": "<string>",
    "internal_session_id": "<string>",
    "metadata": {},
    "role": "<string>",
    "span_id": "<string>",
    "trace_id": "<string>"
}
headers = {
    "whitecircle-version": "<whitecircle-version>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'whitecircle-version': '<whitecircle-version>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    content: {
      kind: '<string>',
      data: '<string>',
      mime_type: '<string>',
      name: '<string>',
      url: '<string>'
    },
    deployment_id: '<string>',
    external_artifact_id: '<string>',
    external_session_id: '<string>',
    internal_session_id: '<string>',
    metadata: {},
    role: '<string>',
    span_id: '<string>',
    trace_id: '<string>'
  })
};

fetch('https://eu.whitecircle.com/api/artifact', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://eu.whitecircle.com/api/artifact",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'content' => [
        'kind' => '<string>',
        'data' => '<string>',
        'mime_type' => '<string>',
        'name' => '<string>',
        'url' => '<string>'
    ],
    'deployment_id' => '<string>',
    'external_artifact_id' => '<string>',
    'external_session_id' => '<string>',
    'internal_session_id' => '<string>',
    'metadata' => [
        
    ],
    'role' => '<string>',
    'span_id' => '<string>',
    'trace_id' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "whitecircle-version: <whitecircle-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://eu.whitecircle.com/api/artifact"

	payload := strings.NewReader("{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("whitecircle-version", "<whitecircle-version>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://eu.whitecircle.com/api/artifact")
  .header("whitecircle-version", "<whitecircle-version>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://eu.whitecircle.com/api/artifact")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["whitecircle-version"] = '<whitecircle-version>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "policies": {},
  "kind": "<string>",
  "status": "<string>",
  "internal_artifact_id": "<string>",
  "flagged": true,
  "updated_at": "<string>",
  "external_artifact_id": "<string>",
  "external_session_id": "<string>",
  "internal_session_id": "<string>",
  "created_at": "<string>",
  "note": "<string>"
}

Check a single content artifact against your deployment’s policies. Use this endpoint to moderate standalone content such as profile pictures, user uploads, AI-generated images, and more.

How It Works

You submit a content artifact (e.g., an image via URL or base64)
White Circle analyzes the content against applicable policies configured in your deployment
You receive a synchronous response with policy violations

Image artifacts are checked synchronously — you receive results immediately in the response.

mime_type is optional for all submission methods. White Circle detects the image format automatically from the content bytes.

Request Overview

Field	Type	Required	Description
`content`	object	✓	Artifact content payload. See Content Constraints below.
`content.kind`	string	✓	Content type: `"image"`
`content.url`	string		URL to fetch the image from. Provide either `url` or `data`, not both.
`content.data`	string		Base64-encoded image data. Provide either `url` or `data`, not both.
`content.mime_type`	string		MIME type (e.g., `image/jpeg`). Auto-detected if omitted.
`deployment_id`	string		Optional deployment override. If omitted, White Circle uses the deployment associated with your API key.
`role`	string		The role that produced this artifact. Controls which policies apply. See Role-Based Filtering below.
`external_artifact_id`	string		Your custom artifact tracking ID. See External Artifact ID below.
`internal_session_id`	string		Attach artifact to an existing session by its system-generated UUID.
`external_session_id`	string		Attach artifact to an existing session by your custom session ID.
`metadata`	object		Arbitrary key-value metadata.

Response Overview

Field	Type	Description
`flagged`	boolean \| null	`true` if any policy was violated. `null` while processing or on failure.
`policies`	object	Map of policy IDs to their violation statuses
`kind`	string	Echo of `content.kind` from request (e.g., `"image"`)
`status`	string	Check status: `"completed"`, `"processing"`, or `"failed"`. Images are always `"completed"`.
`updated_at`	string	ISO 8601 last update timestamp
`internal_artifact_id`	string	System-generated UUID for this artifact
`external_artifact_id`	string	Your custom artifact tracking ID (if provided)
`external_session_id`	string	External ID of the linked session (if attached)
`internal_session_id`	string	System-generated UUID of the linked session (if attached)
`created_at`	string	ISO 8601 creation timestamp
`note`	string	Informational message when applicable (e.g., why an image fetch failed)

Each policy in the policies object includes:

name — Human-readable policy name
flagged — Whether this specific policy was violated
flagged_source — Array of content types that triggered the violation (e.g., ["image"])

Artifact Statuses

Status	Description
`completed`	Check finished. `flagged` contains the result.
`processing`	Async check in progress, reserved for future content types (website, video, audio). `flagged` is `null`.
`failed`	Check could not complete (e.g., image fetch timed out). `flagged` is `null`. See `note` field.

Checking image artifacts is always synchronous — the response always has status "completed".

External Artifact ID

Use external_artifact_id to track artifacts with your own identifiers. This is useful for:

Deduplicating checks for the same content
Looking up results later via Get Artifact Results
Referencing the artifact in session checks by your own ID

{
  "deployment_id": "your-deployment-id",
  "content": {
    "kind": "image",
    "url": "https://cdn.example.com/uploads/avatar-42.jpg"
  },
  "external_artifact_id": "user-avatar-42"
}

If multiple artifacts share the same external_artifact_id, White Circle returns the latest artifact version within the same deployment on lookup.

Attach to a Session

You can optionally attach an artifact to an existing session by providing internal_session_id or external_session_id. This connects the artifact to the session for tracking and analytics.

{
  "deployment_id": "your-deployment-id",
  "content": {
    "kind": "image",
    "url": "https://storage.example.com/uploads/photo.jpg"
  },
  "external_session_id": "user-session-123"
}

To directly attach this artifact to a session, send a session check request referencing it by ID. The artifact won’t be re-checked — White Circle will use the existing result.

The object returned here is also the object you receive inside artifacts[] on the Check Content response.

The session must already exist before you can attach an artifact to it. If the provided session ID doesn’t match any existing session, the artifact is created without a session link.

Sessions can be on any deployment within the same team — the artifact and session don’t need to share the same deployment.

Role-Based Filtering

The role field controls which policies are evaluated against the artifact based on each policy’s Applies To setting (input, output, or any).

`role` value	Policies applied
`"user"`, `"system"`, `"developer"`, `"tool"`	`input` + `any` policies
`"assistant"`	`output` + `any` policies
omitted / `null`	`any` policies only

Use this to apply the right set of policies depending on who produced the content. For example, pass "user" for user-uploaded images and "assistant" for AI-generated images.

{
  "deployment_id": "your-deployment-id",
  "content": {
    "kind": "image",
    "url": "https://cdn.example.com/ai-generated-image.png"
  },
  "role": "assistant"
}

Role strings with postfixes (e.g., "user-12345", "assistant-v2") are normalized to their base role. Invalid role values are treated the same as omitting the field.

Content Constraints

Constraint	Value
Supported formats	JPEG, PNG, WebP, GIF
Max file size	20 MB
Max dimension	8,192 px (width or height)
Max total pixels	50,000,000
URL fetch timeout	5,000 ms
Max URL redirects	5

Authorizations

Authorization

string

header

required

API Key required. Format: Bearer wc-your-api-key

Headers

whitecircle-version

string

required

API Version

Body

application/json

content

object

required

Hide child attributes

content.kind

string

required

content.data

string | null

content.mime_type

string | null

content.name

string | null

content.url

string | null

deployment_id

string | null

external_artifact_id

string | null

external_session_id

string | null

internal_session_id

string | null

metadata

null | object

Hide child attributes

metadata.{key}

object

Hide child attributes

metadata.{key}.{key}

role

string | null

span_id

string | null

trace_id

string | null

Response

Success

policies

object

required

Hide child attributes

policies.{key}

object

Hide child attributes

policies.{key}.flagged

boolean

required

policies.{key}.flagged_source

string[]

required

policies.{key}.name

string

required

kind

string

required

status

string

required

internal_artifact_id

string

required

flagged

boolean | null

updated_at

string | null

external_artifact_id

string | null

external_session_id

string | null

internal_session_id

string | null

created_at

string | null

note

string | null

⌘I

cURL

curl --request POST \
  --url https://eu.whitecircle.com/api/artifact \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'whitecircle-version: <whitecircle-version>' \
  --data '
{
  "content": {
    "kind": "<string>",
    "data": "<string>",
    "mime_type": "<string>",
    "name": "<string>",
    "url": "<string>"
  },
  "deployment_id": "<string>",
  "external_artifact_id": "<string>",
  "external_session_id": "<string>",
  "internal_session_id": "<string>",
  "metadata": {},
  "role": "<string>",
  "span_id": "<string>",
  "trace_id": "<string>"
}
'

import requests

url = "https://eu.whitecircle.com/api/artifact"

payload = {
    "content": {
        "kind": "<string>",
        "data": "<string>",
        "mime_type": "<string>",
        "name": "<string>",
        "url": "<string>"
    },
    "deployment_id": "<string>",
    "external_artifact_id": "<string>",
    "external_session_id": "<string>",
    "internal_session_id": "<string>",
    "metadata": {},
    "role": "<string>",
    "span_id": "<string>",
    "trace_id": "<string>"
}
headers = {
    "whitecircle-version": "<whitecircle-version>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'whitecircle-version': '<whitecircle-version>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    content: {
      kind: '<string>',
      data: '<string>',
      mime_type: '<string>',
      name: '<string>',
      url: '<string>'
    },
    deployment_id: '<string>',
    external_artifact_id: '<string>',
    external_session_id: '<string>',
    internal_session_id: '<string>',
    metadata: {},
    role: '<string>',
    span_id: '<string>',
    trace_id: '<string>'
  })
};

fetch('https://eu.whitecircle.com/api/artifact', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://eu.whitecircle.com/api/artifact",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'content' => [
        'kind' => '<string>',
        'data' => '<string>',
        'mime_type' => '<string>',
        'name' => '<string>',
        'url' => '<string>'
    ],
    'deployment_id' => '<string>',
    'external_artifact_id' => '<string>',
    'external_session_id' => '<string>',
    'internal_session_id' => '<string>',
    'metadata' => [
        
    ],
    'role' => '<string>',
    'span_id' => '<string>',
    'trace_id' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "whitecircle-version: <whitecircle-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://eu.whitecircle.com/api/artifact"

	payload := strings.NewReader("{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("whitecircle-version", "<whitecircle-version>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://eu.whitecircle.com/api/artifact")
  .header("whitecircle-version", "<whitecircle-version>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://eu.whitecircle.com/api/artifact")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["whitecircle-version"] = '<whitecircle-version>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"content\": {\n    \"kind\": \"<string>\",\n    \"data\": \"<string>\",\n    \"mime_type\": \"<string>\",\n    \"name\": \"<string>\",\n    \"url\": \"<string>\"\n  },\n  \"deployment_id\": \"<string>\",\n  \"external_artifact_id\": \"<string>\",\n  \"external_session_id\": \"<string>\",\n  \"internal_session_id\": \"<string>\",\n  \"metadata\": {},\n  \"role\": \"<string>\",\n  \"span_id\": \"<string>\",\n  \"trace_id\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "policies": {},
  "kind": "<string>",
  "status": "<string>",
  "internal_artifact_id": "<string>",
  "flagged": true,
  "updated_at": "<string>",
  "external_artifact_id": "<string>",
  "external_session_id": "<string>",
  "internal_session_id": "<string>",
  "created_at": "<string>",
  "note": "<string>"
}

First Steps

Use Cases

Integrations

Sessions

Artifacts

Policy

Metric

User

How It Works

Request Overview

Response Overview

Artifact Statuses

External Artifact ID

Attach to a Session

Role-Based Filtering

Content Constraints

Authorizations

Headers

Body

Response

​How It Works

​Request Overview

​Response Overview

​Artifact Statuses

​External Artifact ID

​Attach to a Session

​Role-Based Filtering

​Content Constraints

Authorizations

Headers

Body

Response

How It Works

Request Overview

Response Overview

Artifact Statuses

External Artifact ID

Attach to a Session

Role-Based Filtering

Content Constraints