Skip to content
Patronus
Website

API Reference

Scan text, URLs, PDF, DOCX, HTML, and Markdown for prompt injection, data leakage, personal information, and threats with the Patronus API.

Scan content for prompt injection, sensitive data (DLP), personal information (PII), and threats before passing it to a model, tool, or user. Scans check injection and DLP by default; configuration controls categories and rules.

The API returns analysis results. Your application decides whether to allow, block, redact, or request review.

Service URL:

https://control.patronus.studio
Run your first scan Create an API key, submit text, and read the result.
Create a scan Submit text or files and optionally wait briefly for a result.
Understand results Job status, completion, category results, and evidence.
Working examples cURL, Python, and JavaScript examples with polling and timeouts.

How it works

Section titled “How it works”
  1. Send text, documents, a public URL, or public MCP metadata to POST /api/v1/scan with an account API key.
  2. Text without Prefer returns completed jobs with HTTP 200. URL, file, and MCP server inputs return asynchronous jobs with HTTP 202 by default. For asynchronous text, send Prefer: respond-async. Poll every accepted job. Prefer: wait=1 briefly waits for one asynchronous job before returning 200 or 202.
  3. Check both job status and completion, then apply your policy to the category results.

This reference covers authenticated scans. Website and playground scans use the same endpoint with different authentication and input limits. Account administration and device management are separate.

OpenAPI

Section titled “OpenAPI”

Download the OpenAPI 3.1 specification for request and response schemas or client generation. The endpoint and schema tables use the same specification.