Skip to main content
POST
/
api
/
runtime-security
/
scan
/
input
curl --request POST \
  --url https://api.antidote.example.com/api/runtime-security/scan/input \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "text": "What is the capital of France?"
}
'
{
  "uuid": "<string>",
  "injection": {
    "score": 0.5,
    "meta": {}
  },
  "pii": {
    "count": 1,
    "categories": [
      "<string>"
    ],
    "findings": [
      {
        "type": "<string>",
        "subtype": "<string>",
        "score": 0.5,
        "snippet": "<string>",
        "start": 1,
        "end": 1,
        "extra": {}
      }
    ]
  },
  "redacted_text": "<string>",
  "latency_ms": 1,
  "text_length": 1,
  "blocked_reason": "<string>"
}

Authorizations

​
X-API-Key
string
header
required

Antidote workspace API key (ak_live_…). Use this header for the scan API and the OpenAI proxy routes. The required permission scope is runtime_security.scan for scan endpoints, runtime_security.view for read-only analytics, and runtime_security.manage for configuration changes.

Body

application/json
​
text
string
required

The prompt about to be sent to the LLM.

​
source_app
string

Free-form app identifier kept on the audit row.

Maximum string length: 128
​
provider
string
Maximum string length: 32
​
model
string
Maximum string length: 128
​
metadata
object

Response

Scan complete — verdict in body

​
uuid
string
required

Audit-record UUID. Empty when log_events=false.

​
verdict
enum<string>
required
Available options:
allow,
redact,
block
​
injection
object
required
​
pii
object
required
​
redacted_text
string
required

Original text with detected PII replaced by <CATEGORY> markers. Equal to the original when verdict=allow. Use this instead of the original when verdict=redact.

​
latency_ms
integer
required
Required range: x >= 0
​
text_length
integer
required
Required range: x >= 0
​
blocked_reason
string | null

Short string explaining why a block verdict fired.