> ## Documentation Index
> Fetch the complete documentation index at: https://docs.frostwolf.app/llms.txt
> Use this file to discover all available pages before exploring further.

# API overview

> Authentication, errors, and the endpoints the SDKs call. Use it directly when there is no SDK for your language.

The SDKs are a thin layer over a small HTTPS API. Everything here is what they call.

**Base URL:** `https://api.frostwolf.app`

## Authentication

Send your API key on every request, as a bearer token or in `x-api-key`.

```bash theme={null}
curl https://api.frostwolf.app/v1/me \
  -H "Authorization: Bearer fw_sk_..."
```

A missing or invalid key returns `401`. Create and revoke keys in the console. A key belongs to one workspace.

## Endpoints

| Method | Path | Purpose |
| - | - | - |
| `POST` | [`/v1/scan`](/api/scan) | Inspect a payload and return a verdict. Optionally find personal data too. |
| `POST` | [`/v1/sanitise`](/api/sanitise) | Inspect a payload and return it with matched spans redacted. |
| `POST` | [`/v1/cloak/detect`](/api/cloak-detect) | Find personal data and return where it is. |
| `POST` | [`/v1/telemetry`](/api/telemetry) | Ship batched decision records. |
| `POST` | [`/v1/captures`](/api/captures) | Ship batched request and response bodies. |
| `GET` `PATCH` | [`/v1/me`](/api/me) | Key metadata, and the capture setting. |
| `GET` | `/health` | Liveness. No authentication. |

## Conventions

* Request and response bodies are JSON, `snake_case`.
* Request bodies are limited to 1,000,000 bytes.
* Offsets in a response are inclusive at the start, exclusive at the end, and index into the text you sent, counted in **UTF-16 code units**. A client that indexes by code point, such as Python, must translate them.
* Responses that hold anything derived from your text are not cacheable.

## Errors

Every error uses one envelope, so a client can branch on `error.code`.

```json theme={null}
{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key. Send it as `Authorization: Bearer fw_sk_...`.",
    "code": "unauthorized"
  }
}
```

| Code | Status | Meaning |
| - | - | - |
| `bad_request` | 400 | The body is malformed or a field is invalid. The message says which. |
| `unauthorized` | 401 | Missing or invalid key. |
| `forbidden` | 403 | The key may not do this. |
| `capture_disabled` | 403 | Capture is off for this key. |
| `not_found` | 404 | No such route. |
| `method_not_allowed` | 405 | The route does not accept this method. |
| `not_configured` | 503 | A feature is not set up on this deployment. |
| `unavailable` | 503 | A dependency did not answer. |
| `internal_error` | 500 | Something failed on our side. |

A `503` from a route that inspects text is never a clean verdict. Treat it as "not checked".

## Plan usage

Scan responses include a `quota` block with your plan and this month's usage. The static pass is uncapped on every plan, and its limits are `null`. See [Detection](/guard/detection#plan-allowances).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.