API overview - FrostWolf

The SDKs are a thin layer over a small HTTPS API. Everything here is what they call. Base URL: https://api.frostwolf.app

Authentication

Send your API key on every request, as a bearer token or in x-api-key.

curl https://api.frostwolf.app/v1/me \
  -H "Authorization: Bearer fw_sk_..."

A missing or invalid key returns 401. Create and revoke keys in the console. A key belongs to one workspace.

Endpoints

Method	Path	Purpose
`POST`	`/v1/scan`	Inspect a payload and return a verdict. Optionally find personal data too.
`POST`	`/v1/sanitise`	Inspect a payload and return it with matched spans redacted.
`POST`	`/v1/cloak/detect`	Find personal data and return where it is.
`POST`	`/v1/telemetry`	Ship batched decision records.
`POST`	`/v1/captures`	Ship batched request and response bodies.
`GET` `PATCH`	`/v1/me`	Key metadata, and the capture setting.
`GET`	`/health`	Liveness. No authentication.

Conventions

Request and response bodies are JSON, snake_case.
Request bodies are limited to 1,000,000 bytes.
Offsets in a response are inclusive at the start, exclusive at the end, and index into the text you sent, counted in UTF-16 code units. A client that indexes by code point, such as Python, must translate them.
Responses that hold anything derived from your text are not cacheable.

Errors

Every error uses one envelope, so a client can branch on error.code.

{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key. Send it as `Authorization: Bearer fw_sk_...`.",
    "code": "unauthorized"
  }
}

Code	Status	Meaning
`bad_request`	400	The body is malformed or a field is invalid. The message says which.
`unauthorized`	401	Missing or invalid key.
`forbidden`	403	The key may not do this.
`capture_disabled`	403	Capture is off for this key.
`not_found`	404	No such route.
`method_not_allowed`	405	The route does not accept this method.
`not_configured`	503	A feature is not set up on this deployment.
`unavailable`	503	A dependency did not answer.
`internal_error`	500	Something failed on our side.

A 503 from a route that inspects text is never a clean verdict. Treat it as “not checked”.

Plan usage

Scan responses include a quota block with your plan and this month’s usage. The static pass is uncapped on every plan, and its limits are null. See Detection.

​Authentication

​Endpoints

​Conventions

​Errors

​Plan usage

Authentication

Endpoints

Conventions

Errors

Plan usage