ToxicFilter

ToxicFilter is a content moderation API. A site sends it what its users write (a comment, a profile, a listing, a picture, a conversation) and gets back one of three decisions, allow, review or block, with the reason in words and the fragment that triggered it.

Why three decisions

Forced to choose between publishing and deleting, a strict line eats real posts and a lenient one publishes the abuse. review is where the doubt goes: the site holds it for a person instead of guessing.

And never one toxicity number. Every answer scores fifteen categories apart (spam, scams, harassment, hate, personal data, prompt injection and more), because what a dating app tolerates is not what a children's forum does, and a single score bakes somebody else's policy into every site.

Fast because it rarely needs a model

Most of what people write is an ordinary sentence. Free detectors run first and settle nearly every call in about a millisecond: word lists that see through f*ck and look-alike letters, checksums that tell a real card or IBAN from an order number, the same message arriving forty times, a wall of Cyrillic on a Spanish forum.

A model reads only what they leave open. A check costs one credit, and a model reading adds the tokens it used, rounded up. A spam campaign sent a hundred times is recognised and answered from memory.

What it catches that a single message cannot show

• Pile-ons: thirty different people each writing one rude sentence.
• Approaches to children: a conversation that moves to another app, asks for secrecy and then for photos, reported as what happened and never as an accusation.
• Leads nobody wants: free work in exchange for equity, no budget, a scope that keeps growing, told apart per type so a contact form can drop them.
• Scams by shape: rentals from an owner abroad, jobs that ask you to pay first, borrowed freelance accounts.

Rules per site

An organization groups its sites into projects, each with its own activity, review queue, webhooks and policy. A policy moves the lines, switches categories off, and adds the site's own words. It can be tried in shadow first, to see what it would have done to last week's traffic before it decides anything.

For developers

The whole API is documented at toxicfilter.com/docs: endpoints, the response, categories, policies, webhooks and errors.

Official clients, each with its reference page and its repository:

• PHP: documentation and source on GitHub.
• Python: documentation and source on GitHub.
• JavaScript: documentation and source on GitHub.
• Laravel: Laratox, a validation rule, a facade and a fake for tests, with its source on GitHub.

Every call is idempotent, a 402 is never retried, and what a user wrote is not kept in the database unless the site asks for it.

Status

In production. DuracionDe moderates its forum threads and profiles with it.