Decontamination Request

Used for SHIELDEX CDR decontamination requests.

It operates asynchronously, inserting the request into a queue and responding immediately.

The inspection results can be checked through a separate status inquiry API or Callback.

info

Important Notes

Protocol: Uses the HTTP form submission method (multipart/form-data).

Encoding: All text data must be encoded in UTF-8.

Callback: The callback URL isresult.callbackURLYou can set it in the field, and you can receive the results after the neutralization is completed.

Job ID Length: Up to 36 characters are allowed, and exceeding this will result in a validation failure.

Authentication : Authorization: Bearer <API-KEY>Identifies the integration system with the header. The API Key can be issued from the web console → policies → integration system policies. :::

Authentication

For identifying the integrated system during the demilitarization requestAuthorizationIncludes the API Key in the header.

item	value
Header	`Authorization: Bearer <API-KEY>`
Issuance Location	Web Console → Policy → Integration System Policy → Automatic Issuance When Registering Integration System

Authentication Flow

in the web consoleIntegration SystemWhen you register, an API Key will be automatically issued.
(Optional) Integration System inAllowed IPIf you register, requests can only be made from that IP.
When requesting decontaminationAuthorization: Bearer <발급받은 API Key>Includes header.
The server automatically identifies the system with the API Key.

IP Whitelist

If an allowed IP is registered for the API Key, requests from unregistered IPs will be blocked.
If there are no allowed IPs, it is fully allowed (default behavior).

Method

POST /v5/cdr
/v5/cdr/{jobID}

Request Path Parameter

KEY	OBJECT	DESC
jobID	String	Task ID (optional, a time-based UUID will be automatically generated if not entered. Maximum 36 characters)

Request Parts (multipart/form-data)

KEY	OBJECT	DESC
data	JSON	Decontamination Request Data (Required)
file	File	Decontamination Target File (Required)

Request Data JSON Structure

{
  "request": {
    "type": "upload"
  },
  "userinfo": {
    "id": "string",
    "department": "string",
    "name": "string",
    "dutyname": "string"
  },
  "fileinfo": {
    "filename": "string"
  },
  "result": {
    "callbackURL": "string"
  }
}

Request Data Fields

KEY	OBJECT	REQUIRED	DESC
request.type	String	Yes*	Request Type (`upload`fixed)
userinfo.id	String	Yes	User ID (up to 40 characters)
userinfo.department	String	No	User Department (up to 256 characters)
userinfo.name	String	No	Username (up to 40 characters)
userinfo.dutyname	String	No	User Job Title (up to 40 characters)
userinfo.userNumber	Number	No	User Number
fileinfo.filename	String	Yes*	File name (must be the same as the name of the multipart file)
result.callbackURL	String	No	Callback URL (for result notification)

Response Body (json)

KEY	OBJECT	DESC
code	int	Response Code (see table below)
msg	String	Response Message
jobID	String	Work ID (used when querying inspection results)

Response Code

CODE	MESSAGE	DESC
0	success	The declassification request has been received normally. Check the declassification results through the status inquiry API.
1	duplicate	Decontamination request duplicate request occurred (duplicate jobID)
2	Block Message	Block (Validation failure, File creation failure)
3	unavailable agent service	Decontamination service connection failed
5	Sanitization Request Blocked by API Access control.	The request has been blocked due to API access control.

Sample

REQUEST - Upload Type

curl -X POST "{{url}}/v5/cdr" \
  -H "Content-Type: multipart/form-data" \
  -H "Authorization: Bearer your-api-key-here" \
  -F 'data={
    "request": {
      "type": "upload"
    },
    "userinfo": {
      "id": "user001",
      "name": "홍길동",
      "department": "개발팀",
      "dutyname": "개발자"
    },
    "fileinfo": {
      "filename": "test.pdf"
    },
    "result": {
      "callbackURL": "https://your-callback-url.com/callback"
    }
  };type=application/json' \
  -F "file=@/path/to/test.pdf"

RESPONSE - Demilitarization request successful (200 OK)

{
  "code": 0,
  "msg": "success",
  "jobID": "test-job-001"
}

RESPONSE - Service Connection Failed (200 OK)

{
  "code": 3,
  "msg": "unavailable agent service",
  "jobID": "test-job-001"
}

RESPONSE - Missing required fields (400 BAD_REQUEST)

{
  "timestamp": 1767768931518,
  "status": 400,
  "error": "Bad Request",
  "message": "400 BAD_REQUEST \"Invalid or missing fields in JSON: 'request.type'\"",
  "path": "/v5/cdr"
}

RESPONSE - Missing file field (400 BAD_REQUEST)

{
  "code": 2,
  "msg": "Missing required file: 'file', The request must include a file upload in the 'file' field.",
  "jobID": "test-job-001"
}

RESPONSE - Access Denied (200 OK)

{
  "code": 5,
  "msg": "Sanitization Request Blocked by API Access control.",
  "jobID": "test-job-001"
}

RESPONSE - API Key authentication failed (401 Unauthorized)

{
  "code": 5,
  "msg": "The API Key is invalid. Please verify the API Key.",
  "jobID": ""
}

RESPONSE - IP Blocking (403 Forbidden)

{
  "code": 5,
  "msg": "Access denied. IP address 10.10.1.50 is not in the allowed list for this API Key.",
  "jobID": ""
}

warning

Reference - code 5 (API Access Control)

The above response is HTTP 200, but the bodycodeWhen it is 5 days and the demilitarization request is blocked by API access control.

1. Integration System Registration (Preparation)

Menu:Policy → Integration System Policy → Integration System Registration

When you register an external system to be linked, an API Key will be automatically issued.

Issued API KeyAuthorization: BearerPlease include in the header.

(Optional) If you register allowed IPs, requests can only be made from those IPs.

2. Access Control Logs (Block·Allow Confirmation)

Menu:log → API request log

in the list for that request (orjobID·Find the row that matches the time zone.

Control StateColumn:차단Recognition허용I confirm recognition.

If it is blocked, it is blocked by the access control policy, and the request only passes when it is allowed. :::

Callback

upon requestresult.callbackURLIf a URL is entered in the field, the results will be sent to that URL once the de-identification process is complete.

You can receive the deactivation results through the status inquiry API or via a callback.

The overall specification of the response is Decontamination Response (Result Specification) **Please refer to the document.**In the callback specification, there are additional classification values.detailCode(Activation upon integration agreement) and processing server informationserveris sent together. Callback messagemsgis"success"fixed, and the result reason text islogReasonMsgIt will be delivered.

Callback API JSON

{
  "jobID": "test-job-001",
  "code": 0,
  "detailCode": 0,
  "logReason": 200000,
  "logReasonMsg": "파일 재구성 완료",
  "msg": "success",
  "server": {
    "serverId": "A64B2A42-99AF-CF00-29C1-366B9CCFE002",
    "serverName": "SANITIZE-NODE-01",
    "ipList": ["10.10.12.226"],
    "macList": ["00:50:56:aa:41:ec"]
  }
}

{
  "jobID": "test-job-001",
  "code": 2,
  "detailCode": 1,
  "logReason": 220355,
  "logReasonMsg": "[차단] 확장자 위변조 파일 차단",
  "msg": "success",
  "server": {
    "serverId": "A64B2A42-99AF-CF00-29C1-366B9CCFE002",
    "serverName": "SANITIZE-NODE-01",
    "ipList": ["10.10.12.226"],
    "macList": ["00:50:56:aa:41:ec"]
  }
}

Authentication​

Authentication Flow​

IP Whitelist​

Method​

Request Path Parameter​

Request Parts (multipart/form-data)​

Request Data JSON Structure​

Request Data Fields​

Response Body (json)​

Response Code​

Sample​

REQUEST - Upload Type​

RESPONSE - Demilitarization request successful (200 OK)​

RESPONSE - Service Connection Failed (200 OK)​

RESPONSE - Missing required fields (400 BAD_REQUEST)​

RESPONSE - Missing file field (400 BAD_REQUEST)​

RESPONSE - Access Denied (200 OK)​

RESPONSE - API Key authentication failed (401 Unauthorized)​

RESPONSE - IP Blocking (403 Forbidden)​

Callback​

Callback API JSON​