Hexloom API

Two tools, three endpoints: merge PDFs, and inspect or strip location and camera metadata from images. Files are handled in memory for the length of the request and are not stored.

Endpoints

Endpoint	What it does
`POST /api/v1/pdf/merge`	Merges 2 to 20 PDFs (multipart fields, in the order sent). Output limited to 500 pages.
`POST /api/v1/exif/strip`	Removes EXIF, GPS and other metadata from JPEG, PNG or WebP without re-encoding pixels.
`POST /api/v1/exif/inspect`	Lists the metadata found in an image, as JSON.
`GET /api/v1/status`	Health check.

Try it

curl -X POST https://hexloomlabs.com/api/v1/pdf/merge \
  -F file1=@first.pdf -F file2=@second.pdf -o merged.pdf

curl -X POST https://hexloomlabs.com/api/v1/exif/strip \
  -F image=@photo.jpg -o clean.jpg

The full contract is in the OpenAPI spec.

Limits

Keyless demo: 1 MB per call, best-effort rate limit.
RapidAPI free plan: 1 MB per call for PDF merge and 8 MB per call for the two photo endpoints. Paid plans: 10 MB per call. Plans and prices are shown on the listing before you subscribe. Get a key on RapidAPI (free plan: 100 calls a month).
Errors return JSON with a code and a message, for example 413 too_large or 429 rate_limited.
Do not put an API key in browser code.

Authentication and CORS

Keyless demo at https://hexloomlabs.com/api/v1: no key needed, 1 MB per call.
RapidAPI plans (free plan: 1 MB per call for PDF merge, 8 MB for the photo endpoints; paid plans: 10 MB): subscribe on RapidAPI and send your key in the X-RapidAPI-Key header to the endpoint shown on the listing (host hexloom-file-api.p.rapidapi.com). Plan limits are enforced there. The keyless demo URL at hexloomlabs.com/api/v1 takes no key and is limited to 1 MB per call.
CORS: the endpoints at hexloomlabs.com/api/v1 send Access-Control-Allow-Origin: *, so the keyless demo can be called from a browser. Keep real keys on a server.

What we keep

File contents are not stored or logged by this service. Cloudflare, which hosts it, keeps its usual request logs (time, path, size, IP and request headers; key and secret headers are masked). See the privacy policy and terms. Questions: support.