POST /v1/scan - FrostWolf

Inspects text and returns a decision, the rules that fired, and the offsets they fired at. It never returns a pattern.

Request

string

required

The payload, flattened to one string. An empty string is allowed.

"critical" | "high" | "medium" | "low"

default:"medium"

Lowest severity that blocks. A match below it is still reported.

integer

default:"100000"

Payloads longer than this are truncated before scanning. Between 1 and 1,000,000.

boolean

default:"false"

Return the matched substring for each match. It is your own text.

object[]

Tool declarations. Supplying them turns on the allowlist check.

object[]

Calls to validate: { id?, name, arguments }, where arguments is the raw JSON string. Adds tool_validation to the verdict.

object

Ask for personal data detection in the same call. See below.

"enforce" | "report" | "off"

default:"enforce"

What the semantic pass may do. See Detection.

The `cloak` block

string[]

Entity types to detect. Defaults to every type except location and date. See Entity types.

number

default:"0.5"

Lowest detector score to accept, from 0 to 1.

boolean

default:"true"

Skip detection when the static pass has already blocked the payload.

{
  "text": "Please mail jane@example.com the invoice",
  "cloak": { "entities": ["email"] },
  "semantic": "report"
}

Response

"allow" | "block"

The detection verdict.

boolean

Convenience mirror of decision.

string | null

The rule id of the highest-severity match, or a classifier task=label pair when only the semantic pass fired.

string | null

Highest severity across all matches.

string[]

Distinct attack families that fired, in severity order.

object[]

{ signature_id, category, severity, start, end, evidence? } for each match.

integer

Characters scanned.

string

Which rule set produced the verdict.

object

The semantic pass’s answer. Present only when it was applicable. See Detection.

object

Present only when tool_calls were submitted: { allowed, severity, calls[], model_check? }.

object

Present only when you asked for detection.

Show properties

boolean

Whether the detector answered. A payload it never saw is not one it cleared.

object[]

{ type, category, start, end, confidence }. Never the value.

string

Identity of the type mapping.

number | null

Slowest detector call.

string | null

disabled, timeout, unavailable, malformed_response, too_large, or skipped_blocked.

object

Your plan and this month’s usage.

{
  "decision": "block",
  "blocked": true,
  "reason": "FW-INJ-001",
  "severity": "critical",
  "categories": ["direct_injection"],
  "matches": [
    {
      "signature_id": "FW-INJ-001",
      "category": "direct_injection",
      "severity": "critical",
      "start": 0,
      "end": 32
    }
  ],
  "scanned_chars": 32,
  "signature_version": "2026.09.16",
  "quota": {
    "plan": "free",
    "period": "2026-09",
    "aho": {
      "scans": { "used": 412, "limit": null, "remaining": null },
      "blocks": { "used": 7, "limit": null, "remaining": null }
    },
    "ai": {
      "scans": { "used": 96, "limit": 100000, "remaining": 99904 },
      "blocks": { "used": 3, "limit": 5000, "remaining": 4997 }
    },
    "overflow": 0,
    "enforcement_withheld": false
  }
}

Notes

If detection does not answer, the scan still returns the attack verdict, with cloak.ran: false. What that means for the request is up to the caller. The SDKs refuse by default.
The verdict is not cached. It is a function of the payload and the live rule set.
A rejected tool call blocks the payload. The tool verdict is folded into the payload verdict so a caller that reads blocked cannot forward a request whose call was rejected.

​Request

​The cloak block

​Response

​Notes

Request

The `cloak` block

Response

Notes