API Documentation for Image Verification System

Overview

This API allows users to request puzzle pieces from an image and verify them using a perceptual hash (pHash) within a given time frame. The system integrates MongoDB for storing user authentication details and request tracking. Users must provide a temporary API key for access.

Endpoints

1. Request Puzzle Pieces

Endpoint: GET /get_puzzle

Headers: - Temp-API-Key: A temporary API key for authentication.

Response: json { "puzzle_pieces": ["piece1_url", "piece2_url", ...], "request_id": "1712345678901", "message": "Please send the perceptual hash within 45 seconds." }

Errors: - 400: Temporary API key missing - 403: Invalid or expired API key

2. Verify Perceptual Hash

Endpoint: POST /verify_phash

Headers: - Temp-API-Key: A temporary API key for authentication.

Request Body: json { "request_id": "1712345678901", "phash": "abc123xyz" }

Response: json { "status": "verified", "message": "pHash verified successfully!" }

Errors: - 400: Missing required fields (e.g., request_id, phash, or API key) - 403: Invalid or expired API key - 400: Invalid request ID - failed: pHash does not match - timeout: Verification timeout

3. Get temp api

Endpoint: POST /generate_temp_api

Method: POST

Description: Generates a temporary API key that is valid for 60 seconds.

Request Body: json { "api_key": "your_main_api_key" }

Responses: - 200 OK json { "temp_api_key": "temp_api_xxxx", "valid_until": "2025-02-06T12:00:00Z", "updated_stats": { "api_key": "your_main_api_key", "temp_api_generated": 1, "temp_api_used": 0, "temp_api_remaining": 4 } } - 400 Bad Request (If api_key is missing) json { "error": "API key is required" } - 403 Forbidden (If no temporary API keys are remaining) json { "error": "No temporary API keys remaining" }

Temporary API Key Validation

The API extracts and validates temporary keys by: 1. Checking the key format. 2. Ensuring it has not expired. 3. Verifying its presence in the database.

If any check fails, the API responds with 403 and an error message.

Timeout Mechanism

Each request is assigned a unique request_id.
If no response is received within 45 seconds, the verification status is updated to timeout.

Security Considerations

API keys should be kept confidential.
Requests and responses should be encrypted via HTTPS.
Rate limiting should be implemented to prevent abuse.

Sample Requests

``` curl --location 'http://leo.aiko:5000/generate_temp_api' \ --header 'Content-Type: application/json' \ --data '{"api_key": "your-api-key"}'

```

curl --location 'http://leo.aiko:5000/get_puzzle' \ --header 'Temp-API-Key: your-temp-api-key'