---
title: "Check text for known PROMPT injection IOCs"
method: GET
path: "/v1/ioc/lookup"
---

# Check text for known PROMPT injection IOCs

`GET /v1/ioc/lookup`

## Request

- Base URL: `https://nullcone.ai/api`
- URL: `https://nullcone.ai/api/v1/ioc/lookup`
- Auth: none declared

Sub-millisecond prompt injection detection via sliding-window hash lookup.

Scans the input `text` against the in-memory PROMPT IOC cache using a
token-level sliding window. Returns match details if any window matches
a known prompt injection payload.

**No API key required.** This endpoint is public to enable zero-friction
adoption by any agent, plugin, or proxy.

## Query parameters

- `text` string, required: Text to scan for known prompt injection payloads
- `threat_type` string: Threat type to check (currently: prompt)

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nullcone/apis/nullcone-api.md) · [All operations](https://skmtc.dev/nullcone/apis/nullcone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nullcone/apis/nullcone-api/revisions/c00983c87271?raw)