REDAX / EXAMPLES

Practical examples

Copyable request, integration, browser, Redis, telemetry, and production configuration examples for the supported Redax interfaces.

WHYKeep raw customer text outside the model boundary.

WHATA local API that detects, replaces, and records safely.

HOWRun it, send text, pass only returned text onward.

Start with a synthetic value.

Every example below is designed to run against a local Redax process. Replace the example host and credentials through your environment, and never paste real customer data into a tutorial command.

1. Run the local boundary

Compose starts the API, worker, Redis, and local observability services. The API is published on port 8000.

cp .env.example .env
docker compose up -d --build
curl --fail http://localhost:8000/healthz
curl --fail http://localhost:8000/readyz

2. Make one authenticated API call

In production, REDAX_API_KEYS is required. Keep the key in your shell or secret manager; do not put it in frontend JavaScript.

export REDAX_API_KEY='your-local-or-injected-key'
curl --fail --silent --show-error \
  -X POST http://localhost:8000/v1/redact \
  -H "X-API-Key: $REDAX_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: synthetic-checkout-8421' \
  -d '{"text":"Synthetic contact alice@example.com"}'

The returned text is the value that may continue to your downstream model. Treat /v1/detect differently: it is diagnostic and returns original text, so it must not be forwarded as safe output.

3. Use the HTTP boundary from Python

This example uses the actual endpoint and response field. It fails closed: if Redax returns an error, the caller does not send the original message to a model.

import os
import httpx


def redact_before_model(message: str) -> str:
    response = httpx.post(
        os.environ.get("REDAX_URL", "http://localhost:8000") + "/v1/redact",
        headers={"X-API-Key": os.environ["REDAX_API_KEY"]},
        json={"text": message, "use_pipeline": True},
        timeout=30.0,
    )
    response.raise_for_status()
    return response.json()["text"]


safe_message = redact_before_model("Synthetic contact alice@example.com")
# Pass safe_message to your existing model client.
print(safe_message)

4. Browser-local versus server-backed

Browser-localThe public demo runs deterministic structured regex in the browser, shows “REGEX · NO NETWORK,” and does not need an API key. It is illustrative coverage, not server/model parity.

Server-backedThe HTTP API can use the pinned local GLiNER2 model, centralized policy, authentication, Redis jobs, audit, metrics, and OTLP. Call it from your backend; never expose production API keys to browser code.

5. Redis and telemetry inputs

These are application-side environment inputs. HA, persistence, backups, failover, collector retention, and access control remain settings in the platform services around Redax.

REDAX_REDIS_URL=rediss://redis.internal:6380/0
REDAX_REDIS_REQUIRED=true
REDAX_REDIS_NAMESPACE=redax-prod-acme
REDAX_REDIS_CONNECT_TIMEOUT_SECONDS=1.0
REDAX_REDIS_SOCKET_TIMEOUT_SECONDS=1.0
REDAX_OTLP_ENDPOINT=http://otel-collector.internal:4317

6. Production boundary inputs

Inject secrets through your deployment platform. The values below show names and shape, not credentials.

REDAX_ENV=prod
REDAX_API_KEYS=inject-from-secret-manager
REDAX_HASH_SALT=unique-random-deployment-value
REDAX_JOB_PAYLOAD_ENCRYPTION_KEY=generated-fernet-key
REDAX_TRUSTED_HOSTS=redax.example.com
REDAX_DEFAULT_POLICY=default
REDAX_AUDIT_BACKEND=redis
REDAX_AUDIT_INTEGRITY_KEY=independent-audit-secret

Changing these values requires a coordinated restart/redeploy. Follow the configuration reference and run the production launch gate before exposing traffic.