The PlantCare Enterprise API implements a Zero Trust security model. Every request is authenticated and validated at multiple layers to ensure crop data privacy and infrastructure integrity.

1. Client-to-API Authorization (API Keys)

Clients authenticate with a permanent, secure pk_ent_ key provided during onboarding. This bearer token is validated instantly by the API Gateway routing layer before any request reaches the backend.

sequenceDiagram participant Client participant GW as "API Gateway" participant KV as "Secret Store" participant API as "Backend Service" Client->>GW: "Request with Bearer pk_ent_..." GW->>KV: "Validate Key & Permissions" alt "Valid Key" GW->>API: "Proxy Request + Identity Headers" else "Invalid Key" GW-->>Client: "401 Unauthorized" end

2. Storage Security (Malware Scanning)

Precision agriculture photo uploads must be clean of malware. Every leaf diagnostic image uploaded to object storage is automatically scanned for signature viruses asynchronously prior to triggering model evaluation.

sequenceDiagram participant GCS as "Object Storage" participant Func as "Scan Function" participant Scan as "Malware Scanner" GCS->>Func: "Event: Object Finalized" Func->>Scan: "Signed Token Scan Request" Scan->>Scan: "Malware Signature Analysis" alt "Infected File" Scan-->>Func: "Status: infected" Func->>GCS: "DELETE Object" Func->>Func: "Log Security Incident" else "Clean File" Scan-->>Func: "Status: clean" end

3. Service-to-Service Authorization

When the Backend Service communicates with internal processing microservices (such as the Image Processor), it completely avoids shared static credentials. The service fetches ephemeral signed identity tokens from the local Cloud Metadata Server.

sequenceDiagram participant API as "Analyze Service" participant Meta as "Metadata Server" participant Proc as "Image Processor" API->>Meta: "Fetch ID Token (Audience: Processor URL)" Meta-->>API: "Signed ID Token" API->>Proc: "POST /process (Authorization: Bearer Token)" Proc->>Proc: "Validate Token Signature" alt "Valid Token" Proc-->>API: "200 OK (Processed Image)" else "Invalid Token" Proc-->>API: "403 Forbidden" end

4. Network Isolation

To further protect internal infrastructure, critical back-end containers (like the Image Processor) are configured with INGRESS_TRAFFIC_INTERNAL_ONLY rules. They are completely unreachable from the public internet, even with valid identity tokens. All internal requests route through secure, private network connectors.

5. Content Moderation & Anti-Spam

Every crop analysis is subject to an automated, tag-based spam filter. The gateway evaluates tags returned by the model to block off-topic or policy-violating uploads before they consume B2B API quotas.

How It Works

  1. The AI diagnostics returns a list of detected_objects (tags) for every uploaded photo.
  2. Each tag is classified into a specific weight category (+10 for off-topic, +100 for abuse).
  3. If the tag sum score exceeds the threshold, the gateway blocks the request and creates an event.
sequenceDiagram participant AI as "AI Model" participant SF as "Spam Filter" participant DB as "Database" participant MQ as "Moderation Queue" AI->>SF: "detected_objects: [car, dog, ...]" SF->>SF: "Score = Σ weight(tag)" alt "Score < 20 (Harmless)" SF-->>AI: "ALLOW" else "Score ≥ 20 (Spam)" SF->>MQ: "Add to queue (ERR_IMAGE_SPAM)" SF->>DB: "IncrementSpamScore(uid)" SF-->>AI: "BLOCK + Quota Refund" else "Abuse tag detected" SF->>MQ: "Add to queue (ERR_SECURITY_VIOLATION)" SF->>DB: "PenalizeUser: 24h lock + +50" SF-->>AI: "BLOCK + Quota Refund" end

Tag Weight Categories

Category Weight Examples
Harmless 0 plant, leaf, hand, table, pot, soil
Off-topic +10 each car, pet, food, screen, clothing, animal
Abuse +100 each weapon, drugs, nudity, id_card, passport, explicit

Enforcement Actions

Score Action Penalty
0–10 ✅ Allowed None
≥20 🚫 Blocked Spam score accumulates; auto-lock at ≥50
≥100 🚫 Blocked Immediate 24h account lock + +50 spam score

Quota protection: Blocked analyses refund the user's quota slot — you are never charged for a blocked analysis.
No-plant guard: If the AI detects no plant in the image (is_plant_present: false), the transaction is sent to the moderation queue without penalty.

Admin Moderation Queue

Administrators can review flagged transactions in the Enterprise Dashboard and choose to:
• Approve — re-process the image, bypassing the spam filter.
• Block — confirm the block and maintain the transaction error.
• Ban User — apply a 24h lock and +50 spam score.