Accepted Input Formats

Input formats accepted by a self-hosted Roboflow Inference server, and how to disable the less secure ones such as pickled numpy payloads and URL image fetching.

Why this matters

The Inference server is designed to be straightforward to integrate, which is why some convenient but potentially less secure data loading methods are available. For production deployments, configuration options let you disable those behaviors.

This page explains how to configure the server to either harden it or enable more flexible behavior, depending on your needs.

Deserialization of pickled numpy objects

One way to send requests to the Inference server is with serialized numpy objects:

import cv2
import pickle
import requests

image = cv2.imread("...")
img_str = pickle.dumps(image)

infer_payload = {
    "model_id": "{project_id}/{model_version}",
    "image": {
        "type": "numpy",
        "value": img_str,
    },
    "api_key": "YOUR_API_KEY",
}

res = requests.post(
    "http://localhost:9001/infer/{task}",
    json=infer_payload,
)

Starting with version v0.14.0, deserialization of this payload type is disabled by default. You can enable it by setting ALLOW_NUMPY_INPUT=True. See the Inference CLI docs for how to run the server with that flag. This option is not available in Roboflow's hosted APIs.

Do not enable this option in production if the server is open to requests from the open internet, or is not locked down to accept only authenticated requests from your workspace's API key.

Sending URLs to inference images

Fetching images from URLs is convenient, but it can expose the server to server-side request forgery (SSRF) attacks:

import requests

infer_payload = {
    "model_id": "{project_id}/{model_version}",
    "image": {
        "type": "url",
        "value": "https://some.com/image.jpg",
    },
    "api_key": "YOUR_API_KEY",
}

res = requests.post(
    "http://localhost:9001/infer/{task}",
    json=infer_payload,
)

This option is enabled by default. We recommend configuring the server with one or more of these environment variables:

• ALLOW_URL_INPUT - set to False to reject image URLs of any kind. Default: True.

• ALLOW_NON_HTTPS_URL_INPUT - set to False to only allow the HTTPS protocol in URLs. Default: False.

• ALLOW_URL_INPUT_WITHOUT_FQDN - set to False to enforce fully qualified domain names only and reject URLs based on IPs. Default: False.

• WHITELISTED_DESTINATIONS_FOR_URL_INPUT - comma-separated list of allowed destinations for URL requests, for example WHITELISTED_DESTINATIONS_FOR_URL_INPUT=192.168.0.15,some.site.com. URLs pointing elsewhere are rejected.

• BLACKLISTED_DESTINATIONS_FOR_URL_INPUT - comma-separated list of forbidden destinations for URL requests.

• ALLOW_LOADING_IMAGES_FROM_LOCAL_FILESYSTEM - set to False to disable local filesystem access to images. Default: True.

• ALLOW_URL_TO_NON_GLOBAL_ADDRESSES - set to False to reject URLs whose host resolves to a non-global address (loopback, private/RFC1918, link-local and cloud metadata 169.254.169.254, CGNAT, IPv6 ULA) and pin the connection to the validated IP so DNS rebinding cannot swap the target. Default: True (scheduled to change to False in Q4 2026).

• VALIDATE_IMAGE_URL_REDIRECTS - set to True to follow redirects one hop at a time and re-validate every hop URL (scheme, FQDN, allow-list, block-list, non-global address) instead of letting the client follow redirects blindly. Default: False (scheduled to change to True in Q4 2026).

• MAX_IMAGE_URL_REDIRECTS - hard cap on the number of redirect hops allowed when fetching a URL image, enforced regardless of VALIDATE_IMAGE_URL_REDIRECTS. Default: 30.

See Securing a Self-Hosted Server for a fuller explanation of the SSRF controls and recommended configurations, and the Inference CLI docs for running the server with specific flags.