AI Data Prep Live on RapidAPI & Zyla POST /v1/tabular-rag-cleaner

Tabular CSV/JSON RAG Sanitizer & Spreadsheet Formula-Injection Firewall API

Neutralize CSV formula injection, redact cell-level PII, and convert tables into RAG-ready Markdown & row chunks. Clean CSV/TSV strings or JSON row arrays for RAG ingestion and safe spreadsheet export. Neutralizes =CMD|... formula injection, scans cells for indirect prompt injection, redacts PII, and emits LLM-ready Markdown tables.

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/tabular-rag-cleaner`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "safe": true,
    "verdict": "sanitized",
    "headers": [
      "customer",
      "email",
      "balance",
      "note"
    ],
    "row_count": 1,
    "column_count": 4,
    "clean_markdown_table": "| customer | email | balance | note |\n| --- | --- | --- | --- |\n| Acme Corp | [PII_EMAIL_1] | -120.50 | '=HYPERLINK(\"http://evil.example/leak\", \"Click\") |",
    "row_chunks": [
      "Row 1: customer: Acme Corp | email: [PII_EMAIL_1] | balance: -120.50 | note: '=HYPERLINK(\"http://evil.example/leak\", \"Click\")"
    ],
    "clean_rows": [
      {
        "customer": "Acme Corp",
        "email": "[PII_EMAIL_1]",
        "balance": "-120.50",
        "note": "'=HYPERLINK(\"http://evil.example/leak\", \"Click\")"
      }
    ],
    "stats": {
      "formulas_neutralized": 1,
      "pii_cells_redacted": 1,
      "injection_cells_flagged": 0
    },
    "findings": [
      {
        "row_index": 0,
        "column": "note",
        "kind": "formula_injection",
        "severity": "critical",
        "detail": "Neutralized spreadsheet formula payload (=HYPERLINK(\"http://evil.example/) in column 'note'."
      },
      {
        "row_index": 0,
        "column": "email",
        "kind": "pii_redacted",
        "severity": "medium",
        "detail": "Redacted 1 PII item(s) in column 'email'."
      }
    ]
  },
  "meta": {
    "request_id": "req_tab_01",
    "ms": 2
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/tabular-rag-cleaner" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"csv":"customer,email,balance,note\nAcme Corp,billing@acme.eu,-120.50,=HYPERLINK(\"http://evil.example/leak\", \"Click\")","delimiter":"auto","sanitize_formulas":true,"redact_pii":true,"check_prompt_injection":true}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/tabular-rag-cleaner", {
  "csv": "customer,email,balance,note\nAcme Corp,billing@acme.eu,-120.50,=HYPERLINK(\"http://evil.example/leak\", \"Click\")",
  "delimiter": "auto",
  "sanitize_formulas": true,
  "redact_pii": true,
  "check_prompt_injection": true
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/tabular-rag-cleaner",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "csv": "customer,email,balance,note\nAcme Corp,billing@acme.eu,-120.50,=HYPERLINK(\"http://evil.example/leak\", \"Click\")",
  "delimiter": "auto",
  "sanitize_formulas": true,
  "redact_pii": true,
  "check_prompt_injection": true
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/tabular-rag-cleaner", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "csv": "customer,email,balance,note\nAcme Corp,billing@acme.eu,-120.50,=HYPERLINK(\"http://evil.example/leak\", \"Click\")",
  "delimiter": "auto",
  "sanitize_formulas": true,
  "redact_pii": true,
  "check_prompt_injection": true
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_tabular_rag_cleaner",
    "arguments": {
      "csv": "customer,email,balance,note\nAcme Corp,billing@acme.eu,-120.50,=HYPERLINK(\"http://evil.example/leak\", \"Click\")",
      "delimiter": "auto",
      "sanitize_formulas": true,
      "redact_pii": true,
      "check_prompt_injection": true
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/tabular-rag-cleaner`)

Parameter	Type & Constraints	Description
`csv`optional	`string` minLen: 1, maxLen: 262144	Raw CSV, TSV, or semicolon-delimited table text.
`rows`optional	`object[]`	Optional structured JSON array of row objects instead of raw CSV text.
`delimiter`optional	`"auto" \| "," \| ";" \| "\t" \| "\|"` default: "auto"	Column delimiter for raw text input (default 'auto').
`sanitize_formulas`optional	`boolean` default: true	Neutralize CSV/spreadsheet formula injection payloads (=, +, -, @, DDE commands) by prefixing an apostrophe.
`redact_pii`optional	`boolean` default: true	Redact PII (emails, phones, IBANs, credit cards, national IDs) inside cells.
`check_prompt_injection`optional	`boolean` default: true	Scan cells for indirect prompt-injection instructions hidden in table data.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`safe`	`boolean`	Field 'safe'
`verdict`	`"clean" \| "sanitized" \| "block"`	Field 'verdict'
`headers`	`string[]`	Field 'headers'
`row_count`	`integer`	Field 'row_count'
`column_count`	`integer`	Field 'column_count'
`clean_markdown_table`	`string`	Field 'clean_markdown_table'
`row_chunks`	`string[]`	Field 'row_chunks'
`clean_rows`	`object[]`	Field 'clean_rows'
`stats`	`object`	Field 'stats'
`findings`	`object[]`	Field 'findings'

3. What Tabular CSV/JSON RAG Sanitizer & Formula-Injection Firewall API Detects & Validates

OWASP CSV/Spreadsheet formula injection (=, +, -, @, DDE, HYPERLINK, IMPORTXML, WEBSERVICE) while preserving signed negative numbers (-120.50) and E.164 phone numbers
Cell-level indirect prompt injection hidden inside customer notes or imported CRM fields
Consistent cross-row PII token redaction with clean GFM Markdown table and row-level RAG chunk generation

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Processes up to 500 rows per call in synchronous edge execution; chunk larger CSV files into 500-row batches.
Tested v1.0.6 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Does it corrupt negative numbers like -42.50 when neutralizing formula prefixes?

No—the formula firewall distinguishes numeric literals and international phone numbers from executable spreadsheet formulas.

Why emit both a Markdown table and row_chunks?

Small tables fit in a single prompt as a GFM Markdown table, whereas wide or multi-hundred-row tables retrieve more accurately in vector search when each row chunk embeds its own column headers.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Tabular payloads are parsed and sanitized in memory with zero persistence.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.