Privacy masks · API reference
A pilot's home and custom masks, set by the pilot's own app: fixes inside them leave every shared layer.
GET /v1/privacy-masks
The privacy masks of a pilot
The pilot's masks with their geometry, oldest first; an unknown pilot has none. The
pilot is named in the X-Pilot-Hash header, not in the address.
Authentication: X-Api-Key header; required scope: scope table.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
X-Pilot-Hash required | header | string | HMAC-SHA256 of the client's pilot id, 64 hex characters; the same value as external_pilot_hash of the uploads^[0-9a-fA-F]{64}$ |
Responses
| Status | Description | Content |
|---|---|---|
200 | Successful Response | application/json → PilotMaskList |
401 | code: auth_missing, auth_invalid, auth_revoked | application/json → ErrorBody |
403 | code: auth_scope | application/json → ErrorBody |
422 | code: request_invalid | application/json → ErrorBody |
429 | code: rate_limited, quota_exceeded (Retry-After seconds)Headers: Retry-After — Seconds until the exhausted window resets | application/json → ErrorBody |
POST /v1/privacy-masks
Add a home or custom privacy mask for a pilot
The pilot's fixes inside the mask leave every shared layer: within minutes the pilot's flights are processed again with it, within 24 hours every published grid cell, thermal, take-off/landing and skyway count is recomputed without them. The public replay of a shared flight hides the area at once. An unknown pilot is created, so a mask set before the first upload covers it.
Authentication: X-Api-Key header; required scope: scope table.
Request body
application/json → PilotMaskCreate
Responses
| Status | Description | Content |
|---|---|---|
201 | Successful Response | application/json → PilotMaskReceipt |
401 | code: auth_missing, auth_invalid, auth_revoked | application/json → ErrorBody |
403 | code: auth_scope | application/json → ErrorBody |
409 | code: home_mask_exists, mask_limit | application/json → ErrorBody |
422 | code: mask_invalid, request_invalid | application/json → ErrorBody |
429 | code: rate_limited, quota_exceeded (Retry-After seconds)Headers: Retry-After — Seconds until the exhausted window resets | application/json → ErrorBody |
DELETE /v1/privacy-masks/{mask_id}
Remove a privacy mask of a pilot
The pilot's flights are processed again without the mask; its fixes may then count in the shared layers again (threshold rules unchanged).
Authentication: X-Api-Key header; required scope: scope table.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
mask_id required | path | string (uuid) | id of the mask |
X-Pilot-Hash required | header | string | HMAC-SHA256 of the client's pilot id, 64 hex characters; the same value as external_pilot_hash of the uploads^[0-9a-fA-F]{64}$ |
Responses
| Status | Description | Content |
|---|---|---|
200 | Successful Response | application/json → PilotMaskReceipt |
401 | code: auth_missing, auth_invalid, auth_revoked | application/json → ErrorBody |
403 | code: auth_scope | application/json → ErrorBody |
404 | code: mask_not_found | application/json → ErrorBody |
422 | code: request_invalid | application/json → ErrorBody |
429 | code: rate_limited, quota_exceeded (Retry-After seconds)Headers: Retry-After — Seconds until the exhausted window resets | application/json → ErrorBody |