SETUP GUIDE

Private Documents

Workspace owners can upload an extractable text-layer PDF or UTF-8 text file in AntOps, review deterministic masked findings, and create a sanitized text derivative on eligible plans. A server-side API path remains available for programmatic workflows.

Before you start

  • Workspace owner access for the browser path, or a workspace API key for a server-side integration
  • An extractable PDF or UTF-8 plain-text file
  • A workflow that keeps the source document private

Setup

  1. Open Private Documents from the authenticated product chooser.
  2. Upload an extractable PDF or UTF-8 text file within the displayed plan limit.
  3. Wait for processing to complete, then open masked sensitive-data findings.
  4. On eligible plans, create and download the verified sanitized text derivative.
  5. For server-side automation only, use POST /v1/documents and poll GET /v1/documents/{document_id}/status with a workspace API key.

Verify and expected result

The browser shows queued, processing, completed or safe failed status. Completed documents expose masked findings; the browser never displays source text, hashes or storage locations.

No source-document public URL is created. The browser path requires the workspace owner; programmatic metadata, findings and artifacts remain scoped to the workspace API key.

Common safe checks

Upload rejected

Use an extractable text-layer PDF or UTF-8 text within the displayed plan limit. OCR, archives and remote URLs are not supported.

Processing failed

The original remains private. Review the safe status and retry only after correcting the supported input.

Security and revocation

Use the browser path only from an authenticated owner session. Never expose storage paths, object keys, raw findings or document contents outside authenticated workspace access; keep API keys and source documents out of browser bundles and source control.

Delete the document and its derivatives in Private Documents when the source must be removed. For server-side automation, revoke the API key and remove it from the integration.

Open API documentation