---
title: "Detect prompt injection + return sanitized prompt ($0.025 USDC)"
method: POST
path: "/api/fix-injection"
tags: ["fix_injection", "paid", "evm"]
---

# Detect prompt injection + return sanitized prompt ($0.025 USDC)

`POST /api/fix-injection`

## Request

- Base URL: `https://promptqualityscore.com`
- URL: `https://promptqualityscore.com/api/fix-injection`
- Auth: one of:
  - API key in header `X-PAYMENT`
  - API key in header `Authorization`

Detect prompt injection (instruction override, role hijack, data exfiltration, delimiter attacks) and return a sanitized prompt

## Request body

- object
  - `prompt` string, required: Prompt to scan for injection attempts

## Response `200`

Scoring result

- object
  - `pqs_version` '2.0', required
  - `injection_detected` boolean, required
  - `injection_confidence` number, required
  - `injection_pattern` 'instruction_override' | 'role_hijack' | 'data_exfiltration' | 'delimiter_attack' | 'encoding_evasion' | 'jailbreak' | 'null', nullable
  - `matched_signals` string[]: Short labels for the heuristics or LLM signals that fired
  - `sanitized_prompt` string, required: Prompt with injection-like fragments removed; equals original when nothing was detected
  - `detector` 'heuristic' | 'llm' | 'heuristic+llm': Which detection path produced the verdict
  - `powered_by` string

## Other responses

- `400`: Invalid request body
- `401`: Invalid or missing bearer API key (when using bearer auth)
- `402`: Payment Required - x402 challenge when no bearer API key present. See x-payment-info.

---

[API](https://skmtc.dev/promptqualityscore/apis/pqs-prompt-quality-score.md) · [All operations](https://skmtc.dev/promptqualityscore/apis/pqs-prompt-quality-score/llms.txt) · [OpenAPI document](https://skmtc.dev/promptqualityscore/apis/pqs-prompt-quality-score/revisions/7f3f43a1c864?raw)