Scan a user prompt before sending it to the LLM

curl --request POST \
  --url https://api.blindsight.example.com/api/runtime-security/scan/input \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "text": "What is the capital of France?"
}
'

{
  "uuid": "<string>",
  "injection": {
    "score": 0.5,
    "meta": {}
  },
  "pii": {
    "count": 1,
    "categories": [
      "<string>"
    ],
    "findings": [
      {
        "type": "<string>",
        "subtype": "<string>",
        "score": 0.5,
        "snippet": "<string>",
        "start": 1,
        "end": 1,
        "extra": {}
      }
    ]
  },
  "redacted_text": "<string>",
  "latency_ms": 1,
  "text_length": 1,
  "blocked_reason": "<string>"
}

{
  "detail": {
    "code": "QUOTA_EXCEEDED",
    "message": "<string>",
    "usage": {
      "used": 123,
      "limit": 123,
      "period_end": "2023-11-07T05:31:56Z"
    },
    "upgrade_url": "<string>"
  }
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "<string>"
}

{
  "detail": "<string>"
}

POST

api

runtime-security

scan

input

curl --request POST \
  --url https://api.blindsight.example.com/api/runtime-security/scan/input \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "text": "What is the capital of France?"
}
'

{
  "uuid": "<string>",
  "injection": {
    "score": 0.5,
    "meta": {}
  },
  "pii": {
    "count": 1,
    "categories": [
      "<string>"
    ],
    "findings": [
      {
        "type": "<string>",
        "subtype": "<string>",
        "score": 0.5,
        "snippet": "<string>",
        "start": 1,
        "end": 1,
        "extra": {}
      }
    ]
  },
  "redacted_text": "<string>",
  "latency_ms": 1,
  "text_length": 1,
  "blocked_reason": "<string>"
}

{
  "detail": {
    "code": "QUOTA_EXCEEDED",
    "message": "<string>",
    "usage": {
      "used": 123,
      "limit": 123,
      "period_end": "2023-11-07T05:31:56Z"
    },
    "upgrade_url": "<string>"
  }
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "<string>"
}

{
  "detail": "<string>"
}

Authorizations

X-API-Key

string

header

required

Blindsight workspace API key (ak_live_…). Use this header for the scan API and the OpenAI proxy routes. The required permission scope is runtime_security.scan for scan endpoints, runtime_security.view for read-only analytics, and runtime_security.manage for configuration changes.

Body

application/json

text

string

required

The prompt about to be sent to the LLM.

source_app

string

Free-form app identifier kept on the audit row.

Maximum string length: 128

provider

string

Maximum string length: 32

model

string

Maximum string length: 128

metadata

object

Response

Scan complete — verdict in body

uuid

string

required

Audit-record UUID. Empty when log_events=false.

verdict

enum<string>

required

flag records a suspicion without mutating traffic: an injection score that crossed the redact threshold without independent corroboration, or a monitor-mode NER PII finding. See the Verdicts guide for the full decision logic.

Available options:

allow,

flag,

redact,

block

injection

object

required

Show child attributes

pii

object

required

Show child attributes

redacted_text

string

required

Original text with detected PII replaced by <CATEGORY> markers. Equal to the original when verdict=allow. Use this instead of the original when verdict=redact.

latency_ms

integer

required

Required range: x >= 0

text_length

integer

required

Required range: x >= 0

blocked_reason

string | null

Short string explaining why a block verdict fired.

Anthropic Messages Scan an LLM response before returning it to the user

Overview

Blindsight API

Runtime Security API

Scan a user prompt before sending it to the LLM

Authorizations

Body

Response