curl --request POST \
--url https://api.blindsight.example.com/api/runtime-security/scan/input \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"text": "What is the capital of France?"
}
'{
"uuid": "<string>",
"verdict": "allow",
"injection": {
"score": 0.5,
"label": "INJECTION",
"meta": {}
},
"pii": {
"count": 1,
"categories": [
"<string>"
],
"findings": [
{
"type": "<string>",
"subtype": "<string>",
"score": 0.5,
"snippet": "<string>",
"start": 1,
"end": 1,
"extra": {}
}
]
},
"redacted_text": "<string>",
"latency_ms": 1,
"text_length": 1,
"blocked_reason": "<string>"
}{
"detail": {
"code": "QUOTA_EXCEEDED",
"message": "<string>",
"usage": {
"used": 123,
"limit": 123,
"period_end": "2023-11-07T05:31:56Z"
},
"upgrade_url": "<string>"
}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "<string>"
}Scan
Scan a user prompt before sending it to the LLM
Returns an allow / redact / block verdict for the supplied
text. On redact, use redacted_text instead of the original.
On block, refuse the request and surface blocked_reason.
POST
/
api
/
runtime-security
/
scan
/
input
curl --request POST \
--url https://api.blindsight.example.com/api/runtime-security/scan/input \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"text": "What is the capital of France?"
}
'{
"uuid": "<string>",
"verdict": "allow",
"injection": {
"score": 0.5,
"label": "INJECTION",
"meta": {}
},
"pii": {
"count": 1,
"categories": [
"<string>"
],
"findings": [
{
"type": "<string>",
"subtype": "<string>",
"score": 0.5,
"snippet": "<string>",
"start": 1,
"end": 1,
"extra": {}
}
]
},
"redacted_text": "<string>",
"latency_ms": 1,
"text_length": 1,
"blocked_reason": "<string>"
}{
"detail": {
"code": "QUOTA_EXCEEDED",
"message": "<string>",
"usage": {
"used": 123,
"limit": 123,
"period_end": "2023-11-07T05:31:56Z"
},
"upgrade_url": "<string>"
}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "<string>"
}Authorizations
ApiKeyAuthBlindsightKeyAuthSessionCookieAuth
Blindsight workspace API key (ak_live_…). Use this header for the
scan API and the OpenAI proxy routes. The required permission
scope is runtime_security.scan for scan endpoints,
runtime_security.view for read-only analytics, and
runtime_security.manage for configuration changes.
Body
application/json
Response
Scan complete: verdict in body
Audit-record UUID. Empty when log_events=false.
flag records a suspicion without mutating traffic: an
injection score that crossed the redact threshold without
independent corroboration, or a monitor-mode NER PII
finding. See the Verdicts guide for the full decision logic.
Available options:
allow, flag, redact, block Show child attributes
Show child attributes
Show child attributes
Show child attributes
Original text with detected PII replaced by <CATEGORY> markers.
Equal to the original when verdict=allow. Use this instead
of the original when verdict=redact.
Required range:
x >= 0Required range:
x >= 0Short string explaining why a block verdict fired.