---
title: "Scan text for threats (honest vocabulary — prefer for new integrations)"
method: POST
path: "/v2/scan"
---

# Scan text for threats (honest vocabulary — prefer for new integrations)

`POST /v2/scan`

## Request

- Base URL: `https://agent-shield.startekenterprises.com`
- URL: `https://agent-shield.startekenterprises.com/v2/scan`
- Auth: API key in header `X-API-Key`

Same scanner as /v1/scan, but "no_signals" replaces "clean": no_signals means no detector fired, not "safe".

## Request body

- ScanRequest
  - `content` string, required: The text to scan (max 200k chars)
  - `content_type` 'text' | 'prompt' | 'tool_output' | 'email' | 'webpage'
  - `mode` 'detect' | 'enforce': detect reports only; enforce adds an action field (block/review/allow)
  - `offsets` boolean: include character offsets (positions only, never matched text) in findings
  - `sensitivity` 'low' | 'medium' | 'high': per-request sensitivity override; default comes from the API key (POST /v1/sensitivity)
  - `nonce` string: Optional operator challenge (e.g. a UUID). Signed into the receipt for replay protection — the operator checks it matches to confirm the receipt answers their challenge.

## Response `200`

Scan result with signed receipt

- ScanResultV2
  - `verdict` 'suspicious' | 'malicious': no_signals = no detector fired, not "safe"
  - `mode` 'detect' | 'enforce'
  - `action` 'allow' | 'review' | 'block': enforce mode only
  - `sensitivity` 'low' | 'medium' | 'high'
  - `scores` object
    - `prompt_injection` number
    - `secrets_exposure` number
    - `pii_disclosure` number
    - `ssrf_risk` number
  - `findings` object[]
    - `class` string
    - `match_count` integer
    - `detail` object
  - `analyzer` string
  - `content_hash` string: Keyed HMAC of the scanned content (not correlatable across customers)
  - `scanned_chars` integer
  - `receipt` ScanReceipt: Signed tamper-evident proof-of-scan. Expires 180 days after scanned_at. A "clean"/"no_signals" verdict means "no known patterns found", not "safe".
    - `receipt_id` string
    - `scanned_at` string, date-time
    - `expires_at` string, date-time
    - `verdict` string
    - `content_hash` string: Keyed HMAC bound to this API key
    - `analyzer` string
    - `sensitivity` string
    - `key_id` string
    - `key_fp` string: Key fingerprint (first 16 hex chars of SHA-256 of the key)
    - `nonce` string: Operator challenge, when one was passed with the scan
    - `coverage` object: What each detector covered (e.g. prompt_injection is partial)
    - `sig_alg` string
    - `signature` string: HMAC-SHA256 over the canonical receipt fields
    - `verify_url` string: Human-readable verification page for this receipt

## Other responses

- `400`: Bad request
- `401`: Missing or invalid API key
- `413`: Content too large (max 200k chars)
- `429`: Daily quota exceeded

---

[API](https://skmtc.dev/startekenterprises/apis/agent-shield.md) · [All operations](https://skmtc.dev/startekenterprises/apis/agent-shield/llms.txt) · [OpenAPI document](https://skmtc.dev/startekenterprises/apis/agent-shield/revisions/858e23c6841d?raw)