> ## Documentation Index > Fetch the complete documentation index at: https://docs.blindsight.io/llms.txt > Use this file to discover all available pages before exploring further. # Scan an agent tool invocation before executing it > Regex-only — sub-millisecond. Detects: shell injection (`shell.dangerous`), destructive SQL (`sql.dangerous`), SSRF to cloud metadata (`ssrf.imds`) or private networks (`ssrf.private_network`), disallowed schemes (`ssrf.scheme`), path traversal (`path.traversal`), sensitive paths (`path.sensitive`), denylist hits (`tool.denied`), oversized arguments (`tool.args_too_large`), plus PII in argument strings. ## OpenAPI ````yaml /api-reference/openapi-runtime-security.yaml post /api/runtime-security/scan/tool-call openapi: 3.1.0 info: title: Blindsight Runtime Security API version: 1.0.0 summary: LLM firewall — prompt-injection, PII, and agent tool-call protection. description: | Drop-in firewall for LLM traffic. Three integration modes: * **Scan API** — explicit `/scan/input` and `/scan/output` calls. * **Reverse proxy** — wire-compatible with the OpenAI and Anthropic SDKs; swap the SDK's `base_url` to enable scanning at the network boundary. * **Tool-call scan** — sub-millisecond regex check on agent tool arguments before execution. See `runtime-security-guide.md` for prose docs, SDK examples, and a walk-through of verdicts and configuration. contact: name: Blindsight Support url: https://blindsight.example.com/support license: name: Proprietary servers: - url: https://api.blindsight.example.com description: Production - url: https://api.staging.blindsight.example.com description: Staging security: - ApiKeyAuth: [] - BlindsightKeyAuth: [] - SessionCookieAuth: [] tags: - name: Scan description: Single-call scan endpoints for input, output, batch, and tool calls. - name: Proxy description: Wire-compatible reverse-proxy endpoints for OpenAI and Anthropic. - name: Configuration description: Workspace-scoped firewall settings. - name: Analytics description: Read-only analytics, event log, and drift dashboard endpoints. - name: Health description: Liveness and ECS service status. paths: /api/runtime-security/scan/tool-call: post: tags: - Scan summary: Scan an agent tool invocation before executing it description: | Regex-only — sub-millisecond. Detects: shell injection (`shell.dangerous`), destructive SQL (`sql.dangerous`), SSRF to cloud metadata (`ssrf.imds`) or private networks (`ssrf.private_network`), disallowed schemes (`ssrf.scheme`), path traversal (`path.traversal`), sensitive paths (`path.sensitive`), denylist hits (`tool.denied`), oversized arguments (`tool.args_too_large`), plus PII in argument strings. operationId: scanToolCall requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ScanToolCallRequest' examples: imds: summary: SSRF — IMDS target value: tool_name: http_get arguments: url: http://169.254.169.254/latest/meta-data/iam shell: summary: Shell injection value: tool_name: run_shell arguments: cmd: rm -rf / responses: '200': description: Verdict + reasons content: application/json: schema: $ref: '#/components/schemas/ScanToolCallResponse' '402': $ref: '#/components/responses/QuotaExceeded' '422': $ref: '#/components/responses/ValidationError' components: schemas: ScanToolCallRequest: type: object required: - tool_name properties: tool_name: type: string maxLength: 200 arguments: description: Tool arguments — any JSON value (dict / list / string / number). source_app: type: string maxLength: 128 provider: type: string maxLength: 32 model: type: string maxLength: 128 metadata: type: object additionalProperties: true ScanToolCallResponse: type: object required: - uuid - verdict - reasons - redacted_arguments - pii - arg_bytes - latency_ms properties: uuid: type: string verdict: type: string enum: - allow - flag - redact - block reasons: type: array items: type: object properties: code: type: string enum: - tool.missing_name - tool.denied - tool.not_allowed - tool.args_too_large - shell.dangerous - sql.dangerous - ssrf.imds - ssrf.private_network - ssrf.scheme - path.traversal - path.sensitive severity: type: string enum: - block detail: type: string redacted_arguments: description: Original `arguments` with PII string leaves masked. pii: type: object properties: count: type: integer categories: type: array items: type: string findings: type: array items: $ref: '#/components/schemas/PIIFinding' arg_bytes: type: integer description: JSON-serialised size of the arguments. blocked_reason: type: string nullable: true latency_ms: type: integer PIIFinding: type: object properties: type: type: string subtype: type: string score: type: number minimum: 0 maximum: 1 snippet: type: string start: type: integer minimum: 0 end: type: integer minimum: 0 extra: type: object additionalProperties: true description: | For a NER-tier finding: `detector: "ner_gliner2"`, `model` (HuggingFace model id), and `action` (`"flag"` or `"redact"`, mirroring the App's `ner.mode`). Absent for regex/entropy findings. responses: QuotaExceeded: description: Workspace license quota exhausted content: application/json: schema: type: object properties: detail: type: object properties: code: type: string enum: - QUOTA_EXCEEDED message: type: string usage: type: object properties: used: type: integer limit: type: integer period_end: type: string format: date-time upgrade_url: type: string ValidationError: description: Request body failed schema validation content: application/json: schema: type: object properties: detail: type: array items: type: object properties: loc: type: array items: type: string msg: type: string type: type: string securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: | Blindsight workspace API key (`ak_live_…`). Use this header for the scan API and the OpenAI proxy routes. The required permission scope is `runtime_security.scan` for scan endpoints, `runtime_security.view` for read-only analytics, and `runtime_security.manage` for configuration changes. BlindsightKeyAuth: type: apiKey in: header name: X-Blindsight-Key description: | Alternative header for Anthropic proxy callers — `x-api-key` is reserved for the upstream provider on those routes. Accepts an Blindsight API key or `Bearer `. SessionCookieAuth: type: apiKey in: cookie name: blindsight_session description: In-app dashboard session — for browser callers only. ````