Scan an agent tool invocation before executing it

curl --request POST \
  --url https://api.blindsight.example.com/api/runtime-security/scan/tool-call \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "tool_name": "http_get",
  "arguments": {
    "url": "http://169.254.169.254/latest/meta-data/iam"
  }
}
'

{
  "uuid": "<string>",
  "reasons": [
    {
      "severity": "block",
      "detail": "<string>"
    }
  ],
  "redacted_arguments": "<unknown>",
  "pii": {
    "count": 123,
    "categories": [
      "<string>"
    ],
    "findings": [
      {
        "type": "<string>",
        "subtype": "<string>",
        "score": 0.5,
        "snippet": "<string>",
        "start": 1,
        "end": 1,
        "extra": {}
      }
    ]
  },
  "arg_bytes": 123,
  "latency_ms": 123,
  "blocked_reason": "<string>"
}

{
  "detail": {
    "code": "QUOTA_EXCEEDED",
    "message": "<string>",
    "usage": {
      "used": 123,
      "limit": 123,
      "period_end": "2023-11-07T05:31:56Z"
    },
    "upgrade_url": "<string>"
  }
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

POST

api

runtime-security

scan

tool-call

curl --request POST \
  --url https://api.blindsight.example.com/api/runtime-security/scan/tool-call \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "tool_name": "http_get",
  "arguments": {
    "url": "http://169.254.169.254/latest/meta-data/iam"
  }
}
'

{
  "uuid": "<string>",
  "reasons": [
    {
      "severity": "block",
      "detail": "<string>"
    }
  ],
  "redacted_arguments": "<unknown>",
  "pii": {
    "count": 123,
    "categories": [
      "<string>"
    ],
    "findings": [
      {
        "type": "<string>",
        "subtype": "<string>",
        "score": 0.5,
        "snippet": "<string>",
        "start": 1,
        "end": 1,
        "extra": {}
      }
    ]
  },
  "arg_bytes": 123,
  "latency_ms": 123,
  "blocked_reason": "<string>"
}

{
  "detail": {
    "code": "QUOTA_EXCEEDED",
    "message": "<string>",
    "usage": {
      "used": 123,
      "limit": 123,
      "period_end": "2023-11-07T05:31:56Z"
    },
    "upgrade_url": "<string>"
  }
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Authorizations

X-API-Key

string

header

required

Blindsight workspace API key (ak_live_…). Use this header for the scan API and the OpenAI proxy routes. The required permission scope is runtime_security.scan for scan endpoints, runtime_security.view for read-only analytics, and runtime_security.manage for configuration changes.

Body

application/json

tool_name

string

required

Maximum string length: 200

arguments

any

Tool arguments — any JSON value (dict / list / string / number).

source_app

string

Maximum string length: 128

provider

string

Maximum string length: 32

model

string

Maximum string length: 128

metadata

object

Response

Verdict + reasons

uuid

string

required

verdict

enum<string>

required

Available options:

allow,

flag,

redact,

block

reasons

object[]

required

Show child attributes

redacted_arguments

any

required

Original arguments with PII string leaves masked.

pii

object

required

Show child attributes

arg_bytes

integer

required

JSON-serialised size of the arguments.

latency_ms

integer

required

blocked_reason

string | null

Scan up to 32 items in one round-trip Wire-compatible OpenAI Chat Completions proxy

Overview

Blindsight API

Runtime Security API

Scan an agent tool invocation before executing it

Authorizations

Body

Response