Scan text for threats (honest vocabulary — prefer for new integrations)

Same scanner as /v1/scan, but "no_signals" replaces "clean": no_signals means no detector fired, not "safe".

post/v2/scan

Request

  • Base URL: https://agent-shield.startekenterprises.com
  • URL: https://agent-shield.startekenterprises.com/v2/scan
  • Auth: API key in header X-API-Key

Request body

contentstring required

The text to scan (max 200k chars)

content_type'text' | 'prompt' | 'tool_output' | 'email' | 'webpage'
mode'detect' | 'enforce'

detect reports only; enforce adds an action field (block/review/allow)

offsetsboolean

include character offsets (positions only, never matched text) in findings

sensitivity'low' | 'medium' | 'high'

per-request sensitivity override; default comes from the API key (POST /v1/sensitivity)

noncestring

Optional operator challenge (e.g. a UUID). Signed into the receipt for replay protection — the operator checks it matches to confirm the receipt answers their challenge.

Response

Scan result with signed receipt

verdict'suspicious' | 'malicious'

no_signals = no detector fired, not "safe"

mode'detect' | 'enforce'
action'allow' | 'review' | 'block'

enforce mode only

sensitivity'low' | 'medium' | 'high'
analyzerstring
content_hashstring

Keyed HMAC of the scanned content (not correlatable across customers)

scanned_charsinteger

Example response

{
  "receipt": {
    "sig_alg": "hmac-sha256"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.