---
title: "Analyze prompt for security threats"
method: POST
path: "/api/guard"
tags: ["Security"]
---

# Analyze prompt for security threats

`POST /api/guard`

Classifies user inputs to detect malicious intent such as prompt injection, system prompt extraction, or data exfiltration attempts. Returns classification with violation types and CWE codes. Supports three input methods: 1) Text input via 'text' field, 2) PDF file upload via 'file' field (multipart/form-data or base64-encoded in JSON), 3) PDF file URL via 'url' field. Only one input method should be provided per request.

## Request body

- object
  - `text` string — The user input text to analyze for security threats. At least one of text, file, or url must be provided.
  - `file` string — Base64-encoded PDF file to analyze (format: data:application/pdf;base64,...). At least one of text, file, or url must be provided.
  - `url` string, uri — URL to a PDF file to download and analyze for security threats. At least one of text, file, or url must be provided.
  - `system_prompt` string — Optional system prompt that allows you to steer the guard REST API behavior and customize the classification logic.

## Response `200`

Successfully analyzed the prompt

- GuardResponse
  - `id` string, uuid — Unique identifier for this request
  - `model` string — Model used for classification
  - `choices` object[]
    - `message` object
      - `role` string
      - `content` GuardClassification
        - `classification` 'pass' | 'block', required — The classification result: 'pass' for benign requests, 'block' for malicious requests
        - `violation_types` string[], required — List of violation types if classification is 'block' (e.g., 'system_prompt_extraction', 'prompt_injection')
        - `cwe_codes` string[], required — List of applicable CWE codes if classification is 'block'
      - `reasoning` string — Optional reasoning about the classification
    - `finish_reason` string
  - `usage` Usage — Token usage statistics for the request
    - `prompt_tokens` integer — Number of tokens in the prompt
    - `completion_tokens` integer — Number of tokens in the completion
    - `total_tokens` integer — Total number of tokens used

## Other responses

- `400` — Invalid request parameters
- `401` — Authentication failed
- `402` — Payment required - no active subscription
- `404` — Team or team owner not found
- `500` — Internal server error

---

[API](https://skmtc.dev/superagent-ai/apis/superagent-api.md) · [All operations](https://skmtc.dev/superagent-ai/apis/superagent-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/superagent-ai/superagent-api/revisions/cb2f2f3f4164/schema)