Dry-run the sanitizer WITHOUT publishing or storing anything. Body: {text} — scan arbitrary text, or {kind, id, version?=staging} — scan a STORED item's markdown (collection walks members). Returns {findings:[{type,count}], clean, preview (redacted, capped), files?}.

AUTH IS PER-MODE, deliberately. The {text} mode is the pre-upload check a brand-new user needs BEFORE they have anything to publish: it reads no stored data, writes nothing, and returns only what the sanitizer found. Gating it behind publish rights — as it was until 2026-09-22 — meant the one built-in tool for inspecting a transcript before sending it was unreachable by exactly the people about to send their first one (measured: 403 for a signed-in user with no tenant, 401 anonymous). Sign-in is still required, because scrubbing is CPU-heavy and an anonymous caller could burn the box for free.

The {kind, id} mode still requires publish rights: it READS stored items out of a tenant, which is a different question from "scan this text I already have".

This endpoint is a BACKSTOP, not the control. Responsibility for what leaves a machine sits with the client: the sanitizer only knows secret SHAPES (sk_/ghp_/whsec_ and friends) and cannot know that a hostname, a customer name, or an unreleased product is sensitive to you. Use it to catch what you missed, never as the reason you did not look.