Hexloom API / Image metadata inspect API

Image metadata inspect API

Send one JPEG, PNG or WebP as the request body and get back a JSON list of the metadata it carries, so you can see what a photo reveals before you share it.

POST /api/v1/exif/inspect

Try it without a key

curl -X POST https://hexloomlabs.com/api/v1/exif/inspect \
  -H "Content-Type: image/jpeg" \
  --data-binary @photo.jpg

The keyless demo is limited to 1 MB per call and a best-effort rate limit.

With a RapidAPI key

curl -X POST https://hexloom-file-api.p.rapidapi.com/exif/inspect \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "Content-Type: image/jpeg" \
  --data-binary @photo.jpg

The free plan is 100 calls a month; paid plans and prices are shown on the RapidAPI listing before you subscribe. The free plan allows 8 MB per call for this endpoint; paid plans allow 10 MB.

Request

Body: the raw image bytes, Content-Type image/jpeg, image/png or image/webp. A multipart/form-data body with one file part also works, under any field name (the spec calls it image).
One image per call.

Responses

200 JSON: {"ok":true,"kind":"jpeg","found":[["label","value"], ...]}. found is empty when no metadata is present. Long text values are shortened (EXIF text to 256 characters, comments and PNG text to 120) and about 200 rows are listed.
400 empty: no file received. 400 one_file: a multipart body with more than one file. 400 bad_multipart: the multipart body could not be read.
415 unsupported: not a JPEG, PNG or WebP.
422 bad_image: the image looks damaged (for example a truncated PNG or WebP).
422 too_complex: the image has more than 2,000 JPEG segments or 20,000 PNG or WebP chunks, which normal photos do not have.
413 too_large, 429 rate_limited: see limits.

Errors return JSON: {"ok":false,"error":{"code":"...","message":"..."}}.

What it does not do

It reads metadata only; it does not change or return the image.

What we keep

File contents are held in memory for the length of the request and are not stored or logged by this service. Cloudflare, which hosts it, keeps its usual request logs (time, path, size, IP and request headers; key and secret headers are masked). See the privacy policy and terms. Questions: support.