Skip to main content

Review Feature

The review feature allows a human reviewer to validate and correct API extraction results before they are finalized. This is useful for high-accuracy workflows where automated results need manual verification.

info

This feature is only available for V2 and above API endpoints.

How It Works​

  1. Send a request with review headers enabled.
  2. Receive a review_url in the response — this is a link to the review page.
  3. A reviewer corrects the results on the review page.
  4. AIGEN sends the corrected data to your x-redirect-url callback with a signed payload.

Step 1: Enable Review in Your Request​

Add these headers to your API request:

HeaderTypeDescription
x-review-flowstringSet to "true" to enable the review feature
x-redirect-urlstringYour callback URL to receive corrected results
x-review-expirestringReview link expiration in seconds (default: 3600)
curl -X POST '<API_ENDPOINT>' \
-H 'X-AIGEN-KEY: <KEY>' \
-H 'x-review-flow: true' \
-H 'x-redirect-url: https://example.com/callback' \
-H 'x-review-expire: 3600' \
-H 'Content-Type: application/json' \
-d '{"image": "<base64_string>"}'

Step 2: Get the Review URL​

The API response will include a links.review_url field:

{
"status": "success",
"data": [ ... ],
"links": {
"review_url": "https://review.aigen.online/..."
}
}

Share this URL with a reviewer. The link expires after the duration set in x-review-expire.

Step 3: Receive Corrected Results​

After the reviewer submits corrections, AIGEN redirects to your x-redirect-url with two query parameters:

ParameterDescription
dataCorrected JSON response data, Base64url-encoded
signatureHMAC-SHA256 signature of the data for verification

Verifying the Signature​

Always verify the signature to ensure the callback is from AIGEN and the data has not been tampered with.

  1. Decode the data parameter from Base64url.
  2. Compute the HMAC-SHA256 digest using your API key as the secret.
  3. Compare the computed signature with the received signature.
import base64
import hashlib
import hmac

API_KEY = "your_api_key"
received_signature = b"..." # from query parameter
received_data = b"..." # from query parameter

# Decode and verify
decoded_data = base64.urlsafe_b64decode(received_data)
computed_hash = hmac.new(
API_KEY.encode("utf-8"),
decoded_data,
hashlib.sha256
).digest()
computed_signature = base64.urlsafe_b64encode(computed_hash).rstrip(b"=")

if computed_signature == received_signature:
print("Signature verified - data is authentic")
else:
print("Signature mismatch - data may be tampered")