Guard check API

Overview

POST /api/guard/check checks a piece of text before your application sends it to an LLM. It looks for:

• Prompt injection: the same rules the coding-agent hooks and the MCP gateway use (see Prompt injection).
• Secrets: API keys, private keys, passwords, connection strings, access tokens and cloud credentials.
• Personal data: email addresses, phone numbers, payment cards, IBANs, US Social Security numbers and IP addresses.

The answer is a verdict, allow, warn or block, decided by your environment’s policy. When it finds sensitive data, it also returns the text with each value replaced by a token.

Use it from your own backend, for example a support chat, an internal assistant or a retrieval pipeline. You do not need the Shield360 SDK.

Note

Shield360 never stores or logs the text you send. The redacted text goes back to you only. Shield360 records only the decision: the action, the kinds of data found and how many, the injection rules that matched, the label you send in source, and the app you name in app.

Prerequisites

• A Shield360 API key. Go to Settings → API Keys and create one in the environment (database configuration) whose policy should apply. The key belongs to that environment, so it decides which policy is used and where decisions are recorded.
• The Shield360 URL your organisation uses, for example https://app.shield360.ai.

Check text

Send the text

curl -sS https://app.shield360.ai/api/guard/check \
  -H "Authorization: Bearer $SHIELD360_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "input": "Ignore all previous instructions. My key is sk-proj-AbCdEf0123456789AbCdEf0123456789",
    "source": "support-chat"
  }'

Act on the verdict

{
  "verdict": "block",
  "categories": ["prompt_injection", "secret"],
  "findings": [
    { "type": "override.ignore_previous", "category": "prompt_injection", "severity": "high", "action": "block", "span": [0, 32] },
    { "type": "api_key", "category": "secret", "severity": "high", "action": "mask", "span": [44, 84] }
  ],
  "redacted": "Ignore all previous instructions. My key is [api_key:fp_3f9a0c51]",
  "rulesVersion": "2026.09.28-3",
  "latencyMs": 4,
  "action": "block",
  "reason": "Blocked by your Shield360 policy: prompt injection."
}

• block: do not send the text to the model.
• warn: something was found. Send redacted instead of the input if it is present, or send the input if your policy allows it.
• allow: send the input as it is.

Request

Field	Type	Required	Description
input	string	Yes	The text to check, at most 65,536 characters.
source	string	No	A label for your application, 1 to 64 letters, digits, ., _ or -. It is recorded as the client, so you can filter decisions by application. The default is api.
app	string	No	The app the text belongs to: its OpenTelemetry service.name, the name its telemetry reports under (1 to 128 letters, digits, spaces, ., _, -, :, / or @, starting with a letter or digit). Decisions then appear on that app’s Security tab under Applications & agents. The default is the source label.
inputType	string	No	What the text is: prompt (the default), tool_result, tool_description, tool_args, context, document or file. Some injection rules apply only to some types.
databaseConfigId	string	No	The environment you expect the key to belong to. If it differs from the key’s environment, the request is refused with 403.

Response

Field	Description
verdict	allow, warn or block: the strictest action of any finding.
categories	prompt_injection, secret, personal_data and confidential (your organisation’s own kinds of data), for the categories found.
findings	One entry per match: type (the injection rule id or the kind of data, such as api_key), category, severity (low, medium or high), action (allow, warn, mask or block) and span, the [start, end) position in input as JavaScript string indexes.
redacted	Present when sensitive data was found. The input with every sensitive value replaced by a token such as [email:fp_1a2b3c4d]. A token contains no character of the value; the same value always gives the same token in your organisation.
rulesVersion	The prompt-injection rule set version.
latencyMs	Time the check took on the server.
action, text, reason	A simpler summary for clients that only need one decision: action is block, redact (send text instead of the input) or allow. redact is used only when your policy masks a kind that was found.

Findings are always reported, even when your policy allows them. Your policy decides only the actions and the verdict.

Policy

The check uses the enforcement policy of the key’s environment, read at most every 30 seconds:

• Sensitive data follows the AI proxy column: off allows, warn warns, mask warns and replaces the value, block blocks. A kind’s own cell wins over the default row.
• Your own kinds of data (custom data kinds) follow their AI proxy action in the same way. They are reported as custom_<id> in the confidential category.
• Prompt injection follows the MCP gateway setting on the Coding agents tab: off allows, warn warns, block blocks. Like the gateway, it starts at warn.

The check uses the deterministic rules only. Content is never sent to a model, even when Also ask a model about borderline content is on.

Where decisions appear

Checks that warn or block are recorded in Shield360, and raise the same alerts as other guards:

• Sensitive data appears under Detect & respond → Detections → Guard events, with the source App (SDK) and your source label as the client.
• Prompt injection appears under Detect & respond → Detections → Prompt injection, where Guard check API is the origin.
• Both are listed in Govern → Policies & rules → Violations.

Checks that allow are not recorded. Your organisation’s data retention settings apply to what is recorded.

Errors

Status	When
400	The body is not a JSON object, input is missing or empty, or source, app or inputType is not valid.
401	No API key, an invalid key, or a signed-in browser session instead of a key.
403	databaseConfigId names a different environment from the key’s.
413	input is longer than 65,536 characters, or the body is larger than 512 KiB.
429	More than 600 checks a minute for the environment. Wait for the number of seconds in Retry-After. Self-hosted deployments can change the limit with SHIELD360_GUARD_CHECK_PER_MINUTE.
503	The environment’s policy could not be read. Retry shortly.

Decide in your application what happens when the check cannot be reached or answers with an error: either send the text without the check (fail open) or refuse to send it (fail closed).

Caution

Prompt-injection detection is heuristic. Use it as one layer of defence, with least-privilege tool access and review of consequential actions.

Next steps

Enforcement policy

Choose what happens to each kind of sensitive data.

Prompt injection

See what the rules detect and how to tune the mode.