curl --request POST \
--url https://api.blindsight.example.com/api/runtime-security/scan/output \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"response": "<string>",
"prompt": "<string>",
"source_app": "<string>",
"provider": "<string>",
"model": "<string>",
"metadata": {}
}
'import requests
url = "https://api.blindsight.example.com/api/runtime-security/scan/output"
payload = {
"response": "<string>",
"prompt": "<string>",
"source_app": "<string>",
"provider": "<string>",
"model": "<string>",
"metadata": {}
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
response: '<string>',
prompt: '<string>',
source_app: '<string>',
provider: '<string>',
model: '<string>',
metadata: {}
})
};
fetch('https://api.blindsight.example.com/api/runtime-security/scan/output', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.blindsight.example.com/api/runtime-security/scan/output",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'response' => '<string>',
'prompt' => '<string>',
'source_app' => '<string>',
'provider' => '<string>',
'model' => '<string>',
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.blindsight.example.com/api/runtime-security/scan/output"
payload := strings.NewReader("{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.blindsight.example.com/api/runtime-security/scan/output")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.blindsight.example.com/api/runtime-security/scan/output")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}"
response = http.request(request)
puts response.read_body{
"uuid": "<string>",
"verdict": "allow",
"injection": {
"score": 0.5,
"label": "INJECTION",
"meta": {}
},
"pii": {
"count": 1,
"categories": [
"<string>"
],
"findings": [
{
"type": "<string>",
"subtype": "<string>",
"score": 0.5,
"snippet": "<string>",
"start": 1,
"end": 1,
"extra": {}
}
]
},
"redacted_text": "<string>",
"latency_ms": 1,
"text_length": 1,
"blocked_reason": "<string>"
}{
"detail": {
"code": "QUOTA_EXCEEDED",
"message": "<string>",
"usage": {
"used": 123,
"limit": 123,
"period_end": "2023-11-07T05:31:56Z"
},
"upgrade_url": "<string>"
}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "<string>"
}Scan an LLM response before returning it to the user
Same shape as /scan/input but applies the output threat model
(system-prompt leakage, jailbreak success indicators) using
separate thresholds.
curl --request POST \
--url https://api.blindsight.example.com/api/runtime-security/scan/output \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"response": "<string>",
"prompt": "<string>",
"source_app": "<string>",
"provider": "<string>",
"model": "<string>",
"metadata": {}
}
'import requests
url = "https://api.blindsight.example.com/api/runtime-security/scan/output"
payload = {
"response": "<string>",
"prompt": "<string>",
"source_app": "<string>",
"provider": "<string>",
"model": "<string>",
"metadata": {}
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
response: '<string>',
prompt: '<string>',
source_app: '<string>',
provider: '<string>',
model: '<string>',
metadata: {}
})
};
fetch('https://api.blindsight.example.com/api/runtime-security/scan/output', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.blindsight.example.com/api/runtime-security/scan/output",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'response' => '<string>',
'prompt' => '<string>',
'source_app' => '<string>',
'provider' => '<string>',
'model' => '<string>',
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.blindsight.example.com/api/runtime-security/scan/output"
payload := strings.NewReader("{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.blindsight.example.com/api/runtime-security/scan/output")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.blindsight.example.com/api/runtime-security/scan/output")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"response\": \"<string>\",\n \"prompt\": \"<string>\",\n \"source_app\": \"<string>\",\n \"provider\": \"<string>\",\n \"model\": \"<string>\",\n \"metadata\": {}\n}"
response = http.request(request)
puts response.read_body{
"uuid": "<string>",
"verdict": "allow",
"injection": {
"score": 0.5,
"label": "INJECTION",
"meta": {}
},
"pii": {
"count": 1,
"categories": [
"<string>"
],
"findings": [
{
"type": "<string>",
"subtype": "<string>",
"score": 0.5,
"snippet": "<string>",
"start": 1,
"end": 1,
"extra": {}
}
]
},
"redacted_text": "<string>",
"latency_ms": 1,
"text_length": 1,
"blocked_reason": "<string>"
}{
"detail": {
"code": "QUOTA_EXCEEDED",
"message": "<string>",
"usage": {
"used": 123,
"limit": 123,
"period_end": "2023-11-07T05:31:56Z"
},
"upgrade_url": "<string>"
}
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "<string>"
}Authorizations
Blindsight workspace API key (ak_live_…). Use this header for the
scan API and the OpenAI proxy routes. The required permission
scope is runtime_security.scan for scan endpoints,
runtime_security.view for read-only analytics, and
runtime_security.manage for configuration changes.
Body
Response
Scan complete: verdict in body
Audit-record UUID. Empty when log_events=false.
flag records a suspicion without mutating traffic: an
injection score that crossed the redact threshold without
independent corroboration, or a monitor-mode NER PII
finding. See the Verdicts guide for the full decision logic.
allow, flag, redact, block Show child attributes
Show child attributes
Show child attributes
Show child attributes
Original text with detected PII replaced by <CATEGORY> markers.
Equal to the original when verdict=allow. Use this instead
of the original when verdict=redact.
x >= 0x >= 0Short string explaining why a block verdict fired.

