Developer platform
One protected Job API for every PDFit edition. The current preview exposes a stable asynchronous boundary for Merge, Split, Compress, Organize, Images to PDF, PDF to Images, Watermark, and Page Numbers while preserving operation-specific validation and result contracts.
Job API 1. Create POST /api/v1/jobs with an operation and its required PDF or image files.
Job API 2. Track Poll the protected job status using the returned bearer access token.
Job API 3. Download Fetch the result only after the job reaches completed status.
Job API 4. Delete or expire Delete after delivery or let the retention policy remove files automatically.
Create example
Start an Organize job. The access token returned by this request is a secret. Never place it in a URL or log it.
curl -X POST https://pdfit.pro/api/v1/jobs \
-F operation=organize \
-F pages=4,2,1 \
-F rotations=2:90 \
-F files=@document.pdfSecurity contract
Access is scoped to one unpredictable job. Independent tokens Every job receives a 256-bit access token; Core stores only its SHA-256 hash and compares it in constant time.
Header-only authorization Tokens are accepted in the Authorization header, never in query strings that leak into history or access logs.
Bounded processing File count, bytes, signature, page count, concurrency, rate, and processing time are enforced before and during work.
Image conversion is available through both API styles images-to-pdf accepts ordered JPG/PNG files with normalized page-size and margin options. pdf-to-images returns a numbered 144-DPI PNG or JPG archive. Direct multipart endpoints remain available for no-JavaScript forms.
Document decoration is available through both API styles watermark applies normalized printable Unicode text without returning that text in status responses. page-numbers supports six positions, three formats, and a custom starting number. Direct multipart endpoints are also available.
Password-bound operations stay synchronous POST /api/v1/pdf/protect and POST /api/v1/pdf/unlock accept one multipart PDF and request-local password fields. Passwords are deliberately excluded from the persistent Job API, URLs, logs, and NovaCore analytics.
Browser analytics is not a public ingestion API POST /api/v1/analytics/events is reserved for PDFit's same-origin browser module. It accepts only a fixed privacy-safe vocabulary and cannot be used to submit arbitrary properties, URLs, document metadata, or third-party events.
Community routes are product-facing, not a public write API The public feed can be read at GET /api/v1/community/posts. Publishing, voting, reporting, and moderation require PDFit's protected host-only account session and same-origin browser checks. API keys and third-party Community automation are not released.
Preview access The contract is live for product integration, but public API keys, self-service quotas, billing, SDKs, and an uptime commitment are not released yet.
